{"id":70162,"date":"2026-02-01T15:36:35","date_gmt":"2026-02-01T07:36:35","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/70162.html"},"modified":"2026-02-01T15:36:35","modified_gmt":"2026-02-01T07:36:35","slug":"%e4%ba%8c%e3%80%81php-5-4-7-4%e7%89%88%e6%9c%ac%e6%bc%94%e8%bf%9b%e4%b8%8e%e5%ae%89%e5%85%a8%e6%94%b9%e8%bf%9b","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/70162.html","title":{"rendered":"\u4e8c\u3001PHP 5.4-7.4\u7248\u672c\u6f14\u8fdb\u4e0e\u5b89\u5168\u6539\u8fdb"},"content":{"rendered":"<h3>1. \u4e3a\u4ec0\u4e48\u7248\u672c\u6f14\u8fdb\u4f1a\u6539\u53d8\u5b89\u5168\u8fb9\u754c<\/h3>\n<p>\u4ece\u5b89\u5168\u89c6\u89d2\u770b,\u7248\u672c\u5347\u7ea7\u4e0d\u662f\u201c\u6027\u80fd\u66f4\u5feb\u201d\u8fd9\u4e48\u7b80\u5355,\u800c\u662f\u4e09\u7c7b\u8fb9\u754c\u5728\u53d8\u5316:<\/p>\n<li>\n<p>\u53ef\u7528\u7684\u5371\u9669\u80fd\u529b\u5728\u53d8\u5316<br \/>\n\u67d0\u4e9b\u5386\u53f2\u7279\u6027\u88ab\u79fb\u9664\u3001\u67d0\u4e9b\u6269\u5c55\u88ab\u66ff\u4ee3,\u653b\u51fb\u9762\u76f4\u63a5\u51cf\u5c11\u6216\u8fc1\u79fb\u3002<\/p>\n<\/li>\n<li>\n<p>\u9ed8\u8ba4\u884c\u4e3a\u5728\u53d8\u5316<br \/>\n\u52a0\u5bc6\u3001SSL\/TLS \u6821\u9a8c\u3001Session Cookie \u5c5e\u6027\u7b49\u9ed8\u8ba4\u503c\u53d8\u5316,\u4f1a\u5f71\u54cd\u5b9e\u9645\u5b89\u5168\u7b49\u7ea7\u3002<\/p>\n<\/li>\n<li>\n<p>\u9519\u8bef\u5904\u7406\u4e0e\u5f15\u64ce\u884c\u4e3a\u5728\u53d8\u5316<br \/>\n\u5f15\u64ce\u7ea7\u522b\u7684\u201c\u8bed\u4e49\u7edf\u4e00\u5316\u201d,\u4f1a\u6539\u53d8\u6f0f\u6d1e\u89e6\u53d1\u6761\u4ef6\u548c\u68c0\u6d4b\u7279\u5f81\u3002<\/p>\n<\/li>\n<p>\u5b89\u5168\u5ba1\u8ba1\u5efa\u8bae:<br \/>\n\u522b\u53ea\u95ee\u201c\u4ee3\u7801\u91cc\u6709\u6ca1\u6709\u5371\u9669\u51fd\u6570\u201d,\u8fd8\u8981\u95ee\u201c\u8fd9\u4e2a\u7248\u672c\u91cc\u8fd9\u4e2a\u51fd\u6570\u7684\u884c\u4e3a\u662f\u5426\u53d8\u5316\u6216\u5df2\u88ab\u5e9f\u5f03\u201d\u3002<\/p>\n<h4>1.1 \u540c\u4e00\u6bb5\u4ee3\u7801,\u4e0d\u540c\u7248\u672c,\u5b8c\u5168\u4e0d\u540c\u7684\u5b89\u5168\u8fb9\u754c<\/h4>\n<p>\u5178\u578b\u4f8b\u5b50: preg_replace \/e<\/p>\n<p><span class=\"token comment\">\/\/ PHP 5.x: \/e \u4f1a\u628a\u66ff\u6362\u5b57\u7b26\u4e32\u5f53\u6210PHP\u4ee3\u7801\u6267\u884c<\/span><br \/>\n<span class=\"token variable\">$pattern<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token string single-quoted-string\">&#039;\/\\\\{(\\\\w&#043;)\\\\}\/e&#039;<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token variable\">$template<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token variable\">$_GET<\/span><span class=\"token punctuation\">[<\/span><span class=\"token string single-quoted-string\">&#039;tpl&#039;<\/span><span class=\"token punctuation\">]<\/span> <span class=\"token operator\">??<\/span> <span class=\"token string single-quoted-string\">&#039;&#039;<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token variable\">$result<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">preg_replace<\/span><span class=\"token punctuation\">(<\/span><span class=\"token variable\">$pattern<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token string single-quoted-string\">&#039;strtoupper(&#034;$1&#034;)&#039;<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token variable\">$template<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p><span class=\"token comment\">\/\/ PHP 7.0&#043;: \/e \u88ab\u79fb\u9664,\u8fd9\u6bb5\u4ee3\u7801\u76f4\u63a5\u62a5\u9519<\/span><\/p>\n<p>\u5b89\u5168\u5f71\u54cd:<\/p>\n<ul>\n<li>\u5728 5.x \u4e2d,\u8fd9\u662f\u7ecf\u5178\u201c\u6b63\u5219\u5373\u4ee3\u7801\u6267\u884c\u201d\u7684\u98ce\u9669\u70b9<\/li>\n<li>\u5728 7.0&#043; \u4e2d,\u540c\u6837\u4ee3\u7801\u89e6\u53d1\u7684\u662f\u517c\u5bb9\u6027\u9519\u8bef,\u5e76\u4e0d\u518d\u6267\u884c<\/li>\n<\/ul>\n<p>\u7ed3\u8bba: \u7248\u672c\u5dee\u5f02\u51b3\u5b9a\u4e86\u201c\u6f0f\u6d1e\u662f\u5426\u5b58\u5728\u201d,\u4e5f\u51b3\u5b9a\u4e86\u68c0\u6d4b\u89c4\u5219\u8be5\u600e\u4e48\u5199\u3002<\/p>\n<h4>1.2 \u7248\u672c\u751f\u547d\u5468\u671f\u4e0e\u98ce\u9669\u5206\u7ea7<\/h4>\n<p>\u622a\u81f3\u76ee\u524d,PHP 5.4-7.4 \u5747\u5df2\u505c\u6b62\u5b98\u65b9\u5b89\u5168\u652f\u6301\u3002\u8fd9\u610f\u5473\u7740:<\/p>\n<ul>\n<li>\u4e0d\u4f1a\u518d\u83b7\u5f97\u5b98\u65b9\u5b89\u5168\u8865\u4e01<\/li>\n<li>\u9ad8\u5371\u6f0f\u6d1e\u53ea\u80fd\u9760\u5916\u56f4\u9632\u62a4\u515c\u5e95<\/li>\n<li>\u4f9b\u5e94\u94fe\u4f9d\u8d56\u4e5f\u53ef\u80fd\u505c\u6b62\u7ef4\u62a4<\/li>\n<\/ul>\n<p>\u73b0\u5b9e\u5efa\u8bae:<\/p>\n<ul>\n<li>\u4ecd\u5728\u4f7f\u7528\u8fd9\u4e9b\u7248\u672c\u7684\u7cfb\u7edf,\u5e94\u9ed8\u8ba4\u89c6\u4e3a\u201c\u9ad8\u98ce\u9669\u8d44\u4ea7\u201d<\/li>\n<li>\u5728\u65e0\u6cd5\u5347\u7ea7\u65f6,\u81f3\u5c11\u505a\u5230: \u9694\u79bb\u8fd0\u884c\u3001\u9650\u5236\u6743\u9650\u3001\u52a0\u5f3a\u68c0\u6d4b\u3001\u660e\u786e\u8fb9\u754c<\/li>\n<\/ul>\n<h4>1.3 \u7248\u672c&#043;\u914d\u7f6e&#043;SAPI: \u4e09\u7ef4\u53e0\u52a0\u624d\u662f\u5b8c\u6574\u8fb9\u754c<\/h4>\n<table>\n<tr>\u7ef4\u5ea6\u5178\u578b\u53d8\u5316\u5b89\u5168\u5f71\u54cd<\/tr>\n<tbody>\n<tr>\n<td>\u7248\u672c<\/td>\n<td>API\u79fb\u9664\u3001\u65b0API\u52a0\u5165\u3001\u9ed8\u8ba4\u503c\u6536\u7d27<\/td>\n<td>\u653b\u51fb\u9762\u53d8\u5316\u3001\u89c4\u5219\u9700\u5206\u5c42<\/td>\n<\/tr>\n<tr>\n<td>\u914d\u7f6e<\/td>\n<td>disable_functions\u3001open_basedir\u3001Session\u914d\u7f6e<\/td>\n<td>\u5b89\u5168\u8fb9\u754c\u53ef\u80fd\u88ab\u6269\u5927\u6216\u6536\u7f29<\/td>\n<\/tr>\n<tr>\n<td>SAPI<\/td>\n<td>CLI\u3001FPM\u3001Apache\u6a21\u5757<\/td>\n<td>\u53ef\u7528\u51fd\u6570\u3001\u6743\u9650\u7ee7\u627f\u4e0d\u540c<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u5b9e\u6218\u63d0\u9192:<\/p>\n<p>\u540c\u4e00\u4efd\u4ee3\u7801,\u5728 CLI \u4e0e FPM \u4e2d\u98ce\u9669\u4e0d\u4e00\u81f4;\u540c\u4e00\u7248\u672c,\u5728\u4e0d\u540c php.ini \u4e0b\u98ce\u9669\u4e5f\u4e0d\u4e00\u81f4\u3002\u7248\u672c\u53ea\u662f\u57fa\u7840,\u914d\u7f6e\u548c\u8fd0\u884c\u73af\u5883\u624d\u662f\u6700\u7ec8\u8fb9\u754c\u3002<\/p>\n<hr \/>\n<h3>2. PHP 5.4-5.6: \u65e7\u65f6\u4ee3\u7279\u6027\u6e05\u7406\u4e0e\u5bc6\u7801\u5b66\u57fa\u7840<\/h3>\n<p>\u8fd9\u4e00\u9636\u6bb5\u7684\u5173\u952e\u8bcd\u662f: \u6e05\u7406\u5386\u53f2\u5305\u88b1,\u642d\u5efa\u5b89\u5168\u57fa\u7840\u80fd\u529b\u3002<\/p>\n<h4>2.1 \u7248\u672c\u8981\u70b9\u603b\u89c8<\/h4>\n<table>\n<tr>\u7248\u672c\u5173\u952e\u5b89\u5168\u53d8\u5316\u5b89\u5168\u610f\u4e49<\/tr>\n<tbody>\n<tr>\n<td>5.4<\/td>\n<td>\u79fb\u9664 register_globals \/ magic_quotes_gpc \/ safe_mode<\/td>\n<td>\u6e05\u7406\u201c\u5047\u5b89\u5168\u673a\u5236\u201d,\u51cf\u5c11\u9690\u5f0f\u53d8\u91cf\u6c61\u67d3\u4e0e\u201c\u4f2a\u9694\u79bb\u201d<\/td>\n<\/tr>\n<tr>\n<td>5.5<\/td>\n<td>\u65b0\u589e password_hash() \/ password_verify()<\/td>\n<td>\u7ed9\u5f00\u53d1\u8005\u4e00\u628a\u201c\u6b63\u786e\u4f7f\u7528\u5bc6\u7801\u5b66\u201d\u7684\u6807\u51c6\u94a5\u5319<\/td>\n<\/tr>\n<tr>\n<td>5.6<\/td>\n<td>\u65b0\u589e hash_equals()<\/td>\n<td>\u63d0\u4f9b\u6297\u65f6\u5e8f\u653b\u51fb\u7684\u5b89\u5168\u6bd4\u8f83\u65b9\u5f0f<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>2.2 5.4: \u6e05\u7406\u201c\u770b\u8d77\u6765\u5b89\u5168\u4f46\u5b9e\u9645\u4e0a\u5371\u9669\u201d\u7684\u529f\u80fd<\/h4>\n<h5>2.2.1 register_globals \u7684\u672c\u8d28\u98ce\u9669<\/h5>\n<p><span class=\"token comment\">\/\/ \u65e7\u4ee3\u7801\u5e38\u89c1\u5199\u6cd5<\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token variable\">$is_admin<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token comment\">\/\/ &#8230; \u6267\u884c\u7ba1\u7406\u5458\u903b\u8f91<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p><span class=\"token comment\">\/\/ \u5728 register_globals \u542f\u7528\u65f6,\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u8bf7\u6c42\u53c2\u6570\u6ce8\u5165:<\/span><br \/>\n<span class=\"token comment\">\/\/ ?is_admin&#061;1<\/span><\/p>\n<p>\u6838\u5fc3\u95ee\u9898: \u53d8\u91cf\u6765\u6e90\u4e0d\u518d\u53ef\u8ffd\u8e2a,\u6c61\u70b9\u5206\u6790\u51e0\u4e4e\u5931\u6548\u3002<\/p>\n<p>\u4fee\u6b63\u65b9\u5f0f:<\/p>\n<p><span class=\"token variable\">$is_admin<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token keyword\">isset<\/span><span class=\"token punctuation\">(<\/span><span class=\"token variable\">$_SESSION<\/span><span class=\"token punctuation\">[<\/span><span class=\"token string single-quoted-string\">&#039;is_admin&#039;<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token operator\">&amp;&amp;<\/span> <span class=\"token variable\">$_SESSION<\/span><span class=\"token punctuation\">[<\/span><span class=\"token string single-quoted-string\">&#039;is_admin&#039;<\/span><span class=\"token punctuation\">]<\/span> <span class=\"token operator\">&#061;&#061;&#061;<\/span> <span class=\"token constant boolean\">true<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token variable\">$is_admin<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token comment\">\/\/ &#8230;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<h5>2.2.2 magic_quotes_gpc: \u201c\u81ea\u52a8\u8f6c\u4e49\u201d\u5e26\u6765\u7684\u5047\u5b89\u5168<\/h5>\n<p><span class=\"token comment\">\/\/ \u65e7\u601d\u8def: \u4f9d\u8d56\u81ea\u52a8\u8f6c\u4e49 &#043; \u62fc\u63a5SQL<\/span><br \/>\n<span class=\"token variable\">$name<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token variable\">$_GET<\/span><span class=\"token