清理 PHPSESSID
我正在将 PHPSESSID 传递到 PHP 页面（通过 POST），我想知道清理输入的最佳方法是什么。 mysql_real_escape_string 就足够了吗？在处理会话 ID 时，我应该考虑什么特别的事情（我的意思是，它们只能是字母和数字，对吗？）？
编辑： 为了澄清这个问题，我真正想知道的是：如果有人篡改了 POST 数据，他是否可以发送一个恶意字符串作为 PHPSESSID，当我调用 session_id($_GET['PHPSESSID']) 时，它会做一些令人讨厌的事情？ 我个人想不出任何办法，但安全总比抱歉好……
谢谢
nico
I'm passing PHPSESSID to a PHP page (via POST) and I was wondering what's the best way of sanitizing the input. Would mysql_real_escape_string suffice? Is there anything special I should take into account when dealing with session IDs (I mean, they can only be letters and numbers right?)?
EDIT:
To clarify the question, what I really want to know is: if someone tampers with the POST data, can he send a malicious string as PHPSESSID that would do something nasty when I call session_id($_GET['PHPSESSID'])?
I personally cannot think of any, but better safe than sorry...
Thanks
nico
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
很好的想法，但据我所知，没有必要清理这个输入。 PHPSESSID 将传递给
session_id()。session_id 确实有一些限制：
但是
session_id()应该通过错误消息来处理与这些规则的偏差。 （您可能希望捕获该错误消息并在错误时终止脚本。）我看到的唯一真正的危险是当您使用例如连接到数据库的自定义会话处理程序时。在这种情况下，您将必须清理输入，例如使用
mysql_real_escape_string()。然而，这应该发生在自定义会话处理程序内部。不用说，如果您在其他上下文中使用会话 ID（例如，作为 HTML 表单中的参数），您需要对该特定输出采取必要的卫生措施（在这种情况下，
htmlspecialchars()< /代码>）。Good thinking, but as far as I can see, there is no need to sanitize this input. The PHPSESSID will be passed on to
session_id().session_id indeed has some limitations:
But
session_id()should deal with deviations from these rules with an error message. (You may want to catch that error message and terminate the script on error.)The only real danger that I can see is when you use a custom session handler that e.g. connects to a database. You will have to sanitize the input in that case, e.g. using
mysql_real_escape_string(). However, that is something that should take place inside the custom session handler.It goes without saying that if you use the session ID in some other context - say, as a parameter in a HTML form - you need to take the sanitation measures necessary for that specific output (In that case,
htmlspecialchars()).如果您确实需要通过 POST 传递会话 ID（真的不明白为什么......）并且您知道您想要允许哪些字符，我会使用正则表达式来检查。
mysql_real_escape_string用于数据库输入，需要数据库连接，并且不会清理任何内容，只是转义一些特殊字符。If you really need to pass on a session ID via POST (can´t see why really...) and you know what characters you want to allow, I would use a regular expression to check for that.
mysql_real_escape_stringis for database input and requires a database connection and is not sanitizing anything, just escaping some special characters.错误的。您应该始终使用适当的方法对要写入值的位置进行数据清理。仅当您向 MySQL 数据库写入值时，才需要使用 mysql_real_escape_string() 。
从您的评论中不清楚您到底在做什么。您的意思是您在 PHP 中使用 curl 来创建 POST 吗？如果是这样，那么如果您将 CURLOPT_POSTFIELDS 作为数组传递，则不需要进行清理（严格来说不是这样 - 但curl 会为您完成） - 但如果您将 CURLOPT_POSTFIELDS 作为字符串传递，则需要对值进行 urlencode 。
您是否将值写入浏览器以便用户可以提交该值？在这种情况下，您可以使用 htmlentities() 将值写入表单字段。
还有别的事吗？
Wrong. You should always sanitize data using an appropriate method to the place you are writing the value to. You'd only use mysql_real_escape_string() if/when you are writing a value to a MySQL database.
It's not clear from your comment what exactly you are doing. Do you mean you are using curl in PHP to create the POST? If so then there's no sanitization required (not strictly true - but curl does it for you) if you pass CURLOPT_POSTFIELDS as an array - but you need to urlencode the value if you are passing CURLOPT_POSTFIELDS as a string.
Are you writing the value out to the browser so the user can submit the value? In which case you'd use htmlentities() to write the value into the form field.
Something else?