本文目录导读：
我来详细讲解PHP安全支持的各个方面：
PHP安全基础配置
php.ini 安全相关配置
; 禁用危险函数 disable_functions = exec,passthru,shell_exec,system,popen,proc_open,curl_exec,curl_multi_exec,parse_ini_file,show_source ; 错误报告设置 display_errors = Off log_errors = On error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT ; 文件上传限制 upload_max_filesize = 2M post_max_size = 8M file_uploads = On ; 会话安全 session.use_strict_mode = 1 session.use_only_cookies = 1 session.cookie_httponly = 1 session.cookie_secure = 1 ; 仅HTTPS session.cookie_samesite = "Strict"
输入验证与过滤
防止SQL注入
// 推荐：使用PDO预处理语句
$stmt = $pdo->prepare("SELECT * FROM users WHERE email = :email");
$stmt->execute([':email' => $email]);
// 或使用mysqli
$stmt = $mysqli->prepare("SELECT * FROM users WHERE email = ?");
$stmt->bind_param("s", $email);
$stmt->execute();
防止XSS攻击
// 输出HTML时转义
echo htmlspecialchars($user_input, ENT_QUOTES, 'UTF-8');
// 使用模板引擎（如Twig）自动转义
$twig->render('template.html', ['data' => $user_input]);
输入验证
// 邮箱验证
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
throw new Exception("Invalid email");
}
// URL验证
if (!filter_var($url, FILTER_VALIDATE_URL)) {
throw new Exception("Invalid URL");
}
// 自定义验证
function sanitizeString($input) {
return strip_tags(trim($input));
}
function validateInteger($input, $min, $max) {
$filtered = filter_var($input, FILTER_VALIDATE_INT, [
'options' => ['min_range' => $min, 'max_range' => $max]
]);
return $filtered !== false;
}
CSRF防护
// 生成CSRF令牌
session_start();
if (empty($_SESSION['csrf_token'])) {
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
// 在表单中包含令牌
echo '<input type="hidden" name="csrf_token" value="' . $_SESSION['csrf_token'] . '">';
// 验证令牌
if (!hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
throw new Exception("CSRF token validation failed");
}
文件上传安全
class SecureFileUploader {
private $allowedTypes = ['image/jpeg', 'image/png', 'image/gif'];
private $maxSize = 2097152; // 2MB
private $uploadDir;
public function __construct($uploadDir) {
$this->uploadDir = rtrim($uploadDir, '/') . '/';
}
public function upload($file) {
// 验证文件类型
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mimeType = finfo_file($finfo, $file['tmp_name']);
finfo_close($finfo);
if (!in_array($mimeType, $this->allowedTypes)) {
throw new Exception("Invalid file type");
}
// 验证文件大小
if ($file['size'] > $this->maxSize) {
throw new Exception("File too large");
}
// 生成安全文件名
$extension = pathinfo($file['name'], PATHINFO_EXTENSION);
$newFilename = bin2hex(random_bytes(16)) . '.' . $extension;
// 移动到安全目录
$destination = $this->uploadDir . $newFilename;
if (!move_uploaded_file($file['tmp_name'], $destination)) {
throw new Exception("File upload failed");
}
return $newFilename;
}
}
密码安全
// 密码哈希（推荐使用password_hash）
$hashedPassword = password_hash($password, PASSWORD_BCRYPT, [
'cost' => 12
]);
// 验证密码
if (password_verify($password, $hashedPassword)) {
echo "Password is valid!";
}
// 检查是否需要重新哈希
if (password_needs_rehash($hashedPassword, PASSWORD_BCRYPT, ['cost' => 12])) {
$newHash = password_hash($password, PASSWORD_BCRYPT, ['cost' => 12]);
// 更新数据库中的哈希
}
会话安全
// 安全的会话配置
ini_set('session.use_strict_mode', 1);
ini_set('session.use_only_cookies', 1);
ini_set('session.cookie_httponly', 1);
ini_set('session.cookie_secure', 1); // 仅HTTPS
ini_set('session.cookie_samesite', 'Strict');
// 会话固定攻击防护
session_start();
if (empty($_SESSION['initiated'])) {
session_regenerate_id(true);
$_SESSION['initiated'] = true;
}
// 设置会话超时
if (isset($_SESSION['last_activity']) && (time() - $_SESSION['last_activity'] > 1800)) {
session_unset();
session_destroy();
session_start();
}
$_SESSION['last_activity'] = time();
防止目录遍历
function safeFilePath($baseDir, $userPath) {
// 清理路径
$userPath = str_replace(['../', '..\\'], '', $userPath);
// 获取真实路径
$realPath = realpath($baseDir . '/' . $userPath);
// 检查是否在允许的目录内
$baseReal = realpath($baseDir);
if ($realPath === false || strpos($realPath, $baseReal) !== 0) {
throw new Exception("Invalid file path");
}
return $realPath;
}
加密与数据保护
// 对称加密
$key = random_bytes(32); // 256位密钥
$iv = random_bytes(16); // 128位IV
$encrypted = openssl_encrypt(
$plaintext,
'aes-256-cbc',
$key,
OPENSSL_RAW_DATA,
$iv
);
// 解密
$decrypted = openssl_decrypt(
$encrypted,
'aes-256-cbc',
$key,
OPENSSL_RAW_DATA,
$iv
);
安全响应头
// 设置安全响应头
header("X-Frame-Options: DENY");
header("X-Content-Type-Options: nosniff");
header("X-XSS-Protection: 1; mode=block");
header("Content-Security-Policy: default-src 'self'");
header("Strict-Transport-Security: max-age=31536000; includeSubDomains");
header("Referrer-Policy: strict-origin-when-cross-origin");
// 或一次性设置
$headers = [
"X-Frame-Options: DENY",
"X-Content-Type-Options: nosniff",
"X-XSS-Protection: 1; mode=block",
"Content-Security-Policy: default-src 'self'",
"Strict-Transport-Security: max-age=31536000; includeSubDomains",
"Referrer-Policy: strict-origin-when-cross-origin"
];
foreach ($headers as $header) {
header($header);
}
日志与监控
class SecurityLogger {
private $logFile;
public function __construct($logFile) {
$this->logFile = $logFile;
}
public function logSecurityEvent($event, $details = []) {
$logEntry = [
'timestamp' => date('Y-m-d H:i:s'),
'ip' => $_SERVER['REMOTE_ADDR'] ?? 'unknown',
'event' => $event,
'details' => json_encode($details),
'user_agent' => $_SERVER['HTTP_USER_AGENT'] ?? 'unknown'
];
$logLine = json_encode($logEntry) . PHP_EOL;
file_put_contents($this->logFile, $logLine, FILE_APPEND | LOCK_EX);
}
}
推荐的安全实践总结
- 保持更新：始终使用最新版本的PHP
- 最小权限：使用最小必要的文件权限和数据库权限
- 错误处理：不要在生产环境显示错误信息
- 验证所有输入：永远不要信任用户输入
- 使用HTTPS：所有通信使用加密连接
- 定期审计：定期检查安全漏洞和日志
- 使用安全框架：考虑使用Laravel、Symfony等成熟框架
- 备份数据：定期备份重要数据
- 限制资源：设置适当的执行时间和内存限制
- 使用WAF：考虑使用Web应用防火墙
