PHP 怎么PHP 操作审计

wen PHP项目 2026-07-31 152

本文目录导读：

PHP 怎么PHP 操作审计

基础日志审计
数据库审计
ORM 模型审计
中间件审计
实时审计监控
完整审计系统示例
最佳实践建议
安全检查清单

我来详细介绍 PHP 操作审计的几种方式：

基础日志审计

使用文件日志记录

<?php
class AuditLogger {
    private $logFile;
    public function __construct($logFile = 'audit.log') {
        $this->logFile = $logFile;
    }
    public function log($action, $userId, $details = []) {
        $logEntry = [
            'timestamp' => date('Y-m-d H:i:s'),
            'ip' => $_SERVER['REMOTE_ADDR'] ?? 'unknown',
            'user_id' => $userId,
            'user_agent' => $_SERVER['HTTP_USER_AGENT'] ?? 'unknown',
            'action' => $action,
            'details' => json_encode($details),
            'request_uri' => $_SERVER['REQUEST_URI'] ?? ''
        ];
        $logLine = implode(' | ', $logEntry) . PHP_EOL;
        file_put_contents($this->logFile, $logLine, FILE_APPEND | LOCK_EX);
    }
}
// 使用示例
$audit = new AuditLogger();
$audit->log('USER_LOGIN', 123, ['username' => 'admin', 'status' => 'success']);
$audit->log('DATA_UPDATE', 123, ['table' => 'users', 'record_id' => 456]);

数据库审计

创建审计表

CREATE TABLE audit_logs (
    id BIGINT AUTO_INCREMENT PRIMARY KEY,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    user_id INT,
    action_type VARCHAR(50),
    action_name VARCHAR(100),
    target_type VARCHAR(50),
    target_id INT,
    old_value JSON,
    new_value JSON,
    ip_address VARCHAR(45),
    user_agent TEXT,
    request_uri VARCHAR(500)
);

数据库审计类

<?php
class DatabaseAudit {
    private $db;
    public function __construct(PDO $db) {
        $this->db = $db;
    }
    public function logAction($userId, $actionType, $actionName, $targetType = null, 
                             $targetId = null, $oldValue = null, $newValue = null) {
        $stmt = $this->db->prepare("
            INSERT INTO audit_logs 
            (user_id, action_type, action_name, target_type, target_id, 
             old_value, new_value, ip_address, user_agent, request_uri)
            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
        ");
        return $stmt->execute([
            $userId,
            $actionType,
            $actionName,
            $targetType,
            $targetId,
            json_encode($oldValue),
            json_encode($newValue),
            $_SERVER['REMOTE_ADDR'] ?? null,
            $_SERVER['HTTP_USER_AGENT'] ?? null,
            $_SERVER['REQUEST_URI'] ?? null
        ]);
    }
    public function getAuditTrail($criteria = []) {
        $sql = "SELECT * FROM audit_logs WHERE 1=1";
        $params = [];
        if (!empty($criteria['user_id'])) {
            $sql .= " AND user_id = ?";
            $params[] = $criteria['user_id'];
        }
        if (!empty($criteria['action_type'])) {
            $sql .= " AND action_type = ?";
            $params[] = $criteria['action_type'];
        }
        if (!empty($criteria['date_from'])) {
            $sql .= " AND created_at >= ?";
            $params[] = $criteria['date_from'];
        }
        $sql .= " ORDER BY created_at DESC";
        $stmt = $this->db->prepare($sql);
        $stmt->execute($params);
        return $stmt->fetchAll(PDO::FETCH_ASSOC);
    }
}

ORM 模型审计

<?php
trait Auditable {
    protected static function bootAuditable() {
        static::created(function ($model) {
            static::logAudit('create', $model);
        });
        static::updated(function ($model) {
            static::logAudit('update', $model);
        });
        static::deleted(function ($model) {
            static::logAudit('delete', $model);
        });
    }
    protected static function logAudit($action, $model) {
        $audit = app(DatabaseAudit::class);
        $oldValues = $action === 'update' ? $model->getOriginal() : null;
        $newValues = $action === 'delete' ? null : $model->toArray();
        $audit->logAction(
            auth()->id(),
            $action,
            get_class($model) . '::' . $action,
            get_class($model),
            $model->id,
            $oldValues,
            $newValues
        );
    }
}
// 使用示例
class User extends Model {
    use Auditable;
    protected $fillable = ['name', 'email', 'role'];
}