punctuation\">[<\/span><span class=\"token string single-quoted-string\">&#039;name&#039;<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token variable\">$sql<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token string double-quoted-string\">&#034;SELECT * FROM users WHERE name &#061; &#039;<span class=\"token interpolation\"><span class=\"token variable\">$name<\/span><\/span>&#039;&#034;<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>\u95ee\u9898\u5728\u4e8e:<\/p>\n<ul>\n<li>\u4e0d\u540c\u73af\u5883\u8f6c\u4e49\u884c\u4e3a\u4e0d\u4e00\u81f4<\/li>\n<li>\u53cc\u91cd\u8f6c\u4e49\u6216\u6f0f\u8f6c\u4e49\u90fd\u53ef\u80fd\u4ea7\u751f\u6f0f\u6d1e<\/li>\n<\/ul>\n<p>\u6b63\u786e\u601d\u8def:<\/p>\n<p><span class=\"token variable\">$stmt<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token variable\">$pdo<\/span><span class=\"token operator\">-&gt;<\/span><span class=\"token function\">prepare<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string single-quoted-string\">&#039;SELECT * FROM users WHERE name &#061; ?&#039;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token variable\">$stmt<\/span><span class=\"token operator\">-&gt;<\/span><span class=\"token function\">execute<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">[<\/span><span class=\"token variable\">$name<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<h5>2.2.3 safe_mode: \u4f2a\u9694\u79bb\u7684\u4ee3\u4ef7<\/h5>\n<p>safe_mode \u4e0d\u662f\u5b89\u5168\u6c99\u7bb1,\u5b83\u53ea\u662f\u4e00\u4e9b\u8def\u5f84\u548c\u51fd\u6570\u9650\u5236,\u5f88\u5bb9\u6613\u88ab\u8bef\u7528\u3002<\/p>\n<p>\u66ff\u4ee3\u7b56\u7565:<\/p>\n<ul>\n<li>open_basedir \u9650\u5236\u53ef\u8bbf\u95ee\u76ee\u5f55<\/li>\n<li>disable_functions \u7981\u7528\u9ad8\u5371\u51fd\u6570<\/li>\n<li>OS\u7ea7\u9694\u79bb(\u5bb9\u5668\/\u4e13\u7528\u7528\u6237)<\/li>\n<\/ul>\n<h4>2.3 5.5: \u89c4\u8303\u5316\u5bc6\u7801\u5b58\u50a8\u7684\u5f00\u59cb<\/h4>\n<p>password_hash() \u8fd9\u7c7bAPI\u7684\u610f\u4e49\u4e0d\u53ea\u662f\u201c\u66f4\u65b9\u4fbf\u201d,\u800c\u662f\u51cf\u5c11\u5f00\u53d1\u8005\u81ea\u5df1\u9020\u8f6e\u5b50\u5bfc\u81f4\u7684\u5bc6\u7801\u5b66\u707e\u96be\u3002<br \/>\n\u5728\u5ba1\u8ba1\u4e2d,\u53ea\u8981\u770b\u5230\u81ea\u5236\u7684\u201c\u52a0\u76d0&#043;\u54c8\u5e0c\u201d,\u5c31\u8981\u6000\u7591\u5b83\u662f\u5426\u771f\u7684\u5b89\u5168\u3002<\/p>\n<p>\u5b89\u5168\u793a\u4f8b:<\/p>\n<p><span class=\"token variable\">$hash<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">password_hash<\/span><span class=\"token punctuation\">(<\/span><span class=\"token variable\">$password<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token constant\">PASSWORD_BCRYPT<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token punctuation\">[<\/span><span class=\"token string single-quoted-string\">&#039;cost&#039;<\/span> <span class=\"token operator\">&#061;&gt;<\/span> <span class=\"token number\">12<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p><span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token function\">password_verify<\/span><span class=\"token punctuation\">(<\/span><span class=\"token variable\">$input<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token variable\">$hash<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token comment\">\/\/ \u901a\u8fc7\u8ba4\u8bc1<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p><span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token function\">password_needs_rehash<\/span><span class=\"token punctuation\">(<\/span><span class=\"token variable\">$hash<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token constant\">PASSWORD_BCRYPT<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token punctuation\">[<\/span><span class=\"token string single-quoted-string\">&#039;cost&#039;<\/span> <span class=\"token operator\">&#061;&gt;<\/span> <span class=\"token number\">12<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token comment\">\/\/ \u89e6\u53d1\u5b89\u5168\u5347\u7ea7: \u91cd\u65b0\u8ba1\u7b97\u66f4\u5f3a\u7684hash<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p>\u5ba1\u8ba1\u8981\u70b9:<\/p>\n<ul>\n<li>password_hash() \u662f\u5426\u7edf\u4e00\u4f7f\u7528<\/li>\n<li>cost \u662f\u5426\u5408\u7406<\/li>\n<li>\u662f\u5426\u5b58\u5728\u81ea\u5b9a\u4e49\u201c\u52a0\u76d0&#043;\u54c8\u5e0c\u201d\u903b\u8f91<\/li>\n<\/ul>\n<h4>2.4 5.6: \u65f6\u5e8f\u653b\u51fb\u9632\u62a4\u80fd\u529b\u8865\u9f50<\/h4>\n<p>hash_equals() \u7684\u4ef7\u503c\u5728\u4e8e\u6052\u5b9a\u65f6\u95f4\u6bd4\u8f83,\u5b83\u80fd\u963b\u65ad\u5f88\u591a\u201c\u731c\u957f\u5ea6\/\u731c\u524d\u7f00\u201d\u7684\u653b\u51fb\u8def\u5f84\u3002<\/p>\n<p><span class=\"token