{
$resultTable = new DbTable();
$fields = array();
$rows = array();
while ($property = mysql_fetch_field($queryResult))
{
$fields[] = array($property->name,$property->type);
}
while ($row = mysql_fetch_array($queryResult,MYSQL_NUM)) {
foreach($row as $k=>$v)
if(is_numeric($v))
$row[$k]=floatval($v);
$rows[] = $row;
}
$resultTable->fields = $fields;
$resultTable->rows = $rows;
}
class DbTable
{
var $rows;
var $fields;
var $tableName;
/**
* {
* objectType:"DbTable",
* tableName:"tableName",
* fields:[
* [col1Name,col1Type],
* [col2Name,col2Tpye],
* [col3Name,col3Type]],
* rows:[
* [row1Col1,row1Col2,row1Col3],
* [row2Col1,row2Col2,row2Col3],
* [row3Col1,row3Col2,row3Col3]]
* }
*/
function toString()
{
$jsonFields = json_encode($this->fields);
$josnRows = json_encode($this->rows);
$result = "{objectType:\"DbTable\",tableName:".$this->tableName.",fields:".$jsonFields.",rows:".$josnRows."}";
return $result;
}
}
{
var $rows;
var $fields;
var $tableName;
/**
* {
* objectType:"DbTable",
* tableName:"tableName",
* fields:[
* [col1Name,col1Type],
* [col2Name,col2Tpye],
* [col3Name,col3Type]],
* rows:[
* [row1Col1,row1Col2,row1Col3],
* [row2Col1,row2Col2,row2Col3],
* [row3Col1,row3Col2,row3Col3]]
* }
*/
function toString()
{
$jsonFields = json_encode($this->fields);
$josnRows = json_encode($this->rows);
$result = "{objectType:\"DbTable\",tableName:".$this->tableName.",fields:".$jsonFields.",rows:".$josnRows."}";
return $result;
}
}
class DataSet
{
var $tables;
/**
* {
* objectType:"DataSet",
* tables:[
* {
* objectType:"DbTable",
* tableName:"table1Name",
* fields:[
* [col1Name,col1Type],
* [col2Name,col2Tpye],
* [col3Name,col3Type]],
* rows:[
* [row1Col1,row1Col2,row1Col3],
* [row2Col1,row2Col2,row2Col3],
* [row3Col1,row3Col2,row3Col3]]
* },
* {
* objectType:"DbTable",
* tableName:"table2Name",
* fields:[
* [col1Name,col1Type],
* [col2Name,col2Tpye],
* [col3Name,col3Type]],
* rows:[
* [row1Col1,row1Col2,row1Col3],
* [row2Col1,row2Col2,row2Col3],
* [row3Col1,row3Col2,row3Col3]]
* }
* ]
* }
*/
/**
* $resultDataSet = new DataSet();
* $tables[] = DbTable1->toString();
* $tables[] = DbTable2->toString();
* $resultDataSet->tables = $tables;
* $resultDataSet->toString();
*/
function toString()
{
$result = "{objectType:\"DataSet\",tables:[";
foreach($this->tables as $k=>$v)
{
$result.= "{".$this->tables[$k]."},";
}
$result = substr($result,0,-1);
$result.="]}";
echo $result;
}
}
{
var $tables;
/**
* {
* objectType:"DataSet",
* tables:[
* {
* objectType:"DbTable",
* tableName:"table1Name",
* fields:[
* [col1Name,col1Type],
* [col2Name,col2Tpye],
* [col3Name,col3Type]],
* rows:[
* [row1Col1,row1Col2,row1Col3],
* [row2Col1,row2Col2,row2Col3],
* [row3Col1,row3Col2,row3Col3]]
* },
* {
* objectType:"DbTable",
* tableName:"table2Name",
* fields:[
* [col1Name,col1Type],
* [col2Name,col2Tpye],
* [col3Name,col3Type]],
* rows:[
* [row1Col1,row1Col2,row1Col3],
* [row2Col1,row2Col2,row2Col3],
* [row3Col1,row3Col2,row3Col3]]
* }
* ]
* }
*/
/**
* $resultDataSet = new DataSet();
* $tables[] = DbTable1->toString();
* $tables[] = DbTable2->toString();
* $resultDataSet->tables = $tables;
* $resultDataSet->toString();
*/
function toString()
{
$result = "{objectType:\"DataSet\",tables:[";
foreach($this->tables as $k=>$v)
{
$result.= "{".$this->tables[$k]."},";
}
$result = substr($result,0,-1);
$result.="]}";
echo $result;
}
}
/**
* insert into tableName (col1,col2,col3) values ('v1','v2','v3')
* jsonStr:
* {
* "rows" : [col1,col2,col3]
* }
* @param $jsonStr
* @param $tableName
*/
function rowInsert($jsonStr,$tableName){
$jsonDecode = json_decode($jsonStr);
$result = "insert into ".$tableName." values(";
foreach($jsonDecode ->rows as $k => $v){
$result .= "'".$v."',";
}
$result = substr($result,0,-1);
$result .= ")";
return $result;
}
/**
* UPDATE tableName SET col1 = col1Value, col2 = col2Value WHERE 1=1 AND primaryKey = key
* @param $jsonStr
* @param $tableName
*/
function rowUpdate($jsonStr,$tableName)
{
$jsonDecode = json_decode($jsonStr);
$sql = 'DESCRIBE `'.$tableName.'`;';
$descRs = mysql_query($sql);
$setStr = "UPDATE ".$tableName." SET";
$whereStr = " WHERE true ";
$i = 0;
while ($row = mysql_fetch_array($descRs,MYSQL_NUM)) {
if($row[3] == "PRI")
$whereStr.=" AND ".$row[0]." = '".$jsonDecode->rows[$i]."' ";
$setStr.= " ".$row[0]." = '".$jsonDecode->rows[$i]."',";
$i++;
}
$setStr = substr($setStr,0,-1);
return $setStr.$whereStr;
}
/**
* DELETE tableName WHERE 1=1 AND primaryKey = key
* @param $jsonStr
* @param $tableName
*/
function rowDelete($jsonStr,$tableName)
{
$jsonDecode = json_decode($jsonStr);
$sql = 'DESCRIBE `'.$tableName.'`;';
$descRs = mysql_query($sql);
$result = " DELETE ".$tableName." WHERE true ";
while ($row = mysql_fetch_array($descRs,MYSQL_NUM)) {
$i=0;
if($row[3] == "PRI")
$result.=" AND ".$row[0]." = '".$jsonDecode->rows[$i]."' ";
$i++;
}
return $result;
}
* insert into tableName (col1,col2,col3) values ('v1','v2','v3')
* jsonStr:
* {
* "rows" : [col1,col2,col3]
* }
* @param $jsonStr
* @param $tableName
*/
function rowInsert($jsonStr,$tableName){
$jsonDecode = json_decode($jsonStr);
$result = "insert into ".$tableName." values(";
foreach($jsonDecode ->rows as $k => $v){
$result .= "'".$v."',";
}
$result = substr($result,0,-1);
$result .= ")";
return $result;
}
/**
* UPDATE tableName SET col1 = col1Value, col2 = col2Value WHERE 1=1 AND primaryKey = key
* @param $jsonStr
* @param $tableName
*/
function rowUpdate($jsonStr,$tableName)
{
$jsonDecode = json_decode($jsonStr);
$sql = 'DESCRIBE `'.$tableName.'`;';
$descRs = mysql_query($sql);
$setStr = "UPDATE ".$tableName." SET";
$whereStr = " WHERE true ";
$i = 0;
while ($row = mysql_fetch_array($descRs,MYSQL_NUM)) {
if($row[3] == "PRI")
$whereStr.=" AND ".$row[0]." = '".$jsonDecode->rows[$i]."' ";
$setStr.= " ".$row[0]." = '".$jsonDecode->rows[$i]."',";
$i++;
}
$setStr = substr($setStr,0,-1);
return $setStr.$whereStr;
}
/**
* DELETE tableName WHERE 1=1 AND primaryKey = key
* @param $jsonStr
* @param $tableName
*/
function rowDelete($jsonStr,$tableName)
{
$jsonDecode = json_decode($jsonStr);
$sql = 'DESCRIBE `'.$tableName.'`;';
$descRs = mysql_query($sql);
$result = " DELETE ".$tableName." WHERE true ";
while ($row = mysql_fetch_array($descRs,MYSQL_NUM)) {
$i=0;
if($row[3] == "PRI")
$result.=" AND ".$row[0]." = '".$jsonDecode->rows[$i]."' ";
$i++;
}
return $result;
}
]]>
1、观察变?使用var_dump($var_name)观察变量cd与内?br /> 使用getTypeQ?var_nameQ?/span>查看所属类?br /> 使用defined("")和isset()查看帔R是否已定?br />
2、观察程序执行效率，使用WinCacheGrind载入xdebug目录中的文g
二、特D变?br /> 1?_SERVER
可用var_dump($_SERVER)观察变量作用。储存了常用信息?br />
2?_SESSION
使用session_start()之后启用会话?br />
3?_COOKIE
cookie
4?_REQUEST
保存的是post/get的变?br />
5?_POST
仅限post
6?_GET
仅限get //$_GET["username"]
7?_FILES
form提交的文?br />
8、定义常量：
define("name","...");//帔R只能包含标量数据Q只能在声明的时候赋|q不能在q行时改?br />
9、几个体l常量：
__FILE__、__LINE__、PHP_VERSION、PHP_OS
三、类的说?br /> 1、一个简易的c?br /> class test{
private $pro1;
public static $pro2;
function do1(){
}
public static function do2(){
}
}
非静态的调用
$t = new test();
$t->pro1;
$t->do1();
静态调?br /> test::pro2;
test::do2();
2、构造函数和析构函数
function __construct() {
}
function __destruct() {
}
四、自动加载类
1、当调用的类未找刎ͼ会自动调用以下函数。如果调用之后类扑ֈ了，则l执行；仍旧未找刎ͼ则报?br /> function __autoload($class_name){
include $class_name.'.php';
}
2、spl_autoload_register可以注册一?__autoload函数
自动加蝲cd以代码变得更优雅，无需提前includeQ但是如果有复杂的\径则导致性能下降
(盘IO是媄响PHP性能的一个要点，另一个是数据?
