php安全性以防止恶意软件插入

Question

I am writing a program to be run on a server that takes input from clients in the form http://mywebsite.com/program.php?input=42

I'm concerned that having the client be able to give any value in place of the 42 above could be a security risk because they could put code there that might run on my server. I would like to know if checking that this input is only alphanumberic before proceeding to do anything with it is sufficient protection. If not what should I do to be secure, if so, are there any safety concerns regarding the way in which I do this checking (for example, while checking that the input is alphanumberic could the input if it is malicious code some how get run?)

Thanks

Answer 1

It’s all about how you’re interpreting and using that $_GET['input']

If you do such a code:

exec($_GET['input']);

or

if($_GET['input']) == 66) {
     exec("rm -r /");
}

That’s obvious that people can do something dangerous. But it’s less critical than what you think.

The problem of php it’s that its type system doesn’t encourage people checking their input before using it.

An usual example is the SQL injectable code:

$db->query("SELECT * FROM table WHERE id = '. $_GET['id'].'");

Which is really unsafe.

In your example, if your input should be an integer you can check if that’s an integer:

if (!is_integer($_GET['input'])) die("invalid");