PHP+PHPMyAdmin 可以构建大型网站吗？
我想请教一下如何建立安全的网站。如果我想建立一些大型网站（大约10万用户使用）。
我如何管理安全？只有 PHP 和 PHPMyAdmin 就够了吗？
并告诉我黑客攻击我的网站的方式。以及如何防护？
谢谢！
I would like to ask you about how to build secure website. If I want to build some website that large scale (around 100,000 users use).
How do I manage about security? Only PHP and PHPMyAdmin is enough?
and tell me about the way that hacker could to attack my site. and how to protect?
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您应该更担心 Web 服务器的安全性和您自己代码的漏洞，而不是 PHP 本身。 SQL 注入是 PHP/MySQL 中最令人担忧的问题，但这完全在您的控制范围内来防止。
设置数据库时应该做的第一件事是为表名添加前缀，并尽量避免使用易于猜测的表名和字段。
将您的数据库用户帐户限制为运行应用程序所需的最少权限。
始终对密码等敏感数据进行加密。
在将数据传递到查询之前验证数据。一个好的起点是使用 PHP 转义字符串。更多信息请参见： http://php.net/manual/en/ function.mysql-real-escape-string.php
确保返回的任何 MySQL 错误不会向用户提供有关数据库结构的任何信息。
最后，您应该了解 MySQL 并能够从命令行运行查询 - 让您能够 100% 管理数据库，而无需使用 PHPMyAdmin！
You should be more worried about the security of the web server and vulnerability of your own code rather than PHP itself. SQL injection is the biggest concern when it comes to PHP/MySQL, however this is entirely in your control to prevent.
The first thing you should do when setting up a database is to prefix your table names and try to stay away from using easy-to-guess table names and fields.
Limit your database user account to the least amount of privileges necessary to run your application.
ALWAYS encrypt sensitive data such as passwords.
Validate data before passing it into queries. A good place to start is escaping your strings using PHP. More here: http://php.net/manual/en/function.mysql-real-escape-string.php
Ensure that any MySQL errors returned don't give users any information about your database structure.
And finally, you should know MySQL and be able to run queries from the command line - giving you the ability to manage the databases 100% without the use of PHPMyAdmin!
只有当您的网站实际达到 100,000 个用户时，才需要担心这一点。
至于安全基础知识，我建议您阅读：
跨站脚本
< a href="http://en.wikipedia.org/wiki/SQL_injection" rel="nofollow">SQL 注入
首先，phpMyAdmin 有一个选项仅允许某些 IP 地址访问。所以，我建议你调查一下。
Worry about a 100,000 users only when your site actually gets to that point.
As far as basics of security go, I suggest you read up on:
Cross Site Scripting
SQL Injections
For a start, phpMyAdmin has an option to allow only certain IP addresses access. So, I suggest you look into that.