五、数l?br /> 1、数l是一个K/Vl构的变量，可以存储多类型的数据Q多数据cdQ?br /> 2、多l数l类似JSON格式Q长度可?br /> 3、数l的声明Q烦引数l：数组的烦引值是整数Q?开?br /> 兌数组Q数l以字符串作为烦引?br /> 4、数l遍历：①for($i=0;$i<count($arr);$i++)
echo "\$arr["."]=".$arr[$i]."<br>";
②for($arr as $value)
echo $value."<br>";
for($arr as $key=>$value)
echo "\$arr[".$key."]=".$value."<br>";
六、PHP手册
遇上不认识的函数h开PHP手册Q用烦引功能快速查扑և数参数和q回倹{也可用netbeans自动提示功能参阅其详情?br />
]]>
漏洞介绍Qnginx是一N性能的web服务器，使用非常q泛Q其不仅l常被用作反向代理，也可以非常好的支持PHP的运行?0sec发现其中存在一个较Z重的安全问题Q默认情况下可能D服务器错误的Q何类型的文g以PHP的方式进行解析，q将D严重的安全问题，使得恶意的攻击者可能攻h持php的nginx服务器?/p>
漏洞分析Qnginx默认以cgi的方式支持php的运行，譬如在配|文件当中可以以
location ~ ".php$ {
root
html;
fastcgi_pass 127.0.0.1:9000;
fastcgi_index
index.php;
fastcgi_param SCRIPT_FILENAME
/scripts$fastcgi_script_name;
include
fastcgi_params;
}
的方式支持对php的解析，location对请求进行选择的时候会使用URI环境变量q行选择Q其中传递到后端Fastcgi的关键变?
SCRIPT_FILENAME由nginx生成?fastcgi_script_name军_Q而通过分析可以看到$fastcgi_script_name是直接由URI环境变量控制的，q里是产生问题的点。而ؓ了较好的支持PATH_INFO的提取，在PHP
的配|选项里存在cgi.fix_pathinfo选项Q其目的是ؓ了从SCRIPT_FILENAME里取出真正的脚本名?br />
那么假设存在一个http://www.80sec.com/80sec.jpgQ我们以如下的方式去讉K
http://www.80sec.com/80sec.jpg/80sec.php
会得到一个URI
/80sec.jpg/80sec.php
l过location指oQ该h会交给后端的fastcgi处理Qnginx为其讄环境变量SCRIPT_FILENAMEQ内容ؓ
/scripts/80sec.jpg/80sec.php
而在其他的webserver如lighttpd当中Q我们发现其中的SCRIPT_FILENAME被正的讄?br />
/scripts/80sec.jpg
所以不存在此问题?br />
后端的fastcgi在接受到该选项Ӟ会根据fix_pathinfo配置军_是否对SCRIPT_FILENAMEq行额外的处理，一般情况下如果不对fix_pathinfoq行讄媄响用PATH_INFOq行路由选择的应用，所以该选项一般配|开启。Php通过该选项之后查扑օ中真正的脚本文g名字Q查扄方式也是查看文g是否存在Q这个时候将分离出SCRIPT_FILENAME和PATH_INFO分别?br />
/scripts/80sec.jpg?0sec.php
最后，?scripts/80sec.jpg作ؓ此次h需要执行的脚本Q攻击者就可以实现让nginx以php来解析Q何类型的文g了?/font>
POCQ? 讉K一个nginx来支持php的站点，在一个Q何资源的文g如robots.txt后面加上/80sec.phpQ这个时候你可以看到如下的区别：
讉Khttp://www.80sec.com/robots.txt
HTTP/1.1
200 OK
Server: nginx/0.6.32
Date: Thu, 20 May 2010 10:05:30
GMT
Content-Type: text/plain
Content-Length: 18
Last-Modified: Thu, 20
May 2010 06:26:34 GMT
Connection: keep-alive
Keep-Alive:
timeout=20
Accept-Ranges:
bytes
讉K讉Khttp://www.80sec.com/robots.txt/80sec.php
HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Thu, 20 May 2010
10:06:49 GMT
Content-Type: text/html
Transfer-Encoding:
chunked
Connection: keep-alive
Keep-Alive: timeout=20
X-Powered-By:
PHP/5.2.6
其中的Content-Type的变化说明了后端负责解析的变化，该站点就可能存在漏洞?/p>
漏洞厂商Qhttp://www.nginx.org
解决ҎQ?/p>
我们已经试联系官方Q但是此前你可以通过以下的方式来减少损失
关闭cgi.fix_pathinfo?
或?br />
if ( $fastcgi_script_name ~ "..*"/.*php ) {
return
403;
}
文章来源:80SEC
]]>