中间件审计

<?php
class AuditMiddleware {
    public function handle($request, Closure $next) {
        $response = $next($request);
        // 记录敏感操作
        $sensitiveActions = ['delete', 'update', 'create'];
        $currentAction = $request->route()->getActionMethod();
        if (in_array($currentAction, $sensitiveActions)) {
            Audit::log([
                'user_id' => auth()->id(),
                'action' => $currentAction,
                'route' => $request->path(),
                'method' => $request->method(),
                'params' => json_encode($request->all()),
                'timestamp' => now()
            ]);
        }
        return $response;
    }
}

实时审计监控

<?php
class RealTimeAudit {
    private $auditQueue = [];
    public function addAuditEvent($event) {
        $this->auditQueue[] = $event;
        // 检查是否需要立即处理
        if ($this->shouldProcessImmediately($event)) {
            $this->processAuditEvent($event);
        }
    }
    private function shouldProcessImmediately($event) {
        $criticalEvents = [
            'LOGIN_FAILURE',
            'PERMISSION_DENIED',
            'SENSITIVE_DATA_ACCESS',
            'SECURITY_VIOLATION'
        ];
        return in_array($event['type'], $criticalEvents);
    }
    public function flushAuditQueue() {
        foreach ($this->auditQueue as $event) {
            $this->processAuditEvent($event);
        }
        $this->auditQueue = [];
    }
    private function processAuditEvent($event) {
        // 记录到数据库
        $this->saveToDatabase($event);
        // 如果是关键事件，发送警报
        if ($this->isCriticalEvent($event)) {
            $this->sendAlert($event);
        }
        // 记录到日志文件
        $this->logToFile($event);
    }
    private function logToFile($event) {
        $logEntry = sprintf(
            "[%s] [%s] [User: %s] %s - %s\n",
            date('Y-m-d H:i:s'),
            strtoupper($event['type']),
            $event['user_id'] ?? 'anonymous',
            $event['action'],
            json_encode($event['details'] ?? [])
        );
        error_log($logEntry, 3, '/var/log/audit.log');
    }
}

完整审计系统示例

<?php
class AuditSystem {
    private $storage;
    private $config;
    public function __construct(array $config = []) {
        $this->config = array_merge([
            'storage' => 'database',  // database, file, both
            'log_path' => '/var/log/audit/',
            'retention_days' => 90,
            'batch_size' => 100,
            'async' => false
        ], $config);
        $this->initStorage();
    }
    public function record($data) {
        $auditData = $this->prepareAuditData($data);
        if ($this->config['async']) {
            return $this->queueAudit($auditData);
        }
        return $this->storeAudit($auditData);
    }
    private function prepareAuditData($data) {
        return array_merge([
            'timestamp' => date('Y-m-d H:i:s'),
            'ip_address' => $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0',
            'user_agent' => $_SERVER['HTTP_USER_AGENT'] ?? '',
            'session_id' => session_id(),
            'request_id' => uniqid('req_', true)
        ], $data);
    }
    public function query($filters = []) {
        return $this->storage->query($filters);
    }
    public function export($format = 'csv', $filters = []) {
        $data = $this->query($filters);
        return $this->formatExport($data, $format);
    }
    public function cleanup() {
        $expireDate = date('Y-m-d', strtotime("-{$this->config['retention_days']} days"));
        return $this->storage->deleteOlderThan($expireDate);
    }
    public function getStatistics($period = '24h') {
        return $this->storage->getStatistics($period);
    }
}

最佳实践建议

关键点审计

// 记录关键业务操作
class CriticalOperationAudit {
    public function auditUserLogin($userId, $success, $reason = null) {
        if (!$success) {
            $this->recordFailedLogin($userId, $reason);
            // 连续失败锁定
            if ($this->getConsecutiveFailures($userId) >= 5) {
                $this->lockAccount($userId);
                $this->sendSecurityAlert($userId);
            }
        }
    }
    public function auditDataExport($userId, $exportType, $exportCount) {
        // 大数据量导出需要额外审计
        if ($exportCount > 10000) {
            $this->recordBulkExport($userId, $exportType, $exportCount);
            $this->notifyAdmin("Bulk data export detected");
        }
    }
}

性能优化

// 批量处理审计日志
class BatchAuditProcessor {
    private $buffer = [];
    private $bufferSize = 50;
    public function add($event) {
        $this->buffer[] = $event;
        if (count($this->buffer) >= $this->bufferSize) {
            $this->flush();
        }
    }
    public function flush() {
        if (empty($this->buffer)) {
            return;
        }
        DB::transaction(function () {
            foreach ($this->buffer as $event) {
                DB::table('audit_logs')->insert($event);
            }
        });
        $this->buffer = [];
    }
    public function __destruct() {
        $this->flush();
    }
}