用户输入，PHP，Javascript和安全

我正在致力于一个方向服务，其中用户输入地址和地址，并获取路线表（提供转弯信息）以及显示路线的地图。用户输入，PHP，Javascript和安全

下面是完整的源代码（getdirections.php）：

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> 
<html xmlns="http://www.w3.org/1999/xhtml"> 
<head> 
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /> 
<title>Directions</title> 
<style> 
    * { font-family: Verdana; font-size: 96%; } 
    label { width: 15em; float: left; } 
    label.error { display: block; float: none; color: red; vertical-align: top; } 
    p { clear: both; } 
    .submit { margin-left: 12em; } 
    em { font-weight: bold; padding-right: 1em; vertical-align: top; } 
</style> 
<script src="jquery-1.3.1.js" type="text/javascript"> 
</script> 
<script src="http://maps.google.com/maps?file=api&amp;v=2&amp;sensor=false& amp;key=[Your Key Here]" 
type="text/javascript"> 
</script> 
</head> 
<body onunload="GUnload()"> 
<div id="container">  
<div id="directform"> 
    <form id="direct" action="getdirections.php" method="get"> 
<p><label for="loc1">From Here:</label> 
<input id="loc1" type="text" name="location1" class="required" /></p> 
<p><label for="loc2">To Here:</label> 
<input id="loc2" type="text" name="location2" class="required" /></p> 
<p><input type="submit" value="Search" /></p> 
    </form> 
</div> 
<?php 
function filterInput ($input) { 
$replacement = ','; 
$input = preg_replace('/(\n|\r)+/', $replacement, $input); 
$replacement = " "; 
$input = preg_replace('/(\t)+/', $replacement, $input); 
$inputarray = explode(' ', $input); 
foreach ($inputarray as $i => $value) { 
    $ch = ''; 
    if ($value[strlen($value)-1] == ',') { 
    $ch = ','; 
    $value = substr($value, 0, -1); 
    } 

$value = 
     preg_replace('/^(\&|\(|\)|\[|\]|\{|\}|\"|\.|\!|\?|\'|\:|\;)+/', "", $value); 

$inputarray[$i] = 
     preg_replace('/(\&|\(|\)|\[|\]|\{|\}|\"|\.|\!|\?|\'|\:|\;)+$/', "", $value); 
$inputarray[$i] = $inputarray[$i].$ch; 
} 
$filteredString = implode(" ", $inputarray); 
return $filteredString; 
} 

?> 
</div>  
<table class="directions"> 
<tr> 
<td valign="top"> 
    <div id="directions" style="width: 100%"></div> 
</td> 
</tr> 
<tr> 
<td valign="top"> 
<div id="map_canvas" style="width: 250px; height: 400px"></div> 
</td> 
</tr> 
<td valign="top"> 
<div id="directions_url"></div> 
</td> 
</table> 

<noscript><b>JavaScript must be enabled in order for you to use Google Maps.</b> 
    However, it seems JavaScript is either disabled or not supported by your browser. 
    To view Google Maps, enable JavaScript by changing your browser options, and then 
    try again. 
</noscript> 
<script type="text/javascript"> 

// This programming pattern limits the number of global variables 
// Thus it does not pollute the global namespace 
// for_directions is the only global object here. 
for_directions = function(){ 

// The map is loaded into the div element having id specified by mapid 
// private variable 
var mapid = "map_canvas"; 

// The direction listing is loaded into the div element having id specified by directionsid. 
// private variable 
var directionsid = "directions"; 

// From here 
// private variable 
var location1; 

// To here 
// private variable 
var location2; 

// The functions (init and addevent) are public methods of for_directions object 
return { 
    // Called on loading of this page 
    // public method 
    init: function(){ 
     location1 = "<?= filterInput($_GET['location1']) ?>" || 0; 
     location2 = "<?= filterInput($_GET['location2']) ?>" || 0; 
     var directions = document.getElementById(directionsid); 
     directions.innerHTML = "Please check the address and try again"; 

     if (GBrowserIsCompatible() && location1 != 0 && location2 != 0){ 
      mapAddress(location1, location2); 
      } 
    }, 

    // This method is cross browser compliant and is used to add an event listener 
    // public method 
    addEvent:function(elm,evType,fn,useCapture){ 
     if(elm.addEventListener){ 
      elm.addEventListener(evType, fn, useCapture); 
      return true; 
     } else if (elm.attachEvent) { 
      var r = elm.attachEvent('on' + evType, fn); 
      return r; 
     } else { 
      elm['on' + evType] = fn; 
     } 
    } 
}; 

// Called from init 
// private method 
    function mapAddress (address1, address2){ 
     var geocoder = new GClientGeocoder(); 
    var directions = document.getElementById(directionsid); 
    var i = 0; 

    geocoder.getLatLng(address1, function(point1){ 
     if (point1){ 
     geocoder.getLatLng (address2, function(point2){ 
      if (point2){ 
      getDirections(); 
      } else { 
      directions.innerHTML = "Please check the address and try again"; 
      } 

     }); 
     } else { 
     directions.innerHTML = "Please check the address and try again"; 
     } 

    }); 
} 

// Called from mapAddress to load the directions and map 
// private method 
function getDirections(){ 
    var gmap = new GMap2(document.getElementById(mapid)); 
    var gdir = new GDirections(gmap,document.getElementById(directionsid)); 
    gdir.load("from: " + location1 + " to: " + location2, 
      { "locale": "en_US" }); 
    generateURL(); 
} 

function generateURL(){ 
    var url = "http://maps.google.com/maps?saddr="; 
    url += location1; 
    url += "&daddr="; 
    url += location2; 
    var a = $("<a></a>").attr('href',url); 
    $(a).text("Google Maps"); 
    $("#directions_url").append(a); 
} 
}(); 
// The(); above results in the function being interpreted by the browser just before the page is loaded. 

// Make for_directions.init as the listener to load event 
// Note that the init method is public that why its accessible outside the object scope 
for_directions.addEvent(window, 'load', for_directions.init, false); 
</script> 
</body> 
</html>

如果你尝试在你的系统它的名字作为getdirections.php此代码。唯一需要更改的是Google Maps API密钥。你可以得到钥匙here。

一旦生成放在关键参数的键（复制到下面以方便行）：

<script src="http://maps.google.com/maps?file=api&amp;v=2&amp;sensor=false& amp;key=[Your key here]" 
type="text/javascript">

正如从上面的代码中看到的那样，我打通PHP输入和做在Javascript的处理。现在，我不希望用户放弃任何类型的输入（javscript，危险的HTML等）。我尝试在PHP中使用urlencode函数。但是，编码的用户输入不被JavaScript代码接受，即使输入正确也不会失败。

作为解决此问题的一种解决方法，我在PHP中编写了一个filterInput函数，它将替换/删除某些字符并阻止用户试图通过输入尝试执行Javascript代码的任何尝试。

这工作得很好。但是，当用户尝试提供恶意输入时，比如说“+ alert（”hello“）+”，包括开始和结束引号时，filterInput函数会剪切前导和尾部引号，结果字符串如下所示：

+alert("hello")+

当下面的代码执行现在：像

location1 = "<?= filterInput($_GET['location1']) ?>" || 0;

PHP substitues其返回值的函数调用如下：在S的

location1 = "+alert("hello")+" || 0;

执行与上面的行一起发生错误（错过;之前的声明）

请注意，如果我没有修剪引号，并直接使用$ _GET ['location1']我会得到。

location1 = ""+alert("hello")+"" || 0;

alert（“hello”）会被执行!!

所以，我正在修复。如果我过滤输入，我在某些用户输入上得到一个javascript错误，如果我不过滤输入，我允许用户执行任何类型的JavaScript。

我的问题，然后是：

什么是处理在网络上输入正确的和安全的方式？
这种用户输入是否跨语言（从PHP到Javascript）可以吗？
除了用户能够执行JavaScript之外，其他类型的安全威胁所做的是这段代码是否容易受到攻击？

感谢您的阅读！

请帮忙。

来源

2009-07-08 ardsrk

为什么你关心用户在自己的会话中执行任意的JS？无论如何，他们可以用Firebug等来做到这一点。常见的攻击媒介将包括对服务器端进程（包括PHP和任何数据库服务）或其他用户会话（包括XSS攻击）的攻击。如果人们想要自己的浏览器，为什么要阻止他们？事实上，在这种情况下，我没有看到任何服务器端处理的真正需求 - 您可以将init函数作为onClick处理程序运行，并使用JS获取表单值。 – steamer25 2009-07-08 18:39:32

你可以尝试php中的json_encode和javascript中的eval。

如果JS在输入完成的同一台机器上执行，我不会太在意安全性。黑客可以破解他自己的机器，应该没问题。

来源

2009-07-08 18:32:55 SorinV

用户输入，PHP，Javascript和安全

回答

相关问题