延迟执行 PHP 脚本

发布于 2024-07-13 12:48:07 字数 547 浏览 4 评论 0原文

阻止机器人、恶意用户等过快执行 php 脚本的最佳方法是什么？如果我使用 usleep() 或 sleep() 函数暂时“什么也不做”（就在所需的代码执行之前），可以吗？简直愚蠢，有更好的方法吗？

示例：

function login() {
 //enter login code here
}

function logout() {
 //enter logout code here
}

如果我只是在登录和注销代码之前添加 usleep(3000000) ，可以吗？或者是否有更好、更明智的方法来实现我想要实现的目标？

编辑：根据下面的建议，usleep或sleep是否只会导致处理器脱离当前用户正在执行的当前脚本，或者是否会导致它脱离整个服务？即，如果一个用户+脚本调用sleep/usleep，那么所有并发的用户+脚本也会被延迟吗？

原文

What is the best way to stop bots, malicious users, etc. from executing php scripts too fast? Is it ok if I use the usleep() or sleep() functions to simply do "nothing" for a while (just before the desired code executes), or is that plain stupid and there are better ways for this?

Example:

function login() {
 //enter login code here
}

function logout() {
 //enter logout code here
}

If I just put, say, usleep(3000000) before the login and logout codes, is that ok, or are there better, wiser ways of achieving what I want to achieve?

edit: Based on the suggestions below, does then usleep or sleep only cause the processor to disengage from the current script being executed by the current user, or does it cause it to disengage from the entire service? i.e. If one user+script invokes a sleep/usleep, will all concurrent users+scripts be delayed too?

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

缺⑴份安定 2024-07-20 12:48:07

大多数 Web 服务器（例如 Apache）的工作方式是维护工作线程的集合。当执行 PHP 脚本时，一个线程运行 PHP 脚本。

当您的脚本执行 sleep(100) 时，脚本需要 100 秒才能执行。这意味着您的工作线程被占用 100 秒。

问题是，您的工作线程数量非常有限 - 假设您有 10 个线程，并且有 10 个人登录 - 现在您的 Web 服务器无法提供任何进一步的响应。

限制登录速率（或其他操作）的最佳方法）是使用某种快速内存存储（memcached 非常适合此操作），但是这需要运行单独的进程并且非常复杂（如果你运行像 Facebook 这样的东西，你可能会这样做......）。

更简单的是，您可以有一个数据库表来存储 user_id 或 ip_address、first_failed 和 failure_counter。

每次登录失败时，您（用伪代码）都会这样做：

if (first_failed in last hour) and (failure_counter > threshold):
    return error_403("Too many authentication failures, please wait")
elseif first_failed in last hour:
    increment failure_counter
else:
    reset first_failed to current time
    increment failure_counter

也许不是最有效的，并且有更好的方法，但它应该很好地阻止暴力破解。使用memcached基本是一样的，只不过数据库换成了memcached（速度更快）

The way most web servers work (Apache for example) is to maintain a collection of worker threads. When a PHP script is executed, one thread runs the PHP script.

When your script does sleep(100), the script takes 100 seconds to execute.. That means your worker thread is tied up for 100 seconds.

The problem is, you have a very finite number of worker-threads - say you have 10 threads, and 10 people login - now your web-server cannot serve any further responses..

The best way to rate-limit logins (or other actions) is to use some kind of fast in-memory storage thing (memcached is perfect for this), but that requires running separate process and is pretty complicated (you might do this if you run something like Facebook..).

Simpler, you could have a database table that stores user_id or ip_address, first_failed and failure_counter.

Every time you get a failed login, you (in pseudo code) would do:

if (first_failed in last hour) and (failure_counter > threshold):
    return error_403("Too many authentication failures, please wait")
elseif first_failed in last hour:
    increment failure_counter
else:
    reset first_failed to current time
    increment failure_counter

Maybe not the most efficient, and there is better ways, but it should stop brute-forcing pretty well. Using memcached is basically the same, but the database is replaced with memcached (which is quicker)

回复收藏 0 原文