PHP 表单验证和 XSS 安全性

Question

我是 php 新手，正在开发一个 Web 应用程序，以便遇到不同的技能、问题并找到解决它们的方法。

我现在正在创建一个注册表单并验证该表单并保护它免受 SQL 注入和 XSS 攻击。 注意我知道可以使用准备好的语句，但就我的技能水平而言，我认为从 Mysqli 程序开始对我的开发来说是最好的结果，直到充满信心为止。

所以我只想让专家看看是否有我需要删除、添加或使用的东西（除了 stmt）。

这是我的注册页面。

    <?php
    // define mqsqli real escape string function
    function _olaskee($escape) {
      $escape = htmlspecialchars ($escape, ENT_QUOTES, 'UTF-8');
      $escape = trim ($escape, ENT_QUOTES, 'UTF-8');
      $escape = stripcslashes ($escape, ENT_QUOTES, 'UTF-8');
      return $escape;

    }
    // start session
    session_start(); 

    // include database connection
    //require_once('include/connection.php');

    // if user type already detected, redirect to index.php
    if(isset($_SESSION['user_type'])){
      header('Location: index.php');
    }

    // check if we have submited / if the for as being submitted
    if(!empty($_POST['submit'])){

      //instantiate 
        $firstname = _olaskee($con, $_POST['firstname']);
        $lastname = _olaskee($con, $_POST['lastname']);
        $user_name = _olaskee($con, $_POST['user_name']);
        $user_type = _olaskee($con, $_POST['user_type']);
        $password = _olaskee($con, $_POST['password']);
        $confirm_password = _olaskee($con, $_POST['confirm_password']);

          // hash password
        $hashed_password = password_hash($password, PASSWORD_BCRYPT, ['cost' => 12]);

      // include database connection
      require_once('include/errMsg.php');  

     }
    // include page title
    $title = 'Registration Page';


    // include header layout
    require_once('include/header.php');
    ?>

    <div>

      <form name="register" action="<?php echo htmlspecialchars($_SERVER['PHP_SELF'], ENT_QUOTES, 'UTF-8'); ?>" method="post">
      <table>
        <tr>
          <td>First Name</td>
          <td><input type="text" name="firstname" value='<?php// echo htmlspecialchars ($firstname) ?>'><br><span style='color: red'><?php echo $fnErr ?></span></td>
          <?php echo $firstname ; ?>
        </tr>
        <tr>
          <td>Last Name</td>
          <td><input type="text" name="lastname" value='<?php echo htmlspecialchars ($lastname) ?>'><br><span style='color: red'><?php echo $lnErr ?></span></td>
        </tr>
        <tr>
          <td>User Name</td>
          <td><input type="text" name="user_name" value='<?php echo htmlspecialchars ($user_name) ?>'><br><span style='color: red'><?php echo $unameErr ?></span></td>
        </tr>
        <tr>

          <td>User Type</td>
          <td>
    <!-- <label for="flavor">Select User Type:</label > -->

    <select id="user_type" name='user_type' >
        <option value="">Select User Type</option>
        <option <?php echo $user_type=='rsw'?'selected':''; ?> >rsw</option>
        <option <?php echo $user_type=='sp'?'selected':''; ?> >sp</option>
    </select>
      <span style='color: red'><?php echo $u_typeErr?></span>
          </td>
        </tr>

        <tr>
          <td>Email</td>
          <td><input type="email" name="email" value='<?php echo htmlspecialchars ($email) ?>'><br /><span style='color: red'><?php echo $emailErr ?></span></td>
        </tr>
        <tr>
          <td>Password:</td>
          <td><input type="password" name="password" id="password"><br /><span style='color: red'><?php echo $passErr ?></span></td></td>
        </tr>
        <tr>
          <td>Confirm Password:</td>
          <td><input type="password" name="confirm_password" id="confirm_password"><br /><span style='color: red'><?php echo $cpassErr ?></span></td></td>
        </tr>
        <tr>
          <td></td>
          <td><input type="submit" name="submit" value="Register"><a href='index.php'> Login</a></td>
        </tr>
      </table>
      </form>   
    </div>

    <?php
    if(is_file('include/footer.php'))
    include_once('include/footer.php');
    ?>

这是我的错误信息页面

    <?php

    // error handler variable  
    $fnErr = $lnErr = $unameErr = $u_typeErr = $emailErr = $passErr = $cpassErr = '';
    $firstname = $lastname = $user_name = $user_type = $email = $password = $confirm_password = '';

          // if submit, then validate  
         $firstname = ($_POST['firstname']); 
          // set field validation for first name
          if (empty($firstname)){     
            $fnErr = 'Field empty, please enter your first name';        
          }else{
                    if (strlen($firstname) < 3){ 
                           $fnErr = 'First Name is too short';
                  }
          }
               // check if name only contains letters and whitespace
                      if (!preg_match("/^[a-zA-Z ]*$/",$firstname)) {
                        $fnErr = "Only letters and white space allowed"; 
           }


          // set field validation for last name 
         $lastname = ($_POST['lastname']);
          if (empty($lastname)){     
            $lnErr = 'Field empty, please enter your last name';        
          }else{
                    if (strlen($lastname) < 3){ 
                           $lnErr = 'Last Name is too short';
                  }
          }
                 // check if name only contains letters and whitespace
                      if (!preg_match("/^[a-zA-Z ]*$/",$lastname)) {
                        $lnErr = "Only letters and white space allowed"; 
          }

            // set field validation for user name
          $user_name = ($_POST['user_name']);
          if (empty($user_name)){     
            $unameErr = 'Field empty, please enter user name';        
          }else{
                      if (strlen($user_name) < 6){ 
                             $unameErr = 'Password is too short';
                    }else{

                      if (strlen($user_name) > 15){ 
                             $unameErr = 'Password is too long';                  
                          }
                    }
                }
             // check if name only contains letters and whitespace
                  if (!preg_match("#.*^(?=.*[a-z])(?=.*[A-Z]).*$#",$user_name)) {
                    $unameErr = "At least one CAPS, letters and white space allow";
          }


            // check if user select user type from list
           $user_type = ($_POST['user_type']);
                  if (empty($user_type)){     
                    $u_typeErr = 'Please select user type from list';        
                  }



        // set email filter validation 
           $email = ($_POST['email']);
            if (empty($email)){     
              $emailErr = 'Field empty, please enter your last name';        
            }else{ 
                     // check if e-mail address is well-formed
                     if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
                        $emailErr = "Invalid email format"; 
                     }
            }


            // set field validation for password
          $password = ($_POST['password']);
          if (empty($password)){     
            $passErr = 'Field empty, please create a password';        
          }else{
                      if (strlen($password) < 6){ 
                             $passErr = 'Password is too short';
                    }else{

                      if (strlen($password) > 15){ 
                             $passErr = 'Password is too long';                  
                          }                          
                    }                                       
                }
                      if( !preg_match("#[A-Z]+#", $password) ) {
                            $passErr = "Password must include at least one CAPS! ";
                  }else{

                     if( !preg_match("#[0-9]+#", $password) ) {
                            $passErr = "Password must include at least one NUMBER! ";
                      }  
                   }
    // //               // check if name only contains letters and whitespace
    //               if (preg_match("#.*^(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9]).*$#", $password)) {
    //                 $passErr = "Try again... Password must contain NUMBER, LETTER and CAPS"; 
    //              }


              // set field validation for confirm password
         $confirm_password = ($_POST['confirm_password']);
          if (empty($confirm_password)){     
            $cpassErr = 'Field empty, please confirm your password';        
          }else{
                    if ($password != $confirm_password) {
                        $cpassErr = 'Error... Passwords do not match';
                  }
          }    


    //   // define mqsqli real escape string function
    // function _olaskee($escape) {
    //   $escape = htmlspecialchars ($escape, ENT_QUOTES, 'UTF-8');
    //   $escape = trim ($escape, ENT_QUOTES, 'UTF-8');
    //   $escape = stripcslashes ($escape, ENT_QUOTES, 'UTF-8');
    //   return $escape;

    // }

    ?>

注意已将两页中的一些行注释掉。

还在注册页面中包含会话顶部的安全功能，不确定是否正确。

也使用了密码哈希，但我还没有在数据库上测试，但是（我用对了吗？）

请看一下并给我您的专家意见

最好的问候

Answer 1

我不是专家，但我可以给你一些笔记。在您的消毒功能_olaskee，我认为您需要了解这些功能的作用以及如何使用它

• 这里不需要stripcslashes。这个函数去掉了斜线你为什么放在这里？

• 您不需要清理密码。您将在使用它之前对其进行哈希处理，哈希处理将替换任何注入的代码

• 要清理 SQL 注入，您需要使用 mysqli_real_escape_string 它将负责清理字符串。

• 看看filter_var函数。您会发现它在清理和验证您的输入方面非常有用。此功能允许您根据指定的长度进行验证，允许某些输入中的某些 HTML 标记（如 textarea）等等

要了解如何保护自己免受攻击，您首先需要了解攻击是如何进行的。阅读有关 SQL 注入的信息，看看您是否可以通过易受攻击的代码破解您的数据库。

您也可以试试ZAP 工具。您只需传递网站的 URL 即可使用自动扫描，它会自动扫描您的网络应用程序并报告它发现的任何漏洞

学习如何制作登录系统很好。但对于现实世界的应用程序，不建议制作自己的登录系统。始终依赖经过测试和批准的软件，否则您将创建充满漏洞的系统。祝你好运！