PHP安全的方式以表格形式放置URL，以防止受到xss /跨站点请求伪造CSRF攻击

Question

I am using html form in php as following:

<form method="post" action="<?php echo($_SERVER['PHP_SELF']); ?>">
.
.
</form>

But when i test for CSRF / XSS attack, it is very easy to inject this page. Is there any good way to protect from such kind of attacks?

Answer 1

For CSRF Protection --

• Use csrf token, now what is csrf token it is nothing but a unique value which will be generated by your application for each form submission event and attache to each and every form as input hidden value. and at the same time application need to set that csrf token value into a SESSION so that at the time of form submission it can check the token value is valid or not. This is one way you can protect CSRF attack.

For XSS Protection --

• 1st thing is set form validation both front end and back end
• you can use different php filter methods
• Use htmlspecialchars() which Convert special characters to HTML entities at the time of retrieving the data or showing the data

Answer 2

The only safe way to protect against CSRF is to associate a secret key (csrf token) with each request, and then check it upon form submit. You can put it in a hidden input.

Answer 3

Primary Defenses :

Option #1: Use of Prepared Statements (Parameterized Queries)

Option #2: Use of Stored Procedures

Option #3: Escaping all User Supplied Input

Additional Defenses :

Also Enforce: Least Privilege

Also Perform: White List Input Validation

For option #3 Use this function:

to use the function mysqli_real_escape_str, you need the mysqli , to get it in codeigniter

function get_mysqli() { 
  $db = (array)get_instance()->db;
  return mysqli_connect('localhost', $db['username'], $db['password'],$db['database']);
}

public function filter($data)
    {
        $data = trim(htmlentities(strip_tags($data)));
        // print_r($data);
        if (get_magic_quotes_gpc()){
            // print_r($data);
            $data = stripslashes($data);
            // print_r($data);
            $data = mysqli_real_escape_string(get_mysqli(),$data);
            // print_r($data);
        }
        return $data;       
    }

Loop user inputs as:

foreach($_POST as $key => $value) {
    $array[$key] = $this->filter($value);
}

Check this out:

https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet