CakePHP 安全
我是网络应用程序安全性的新手。我正在 Cakephp 中开发一个应用程序，我的一位朋友告诉我有关跨站点请求伪造（CSRF）和跨站点脚本（XSS）攻击等的信息，但不确定还有多少。
我需要一些帮助来了解如何让 Cakephp 保护我的网络应用程序免受这些攻击。我们的预算很低，目前无法聘请安全顾问。我们仍在开发该应用程序，并计划在本月底发布。所以想要处理最初的事情，可以帮助我不受黑客攻击；）
I am new to Security of Web apps. I am developing an application in Cakephp and one of my friends told me about the Cross-site request forgery (CSRF) and cross-site scripting (XSS) attacks etc. not sure how many more are there.
I need some help in understanding how to make Cakephp defend my web app against these. we are low budget and we cant hire a security consulant as of now. We are still developing the app and plan to release in by the end of the month. so wanna take care of the initial stuff that can help me stand un hacked ;)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
没有（也不可能）有一种工具可以让您部署后就不必再考虑安全性。部署诸如 CakePHP 的
Sanitize::clean之类的“反 XSS”黑客技术将通过阻止有效输入来妨碍用户，同时仍然不一定使应用程序安全。输入过滤黑客充其量只是一种混淆措施，而不是安全漏洞的修复。要拥有安全的 Web 应用程序，您必须从头开始编写安全的 Web 应用程序。这主要意味着，当您将字符串从一个上下文放入另一个上下文时，要注意细节。特别是：
任何时候您将字符串写入 HTML 文本内容或属性值时，请对其进行 HTML 转义 (
htmlspecialchars())，以避免 HTML 注入导致 XSS。这不仅仅是可能包含攻击的用户输入问题，而是将纯文本放入 HTML 的正确方法。当您使用 HTML 帮助器方法时，它们应该默认处理这些元素的 HTML 转义（除非您关闭
escape）；非常不幸的是，CakePHP 教程包含将未转义字符串回显到 HTML 中以获取 HTML 帮助程序之外的文本的不良做法。任何时候您使用字符串值创建 SQL 查询时，都会对其进行 SQL 转义（使用适合您的数据库的函数，例如
mysql_real_escape_string）。如果您使用 CakePHP 的 ORM 并且没有编写自己的 SQL，则不必担心这一点。
避免使用用户输入（例如文件上传名称）来命名文件系统上的文件（而是生成干净的唯一 ID）或作为
system()命令的任何部分。包含 Security 组件以添加表单提交令牌方案，该方案将阻止CakePHP 生成的表单上的 XSRF。
There is not (and cannot be) one tool you can deploy and then never have to think about security again. Deploying ‘anti-XSS’ hacks like CakePHP's
Sanitize::cleanwill get in users' way by blocking valid input, whilst still not necessarily making the app secure. Input filtering hacks are at best an obfuscation measure, not a fix for security holes.To have a secure web application, you must write a secure web application, from the ground up. That means, primarily, attention to detail when you are putting strings from one context into another. In particular:
any time you write a string to HTML text content or attribute value, HTML-escape it (
htmlspecialchars()) to avoid HTML-injection leading to XSS. This isn't just a matter of user input that might contain attacks, it's the correct way to put plain text into HTML.Where you are using HTML helper methods, they should take care of HTML-escaping of those elements by default (unless you turn off
escape); it is very unfortunate that the CakePHP tutorial includes the bad practice of echoing unescaped strings into HTML for text outside of HTML helpers.any time you create SQL queries with string values, SQL-escape it (with an appropriate function for your database such as
mysql_real_escape_string).If you are using CakePHP's ORM and not writing your own SQL you don't have to worry about this.
avoid using user input (eg file upload names) to name files on the filesystem (generate clean unique IDs instead) or as any part of a
system()command.include the Security component to add a form submission token scheme that will prevent XSRF on forms generated by CakePHP.
Cake 的安全性相对容易（与自己编写的 php 脚本相比）：
http://www.dereuromark.de/2010/10/05/cakephp-安全/
Cake can be secured relatively easy (compared to self written php scripts):
http://www.dereuromark.de/2010/10/05/cakephp-security/