variable\">$sign<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">hash_hmac<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string single-quoted-string\">&#039;sha256&#039;<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token variable\">$payload<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token variable\">$secret<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token function\">hash_equals<\/span><span class=\"token punctuation\">(<\/span><span class=\"token variable\">$sign<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token variable\">$userSign<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token comment\">\/\/ \u5b89\u5168\u6bd4\u8f83<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p>\u5b9e\u6218\u63d0\u9192:<br \/>\n\u5982\u679c\u9879\u76ee\u91cc\u5b58\u5728\u201ctoken\/\u7b7e\u540d\u6bd4\u5bf9\u201d,\u8fd9\u7c7b\u6bd4\u8f83\u51fd\u6570\u662f\u4e00\u4e2a\u5f88\u5bb9\u6613\u88ab\u5ffd\u7565\u7684\u5b89\u5168\u7ec6\u8282\u3002<\/p>\n<h4>2.5 5.6: \u5b89\u5168\u9ed8\u8ba4\u503c\u5f00\u59cb\u6536\u7d27<\/h4>\n<h5>2.5.1 TLS \u8bc1\u4e66\u6821\u9a8c\u66f4\u4e25\u683c<\/h5>\n<p>HTTPS \u8bf7\u6c42\u9ed8\u8ba4\u4f1a\u8fdb\u884c\u66f4\u4e25\u683c\u7684\u8bc1\u4e66\u6821\u9a8c,\u8fd9\u5bf9\u5b89\u5168\u662f\u597d\u4e8b,\u4f46\u4e5f\u4f1a\u5bfc\u81f4\u65e7\u4ee3\u7801\u201c\u7a81\u7136\u5931\u8d25\u201d\u3002<\/p>\n<p>\u5b89\u5168\u505a\u6cd5:<\/p>\n<p><span class=\"token variable\">$context<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">stream_context_create<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">[<\/span><br \/>\n    <span class=\"token string single-quoted-string\">&#039;ssl&#039;<\/span> <span class=\"token operator\">&#061;&gt;<\/span> <span class=\"token punctuation\">[<\/span><br \/>\n        <span class=\"token string single-quoted-string\">&#039;verify_peer&#039;<\/span> <span class=\"token operator\">&#061;&gt;<\/span> <span class=\"token constant boolean\">true<\/span><span class=\"token punctuation\">,<\/span><br \/>\n        <span class=\"token string single-quoted-string\">&#039;verify_peer_name&#039;<\/span> <span class=\"token operator\">&#061;&gt;<\/span> <span class=\"token constant boolean\">true<\/span><span class=\"token punctuation\">,<\/span><br \/>\n        <span class=\"token string single-quoted-string\">&#039;cafile&#039;<\/span> <span class=\"token operator\">&#061;&gt;<\/span> <span class=\"token string single-quoted-string\">&#039;\/etc\/ssl\/certs\/ca-certificates.crt&#039;<\/span><span class=\"token punctuation\">,<\/span><br \/>\n    <span class=\"token punctuation\">]<\/span><br \/>\n<span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p><span class=\"token variable\">$data<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">file_get_contents<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string single-quoted-string\">&#039;https:\/\/api.example.com&#039;<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token constant boolean\">false<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token variable\">$context<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>\u98ce\u9669\u63d0\u9192:<\/p>\n<ul>\n<li>\u4e3a\u4e86\u201c\u517c\u5bb9\u201d\u800c\u5173\u95ed\u6821\u9a8c,\u7b49\u4ef7\u4e8e\u4e3b\u52a8\u5f15\u5165\u4e2d\u95f4\u4eba\u653b\u51fb\u9762<\/li>\n<\/ul>\n<h5>2.5.2 \u5b57\u7b26\u96c6\u9ed8\u8ba4\u503c\u66f4\u5b89\u5168<\/h5>\n<p>\u7edf\u4e00\u660e\u786e\u7684\u5b57\u7b26\u96c6,\u662fXSS\u9632\u62a4\u7684\u57fa\u7840\u3002\u65e0\u8bba\u7248\u672c\u662f\u5426\u9ed8\u8ba4 UTF-8,\u5728\u8f93\u51fa\u65f6\u663e\u5f0f\u6307\u5b9a\u7f16\u7801\u90fd\u662f\u6700\u4f73\u5b9e\u8df5\u3002<\/p>\n<p><span class=\"token keyword\">echo<\/span> <span class=\"token function\">htmlspecialchars<\/span><span class=\"token punctuation\">(<\/span><span class=\"token variable\">$input<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token class-name\">ENT_QUOTES<\/span> <span class=\"token operator\">|<\/span> <span class=\"token class-name\">ENT_SUBSTITUTE<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token string single-quoted-string\">&#039;UTF-8&#039;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<hr \/>\n<h3>3. PHP 7.0: \u5f15\u64ce\u91cd\u6784\u5e26\u6765\u7684\u5b89\u5168\u5de5\u7a0b\u5316<\/h3>\n<p>PHP 7.0 \u662f\u4e00\u6b21\u8d28\u53d8,\u6838\u5fc3\u5173\u952e\u8bcd\u662f: \u5f15\u64ce\u91cd\u6784\u3001\u8bed\u4e49\u7edf\u4e00\u3001\u98ce\u9669\u6e05\u7406\u3002<\/p>\n<h4>3.1 \u5f15\u64ce\u5c42\u9762\u7684\u5b89\u5168\u6536\u76ca<\/h4>\n<ul>\n<li>\u9519\u8bef\u5904\u7406\u4f53\u7cfb\u7edf\u4e00: \u90e8\u5206\u81f4\u547d\u9519\u8bef\u88ab\u7eb3\u5165\u53ef\u6355\u83b7\u7684 Throwable \u4f53\u7cfb,\u964d\u4f4e\u201c\u5f02\u5e38\u5373\u5d29\u6e83\u201d\u7684\u98ce\u9669<\/li>\n<li>\u8bed\u4e49\u66f4\u4e00\u81f4: \u7edf\u4e00\u53d8\u91cf\u8bed\u6cd5\u8ba9\u590d\u6742\u8868\u8fbe\u5f0f\u7684\u89e3\u6790\u66f4\u53ef\u9884\u6d4b<\/li>\n<\/ul>\n<p><span class=\"token keyword\">try<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token comment\">\/\/ \u53ef\u80fd\u629b\u51fa Error \u6216 Exception<\/span><br \/>\n    <span class=\"token function\">riskyOperation<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span> <span class=\"token keyword\">catch<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token class-name\">Throwable<\/span> <span class=\"token variable\">$e<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token comment\">\/\/ \u7edf\u4e00\u515c\u5e95<\/span><br \/>\n    <span class=\"token function\">error_log<\/span><span class=\"token punctuation\">(<\/span><span class=\"token variable\">$e<\/span><span class=\"token operator\">-&gt;<\/span><span class=\"token function\">getMessage<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p>\u8fd9\u7c7b\u6539\u52a8\u4e0d\u4f1a\u76f4\u63a5\u201c\u4fee\u590d\u6f0f\u6d1e\u201d,\u4f46\u5b83\u51cf\u5c11\u4e86\u975e\u9884\u671f\u884c\u4e3a\u5e26\u6765\u7684\u5b89\u5168\u6b67\u4e49,\u63d0\u5347\u4e86\u5ba1\u8ba1\u7684\u786e\u5b9a\u6027\u3002<\/p>\n<h4>3.2 \u7edf\u4e00\u53d8\u91cf\u8bed\u6cd5: \u8ba9\u201c\u6b67\u4e49\u89e3\u6790\u201d\u6536\u655b<\/h4>\n<p>PHP 5.x \u65f6\u4ee3,\u4e00\u4e9b\u590d\u6742\u7684\u53d8\u91cf\u53d8\u91cf\/\u5bf9\u8c61\u8bbf\u95ee\u8868\u8fbe\u5f0f\u5b58\u5728\u6b67\u4e49\u3002PHP 7 \u7684\u89e3\u6790\u66f4\u7edf\u4e00\u3002<\/p>\n<p>\u5b89\u5168\u5efa\u8bae:<\/p>\n<ul>\n<li>\u907f\u514d\u590d\u6742\u7684\u53d8\u91cf\u53d8\u91cf\u62fc\u63a5<\/li>\n<li>\u5bf9\u52a8\u6001\u8bbf\u95ee\u4f7f\u7528\u663e\u5f0f\u5927\u62ec\u53f7\u63d0\u9ad8\u53ef\u8bfb\u6027<\/li>\n<\/ul>\n<p><span class=\"token comment\">\/\/ \u63a8\u8350\u663e\u5f0f\u5199\u6cd5<\/span><br \/>\n<span class=\"token variable\">$<\/span><span class=\"token punctuation\">{<\/span><span class=\"token variable\">$foo<\/span><span class=\"token punctuation\">[<\/span><span class=\"token string single-quoted-string\">&#039;bar&#039;<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">}<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token variable\">$object<\/span><span class=\"token operator\">-&gt;<\/span><span class=\"token punctuation\">{<\/span><span class=\"token variable\">$method<\/span><span class=\"token punctuation\">}<\/span><span class=\"token punctuation\">(<\/span><span class=\"token variable\">$arg<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>\u8fd9\u7c7b\u663e\u5f0f\u5199\u6cd5\u80fd\u964d\u4f4e\u201c\u89e3\u6790\u6b67\u4e49\u5bfc\u81f4\u7684\u9690\u85cf\u6267\u884c\u94fe\u201d\u3002<\/p>\n<h4>3.3 \u5b89\u5168\u968f\u673a\u6570\u6210\u4e3a\u6807\u51c6\u80fd\u529b<\/h4>\n<p>random_bytes() \/ random_int() \u662f PHP 7.0 \u7ed9\u5b89\u5168\u5de5\u7a0b\u5e08\u7684\u4e00\u628a\u201c\u6807\u51c6\u94a5\u5319\u201d\u3002<\/p>\n<p><span class=\"token variable\">$token<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">bin2hex<\/span><span class=\"token punctuation\">(<\/span><span class=\"token function\">random_bytes<\/span><span class=\"token punctuation\">(<\/span><span class=\"token number\">32<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token comment\">\/\/ 64\u4f4dHEX\u968f\u673a\u4e32<\/span><\/p>\n<p><span class=\"token comment\">\/\/ \u6216\u8005\u751f\u6210\u5b89\u5168\u8303\u56f4\u5185\u7684\u968f\u673a\u6574\u6570<\/span><br \/>\n<span class=\"token variable\">$id<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">random_int<\/span><span class=\"token punctuation\">(<\/span><span class=\"token number\">100000<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token number\">999999<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>\u5b9e\u6218\u63d0\u9192:<\/p>\n<ul>\n<li>mt_rand() \u9002\u5408\u4e00\u822c\u968f\u673a,\u4e0d\u9002\u5408\u5b89\u5168\u573a\u666f<\/li>\n<li>\u5b89\u5168token\/nonce\/\u9a8c\u8bc1\u7801\u4e00\u5f8b\u4f7f\u7528 random_bytes\/random_int<\/li>\n<\/ul>\n<h4>3.4 preg_replace \/e \u79fb\u9664: \u6e05\u7406\u201c\u6b63\u5219\u5373\u4ee3\u7801\u6267\u884c\u201d<\/h4>\n<p>\u65e7\u5199\u6cd5 (\u5371\u9669):<\/p>\n<p><span class=\"token comment\">\/\/ PHP 5.x: \/e \u4f1a\u6267\u884c\u66ff\u6362\u5b57\u7b26\u4e32<\/span><br \/>\n<span class=\"token function\">preg_replace<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string single-quoted-string\">&#039;\/\\\\{(\\\\w&#043;)\\\\}\/e&#039;<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token string