安全

1、$_SERVER[‘PHP_SELF’]和$_SERVER[‘QUERY_STRING’]，而$_SERVER并没有转义，造成了注入。
例如：

Default…

php上传类（安全上传类）

[php]
<?php
//php文件上传类
//author: lenix 2014.10.7<!--more-->
header("Content-Type:text/html; charset=utf-8");
date_default_timezone_set("Asia/Shanghai");

class UploadFile
{
private $imageType=["image/gif","image/jpeg","image/jpg","image/png","image/x-png","image/bmp","image/x-ms-bmp","image/pjpeg"];//图片类型
private $fileType=["application/zip","application/msexcel","application/xml","application/vnd.ms-excel","application/vnd.openxmlformats-officedocument.wordprocessingml.document","application/mspowerpoint","application/vnd.ms-powerpoint","application/pdf","application/x-shockwave-flash","application/x-rar-compressed","application/x-rar","audio/mpeg","audio/x-ms-wma","flv-application/octet-stream","audio/x-ms-wmv","video/mp4","video/x-flv","audio/x-wav","application/msword","video/mpeg"];//文件类型
private $tmpName;
private $fileName;
private $error;
private $fileSize;//上传文件大小
private $maxSize=10000000;//最大允许上传大小
private $upName;
private $upDir="uploadfile/";//上传目录

//构造函数 默认为图片上传
function __construct($upType="image")
{
$this-&gt;tmpName = $_FILES["file"]["tmp_name"];
$this-&gt;fileName …

以下PHP内置函数能增加PHP代码的安全性：

类型转换（非函数）
(int), (integer) - 转换为整数
(bool), (boolean) - 转换为布尔值
(float), (double), (real) - 转换为浮点数
(string) - 转换为字符串
(array) - 转换为数组…

360发布通用php防护代码，其实最初是协助phpcms来防护安全用的，现在看来可以加入到任何有漏洞的网站里面，拿phpcmsv9问题，解决方案如下，其他网站以此类推！