Question

我对这些功能有疑问：$ _SERVER [“REQUEST_URI”]。有人可以告诉我使用它是否安全（我在论坛中用于新主题）？

<form name="vpid" action="<?php echo htmlspecialchars($_SERVER["REQUEST_URI"]);?>"  method="post">

谢谢

Answer 1

我首先要说的是，在这种情况下，你可能不需要REQUEST_URI。

如果您希望表单回发到当前页面，action属性可以设置为空字符串或点;您不需要指定整个当前网址。

如果您确实需要，答案是肯定的，REQUEST_URI是安全的。

$_SERVER中的很多值不是安全的，所以要小心谨慎，但REQUEST_URI是安全的，因为它代表的是地址曾经去过这个网站;如果地址无效，那么用户将无法首先到达服务器。

其他$_SERVER字段可能被黑客攻击;欺骗REMOTE_HOST和HTTP_REFERER之类的东西是微不足道的，所以你永远不要依赖它们是可靠的，但REQUEST_URI应该是安全的。

这里最重要的是你无论如何都不应该真的需要它。

Answer 2

已经是一个老问题了，但是不，您不能信任$_SERVER['REQUEST_URI']，因为它仅在apache服务器上可用。

Drupal在7.x version上的处理方式如下

function request_uri() {
  if (isset($_SERVER['REQUEST_URI'])) {
    $uri = $_SERVER['REQUEST_URI'];
  }
  else {
    if (isset($_SERVER['argv'])) {
      $uri = $_SERVER['SCRIPT_NAME'] . '?' . $_SERVER['argv'][0];
    }
    elseif (isset($_SERVER['QUERY_STRING'])) {
      $uri = $_SERVER['SCRIPT_NAME'] . '?' . $_SERVER['QUERY_STRING'];
    }
    else {
      $uri = $_SERVER['SCRIPT_NAME'];
    }
  }

  // Prevent multiple slashes to avoid cross site requests via the Form API.
  $uri = '/' . ltrim($uri, '/');
  return $uri;
}

还有WordPress版本from v3.0.0 up to now。其目的是填补空白并标准化$_SERVER变量。

function wp_fix_server_vars() {
    global $PHP_SELF;

    $default_server_values = array(
        'SERVER_SOFTWARE' => '',
        'REQUEST_URI'     => '',
    );

    $_SERVER = array_merge( $default_server_values, $_SERVER );

    // Fix for IIS when running with PHP ISAPI.
    if ( empty( $_SERVER['REQUEST_URI'] ) || ( 'cgi-fcgi' !== PHP_SAPI && preg_match( '/^Microsoft-IIS\//', $_SERVER['SERVER_SOFTWARE'] ) ) ) {

        if ( isset( $_SERVER['HTTP_X_ORIGINAL_URL'] ) ) {
            // IIS Mod-Rewrite.
            $_SERVER['REQUEST_URI'] = $_SERVER['HTTP_X_ORIGINAL_URL'];
        } elseif ( isset( $_SERVER['HTTP_X_REWRITE_URL'] ) ) {
            // IIS Isapi_Rewrite.
            $_SERVER['REQUEST_URI'] = $_SERVER['HTTP_X_REWRITE_URL'];
        } else {
            // Use ORIG_PATH_INFO if there is no PATH_INFO.
            if ( ! isset( $_SERVER['PATH_INFO'] ) && isset( $_SERVER['ORIG_PATH_INFO'] ) ) {
                $_SERVER['PATH_INFO'] = $_SERVER['ORIG_PATH_INFO'];
            }

            // Some IIS + PHP configurations put the script-name in the path-info (no need to append it twice).
            if ( isset( $_SERVER['PATH_INFO'] ) ) {
                if ( $_SERVER['PATH_INFO'] == $_SERVER['SCRIPT_NAME'] ) {
                    $_SERVER['REQUEST_URI'] = $_SERVER['PATH_INFO'];
                } else {
                    $_SERVER['REQUEST_URI'] = $_SERVER['SCRIPT_NAME'] . $_SERVER['PATH_INFO'];
                }
            }

            // Append the query string if it exists and isn't null.
            if ( ! empty( $_SERVER['QUERY_STRING'] ) ) {
                $_SERVER['REQUEST_URI'] .= '?' . $_SERVER['QUERY_STRING'];
            }
        }
    }

    // Fix for PHP as CGI hosts that set SCRIPT_FILENAME to something ending in php.cgi for all requests.
    if ( isset( $_SERVER['SCRIPT_FILENAME'] ) && ( strpos( $_SERVER['SCRIPT_FILENAME'], 'php.cgi' ) == strlen( $_SERVER['SCRIPT_FILENAME'] ) - 7 ) ) {
        $_SERVER['SCRIPT_FILENAME'] = $_SERVER['PATH_TRANSLATED'];
    }

    // Fix for Dreamhost and other PHP as CGI hosts.
    if ( strpos( $_SERVER['SCRIPT_NAME'], 'php.cgi' ) !== false ) {
        unset( $_SERVER['PATH_INFO'] );
    }

    // Fix empty PHP_SELF.
    $PHP_SELF = $_SERVER['PHP_SELF'];
    if ( empty( $PHP_SELF ) ) {
        $_SERVER['PHP_SELF'] = preg_replace( '/(\?.*)?$/', '', $_SERVER['REQUEST_URI'] );
        $PHP_SELF            = $_SERVER['PHP_SELF'];
    }
}

Symfony HttpFoundation方法稍微复杂一些。

$ _SERVER [＆＃34; REQUEST_URI＆＃34;]安全吗？

2 个答案: