It appears as an attempted attack, yes. Depending on your application, it's hard to tell you what you should do, as we have no idea what you have already done.
But one thing is certain, always validate your user input. Assuming you're using the GET variables in your application, here's a few things to keep in mind
Depending on what $_GET['a'] should contain, always make sure it does contain that (and only that) before processing it. This includes making sure it's a number (is_numeric) or that it matches a specific pattern (regex), length or some other predefined criteria.
Regarding $_GET['file'] - if you have a script that serves files based on $_GET['file'], make sure you only include files in your current directory. That means, disallow slashes / and dotdot's ...
Last, again, validate your input, but assuming you don't use eval() or have any other user input executed, you seem safe.
发布评论
评论（3）
是的，这看起来像是一次未遂攻击。根据您的应用程序，很难告诉您应该做什么，因为我们不知道您已经做了什么。
但有一点是确定的，始终验证您的用户输入。假设您在应用程序中使用
GET变量，请记住以下几点$_GET['a']应包含的内容，始终确保在处理它之前，它确实包含该内容（并且仅包含该内容）。这包括确保它是一个数字 (is_numeric) 或者它与特定模式（正则表达式）、长度或其他一些预定义条件匹配。$_GET['file']- 如果您有一个基于$_GET['file']提供文件的脚本，请确保您仅在当前的文件中包含文件目录。这意味着，不允许使用斜杠/和 dotdot 的..。eval()或执行任何其他用户输入，那么您似乎是安全的。It appears as an attempted attack, yes. Depending on your application, it's hard to tell you what you should do, as we have no idea what you have already done.
But one thing is certain, always validate your user input. Assuming you're using the
GETvariables in your application, here's a few things to keep in mind$_GET['a']should contain, always make sure it does contain that (and only that) before processing it. This includes making sure it's a number (is_numeric) or that it matches a specific pattern (regex), length or some other predefined criteria.$_GET['file']- if you have a script that serves files based on$_GET['file'], make sure you only include files in your current directory. That means, disallow slashes/and dotdot's...eval()or have any other user input executed, you seem safe.这取决于以下内容：
index.php（或您的/（根）处理程序）awstats.pl和site.php是。
这些是相当常见的 SQL 注入（和其他）攻击，可能（也可能不会）损害数据库中的数据或服务器上的文件。
这取决于您的脚本如何处理此输入。
It depends what the contents of:
index.php(or your/(root) handler)awstats.plandsite.phpare.
These are fairly common SQL injection (and other) attacks that may (or may not) compromise the data in your database or files on your server.
It depends on how your scripts handle this input.
如果您有不安全的代码，例如
eval()和非静态包含 (include $name;)，您应该担心。始终避免那些编码风格。您还应该担心您的服务器上是否有过时的软件。
You should worry if you have unsafe code, such as
eval()and non-static includes (include $name;). Always avoid those coding styles.You should also worry if there's software on your server which is outdated.