single-quoted-string\">&#039;strtoupper(&#034;$1&#034;)&#039;<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token variable\">$tpl<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>\u65b0\u5199\u6cd5 (\u5b89\u5168):<\/p>\n<p><span class=\"token function\">preg_replace_callback<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string single-quoted-string\">&#039;\/\\\\{(\\\\w&#043;)\\\\}\/&#039;<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token keyword\">function<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token variable\">$m<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token keyword\">return<\/span> <span class=\"token function\">strtoupper<\/span><span class=\"token punctuation\">(<\/span><span class=\"token variable\">$m<\/span><span class=\"token punctuation\">[<\/span><span class=\"token number\">1<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token variable\">$tpl<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<h4>3.5 mysql_* \u79fb\u9664: \u63a8\u52a8\u5b89\u5168\u6570\u636e\u8bbf\u95ee<\/h4>\n<p>\u65e7\u4ee3\u7801\u5178\u578b\u98ce\u9669:<\/p>\n<ul>\n<li>\u5bb9\u6613\u62fc\u63a5SQL<\/li>\n<li>\u5b57\u7b26\u96c6\u4e0e\u8f6c\u4e49\u4e0d\u7edf\u4e00<\/li>\n<\/ul>\n<p>\u63a8\u8350\u65b9\u5f0f:<\/p>\n<p><span class=\"token variable\">$stmt<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token variable\">$pdo<\/span><span class=\"token operator\">-&gt;<\/span><span class=\"token function\">prepare<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string single-quoted-string\">&#039;SELECT id, username FROM users WHERE id &#061; ?&#039;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token variable\">$stmt<\/span><span class=\"token operator\">-&gt;<\/span><span class=\"token function\">execute<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">[<\/span><span class=\"token variable\">$id<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token variable\">$user<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token variable\">$stmt<\/span><span class=\"token operator\">-&gt;<\/span><span class=\"token function\">fetch<\/span><span class=\"token punctuation\">(<\/span><span class=\"token class-name static-context\">PDO<\/span><span class=\"token operator\">::<\/span><span class=\"token constant\">FETCH_ASSOC<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<h4>3.6 \u53cd\u5e8f\u5217\u5316\u5b89\u5168: \u66f4\u53ef\u63a7\u7684\u8fb9\u754c<\/h4>\n<p>PHP 7.x \u652f\u6301 unserialize \u7684 allowed_classes \u9009\u9879,\u8ba9\u5bf9\u8c61\u6ce8\u5165\u98ce\u9669\u53ef\u88ab\u7ea6\u675f\u3002<\/p>\n<p><span class=\"token variable\">$data<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">unserialize<\/span><span class=\"token punctuation\">(<\/span><span class=\"token variable\">$input<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token punctuation\">[<\/span><br \/>\n    <span class=\"token string single-quoted-string\">&#039;allowed_classes&#039;<\/span> <span class=\"token operator\">&#061;&gt;<\/span> <span class=\"token punctuation\">[<\/span><span class=\"token string single-quoted-string\">&#039;SafeDTO&#039;<\/span><span class=\"token punctuation\">]<\/span><br \/>\n<span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>\u5ba1\u8ba1\u8981\u70b9:<\/p>\n<ul>\n<li>\u4efb\u4f55 unserialize \u90fd\u5e94\u89c6\u4e3a\u9ad8\u98ce\u9669<\/li>\n<li>\u4f18\u5148\u6539\u4e3a json_decode &#043; \u660e\u786e\u7ed3\u6784\u6821\u9a8c<\/li>\n<\/ul>\n<h4>3.7 assert \u4e0d\u8981\u7528\u4f5c\u5b89\u5168\u8fb9\u754c<\/h4>\n<p>assert() \u5728\u4e0d\u540c\u7248\u672c\/\u914d\u7f6e\u4e0b\u53ef\u80fd\u88ab\u5173\u95ed\u6216\u88ab\u4f18\u5316\u6389\u3002\u5b83\u66f4\u50cf\u201c\u5f00\u53d1\u671f\u65ad\u8a00\u201d,\u4e0d\u662f\u5b89\u5168\u63a7\u5236\u70b9\u3002<\/p>\n<p>\u5b89\u5168\u505a\u6cd5:<\/p>\n<p><span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token operator\">!<\/span><span class=\"token function\">is_int<\/span><span class=\"token punctuation\">(<\/span><span class=\"token variable\">$userId<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token operator\">||<\/span> <span class=\"token variable\">$userId<\/span> <span class=\"token operator\">&lt;&#061;<\/span> <span class=\"token number\">0<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token keyword\">throw<\/span> <span class=\"token keyword\">new<\/span> <span class=\"token class-name\">InvalidArgumentException<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string single-quoted-string\">&#039;Invalid userId&#039;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<hr \/>\n<h3>4. PHP 7.1-7.4: \u73b0\u4ee3\u5b89\u5168\u80fd\u529b\u7684\u6210\u5f62\u671f<\/h3>\n<p>7.1-7.4 \u7684\u6838\u5fc3\u7279\u5f81\u662f: \u5b89\u5168\u80fd\u529b\u201c\u73b0\u4ee3\u5316\u201d,\u540c\u65f6\u5f15\u5165\u65b0\u7684\u653b\u51fb\u9762\u3002<\/p>\n<h4>4.1 \u7248\u672c\u8981\u70b9\u603b\u89c8<\/h4>\n<table>\n<tr>\u7248\u672c\u5173\u952e\u5b89\u5168\u53d8\u5316\u5b89\u5168\u542b\u4e49<\/tr>\n<tbody>\n<tr>\n<td>7.1<\/td>\n<td>mcrypt \u88ab\u5f03\u7528<\/td>\n<td>\u63a8\u52a8\u843d\u540e\u52a0\u5bc6\u5e93\u9000\u573a<\/td>\n<\/tr>\n<tr>\n<td>7.2<\/td>\n<td>\u5f15\u5165 libsodium \u6269\u5c55,\u652f\u6301 PASSWORD_ARGON2I<\/td>\n<td>\u73b0\u4ee3\u52a0\u5bc6\u80fd\u529b\u5230\u4f4d<\/td>\n<\/tr>\n<tr>\n<td>7.3<\/td>\n<td>\u652f\u6301 session.cookie_samesite\u3001JSON_THROW_ON_ERROR\u3001PASSWORD_ARGON2ID<\/td>\n<td>\u9ed8\u8ba4\u5b89\u5168\u7ec6\u8282\u66f4\u624e\u5b9e<\/td>\n<\/tr>\n<tr>\n<td>7.4<\/td>\n<td>\u5f15\u5165 FFI\u3001Preloading\u3001Typed Properties\u3001__serialize\/__unserialize<\/td>\n<td>\u65b0\u80fd\u529b\u5e26\u6765\u65b0\u653b\u51fb\u9762\u4e0e\u66f4\u5f3a\u7c7b\u578b\u7ea6\u675f<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>4.2 7.1-7.2: \u73b0\u4ee3\u52a0\u5bc6\u5de5\u5177\u7bb1\u6210\u5f62<\/h4>\n<p>\u4e3a\u4ec0\u4e48\u6211\u5f3a\u8c03\u5b83?<br \/>\n\u5728\u5b89\u5168\u5ba1\u8ba1\u91cc,\u6211\u66f4\u613f\u610f\u770b\u5230\u201c\u5b98\u65b9\u63a8\u8350\u7684\u5b89\u5168API\u201d,\u800c\u4e0d\u662f\u81ea\u7814\u52a0\u5bc6\u5b9e\u73b0\u3002<br \/>\n7.2 \u4ee5\u540e,libsodium \u4e0e password_hash() \u7684\u7ec4\u5408,\u8db3\u4ee5\u8986\u76d6\u5927\u90e8\u5206\u5e94\u7528\u573a\u666f\u3002<\/p>\n<p>\u5b89\u5168\u793a\u4f8b (libsodium):<\/p>\n<p><span class=\"token variable\">$key<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">sodium_crypto_secretbox_keygen<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token variable\">$nonce<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">random_bytes<\/span><span class=\"token punctuation\">(<\/span><span class=\"token constant\">SODIUM_CRYPTO_SECRETBOX_NONCEBYTES<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token variable\">$cipher<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">sodium_crypto_secretbox<\/span><span class=\"token punctuation\">(<\/span><span class=\"token variable\">$message<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token variable\">$nonce<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token variable\">$key<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p><span class=\"token comment\">\/\/ \u89e3\u5bc6<\/span><br \/>\n<span class=\"token variable\">$plain<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">sodium_crypto_secretbox_open<\/span><span class=\"token punctuation\">(<\/span><span class=\"token variable\">$cipher<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token variable\">$nonce<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token variable\">$key<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token variable\">$plain<\/span> <span class=\"token operator\">&#061;&#061;&#061;<\/span> <span class=\"token constant boolean\">false<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token keyword\">throw<\/span> <span class=\"token keyword\">new<\/span> <span class=\"token class-name\">RuntimeException<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string single-quoted-string\">&#039;Decrypt failed&#039;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<h4>4.3 create_function \u5f03\u7528: \u8ba9\u201c\u52a8\u6001\u4ee3\u7801\u201d\u9000\u573a<\/h4>\n<p>\u65e7\u4ee3\u7801 (\u5371\u9669):<\/p>\n<p><span class=\"token variable\">$fn<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">create_function<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string single-quoted-string\">&#039;$x&#039;<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token string single-quoted-string\">&#039;return $x * 2;&#039;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>\u66ff\u4ee3\u65b9\u6848:<\/p>\n<p><span class=\"token variable\">$fn<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token keyword\">function<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token variable\">$x<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token keyword\">return<\/span> <span class=\"token variable\">$x<\/span> <span class=\"token operator\">*<\/span> <span class=\"token number\">2<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>\u5ba1\u8ba1\u63d0\u793a:<\/p>\n<ul>\n<li>\u4ee3\u7801\u4e2d\u51fa\u73b0 create_function \u57fa\u672c\u7b49\u4ef7\u4e8e\u201c\u52a8\u6001\u6267\u884c\u5165\u53e3\u201d<\/li>\n<li>\u8fc1\u79fb\u65f6\u4f18\u5148\u66ff\u6362\u4e3a\u533f\u540d\u51fd\u6570<\/li>\n<\/ul>\n<h4>4.4 7.3: \u9ed8\u8ba4\u5b89\u5168\u7ec6\u8282\u5f00\u59cb\u201c\u5bf9\u9f50\u73b0\u4ee3Web\u201d<\/h4>\n<h5>4.4.1 SameSite Cookie<\/h5>\n<p>SameSite \u662f\u5bf9\u6297 CSRF \u7684\u4f4e\u6210\u672c\u589e\u5f3a,\u5c24\u5176\u9002\u5408\u540e\u53f0\u7ba1\u7406\u573a\u666f\u3002<\/p>\n<p>\u63a8\u8350\u5199\u6cd5 (7.3&#043;):<\/p>\n<p><span class=\"token function\">setcookie<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string single-quoted-string\">&#039;SID&#039;<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token variable\">$sid<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token punctuation\">[<\/span><br \/>\n    <span class=\"token string single-quoted-string\">&#039;expires&#039;<\/span> <span class=\"token operator\">&#061;&gt;<\/span> <span class=\"token function\">time<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token operator\">&#043;<\/span> <span class=\"token number\">3600<\/span><span class=\"token punctuation\">,<\/span><br \/>\n    <span class=\"token string single-quoted-string\">&#039;path&#039;<\/span> <span class=\"token operator\">&#061;&gt;<\/span> <span class=\"token string single-quoted-string\">&#039;\/&#039;<\/span><span class=\"token punctuation\">,<\/span><br \/>\n    <span class=\"token string single-quoted-string\">&#039;secure&#039;<\/span> <span class=\"token operator\">&#061;&gt;<\/span> <span class=\"token constant boolean\">true<\/span><span class=\"token punctuation\">,<\/span><br \/>\n    <span class=\"token string single-quoted-string\">&#039;httponly&#039;<\/span> <span class=\"token operator\">&#061;&gt;<\/span> <span class=\"token constant boolean\">true<\/span><span class=\"token punctuation\">,<\/span><br \/>\n    <span class=\"token string single-quoted-string\">&#039;samesite&#039;<\/span> <span class=\"token operator\">&#061;&gt;<\/span> <span class=\"token string single-quoted-string\">&#039;Lax&#039;<\/span><span class=\"token punctuation\">,<\/span><br \/>\n<span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<h5>4.4.2 JSON \u89e3\u6790\u5931\u8d25\u4e0d\u518d\u6c89\u9ed8<\/h5>\n<p><span class=\"token keyword\">try<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token variable\">$data<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">json_decode<\/span><span class=\"token punctuation\">(<\/span><span class=\"token variable\">$raw<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token constant boolean\">true<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token number\">512<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token constant\">JSON_THROW_ON_ERROR<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span> <span class=\"token keyword\">catch<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token class-name\">JsonException<\/span> <span class=\"token variable\">$e<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token comment\">\/\/ \u8bb0\u5f55\u5f02\u5e38\u5e76\u62d2\u7edd<\/span><br \/>\n    <span class=\"token keyword\">throw<\/span> <span class=\"token keyword\">new<\/span> <span class=\"token class-name\">InvalidArgumentException<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string single-quoted-string\">&#039;Invalid JSON payload&#039;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p>\u5b89\u5168\u4ef7\u503c:<\/p>\n<ul>\n<li>\u907f\u514d\u201c\u89e3\u6790\u5931\u8d25\u4f46\u7ee7\u7eed\u6267\u884c\u201d\u7684\u903b\u8f91\u6f0f\u6d1e<\/li>\n<li>\u8ba9\u7ed5\u8fc7\u653b\u51fb\u66f4\u96be\u9690\u85cf<\/li>\n<\/ul>\n<h4>4.5 7.4: \u65b0\u80fd\u529b\u4e0e\u65b0\u653b\u51fb\u9762\u5e76\u5b58<\/h4>\n<h5>4.5.1 FFI: \u5fc5\u987b\u660e\u786e\u8fb9\u754c<\/h5>\n<p>FFI \u53ef\u4ee5\u76f4\u63a5\u8c03\u7528 C \u63a5\u53e3,\u80fd\u529b\u6781\u5f3a,\u98ce\u9669\u4e5f\u6781\u9ad8\u3002<\/p>\n<p>\u5b89\u5168\u5efa\u8bae:<\/p>\n<ul>\n<li>\u751f\u4ea7\u73af\u5883\u5c3d\u91cf\u5173\u95ed: ffi.enable &#061; false<\/li>\n<li>\u5982\u5fc5\u987b\u4f7f\u7528,\u786e\u4fdd\u4ec5\u9884\u52a0\u8f7d\u53d7\u63a7\u5e93,\u5e76\u9650\u5236\u52a0\u8f7d\u8def\u5f84<\/li>\n<\/ul>\n<h5>4.5.2 Preloading: \u6027\u80fd\u63d0\u5347,\u5b8c\u6574\u6027\u8981\u6c42\u66f4\u9ad8<\/h5>\n<p>Preloading \u4f1a\u5728\u542f\u52a8\u65f6\u52a0\u8f7d\u4ee3\u7801,\u5982\u679c\u9884\u52a0\u8f7d\u6587\u4ef6\u88ab\u7be1\u6539,\u98ce\u9669\u4f1a\u88ab\u201c\u63d0\u524d\u6267\u884c\u201d\u3002<\/p>\n<p>\u9632\u62a4\u8981\u70b9:<\/p>\n<ul>\n<li>\u9884\u52a0\u8f7d\u6587\u4ef6\u53ea\u8bfb<\/li>\n<li>\u914d\u5408\u90e8\u7f72\u5b8c\u6574\u6027\u6821\u9a8c<\/li>\n<li>\u9650\u5236 opcache.preload_user<\/li>\n<\/ul>\n<h5>4.5.3 Typed Properties: \u7c7b\u578b\u5b89\u5168\u843d\u5230\u5bf9\u8c61\u5c42<\/h5>\n<p><span class=\"token keyword\">class<\/span> <span class=\"token class-name-definition class-name\">User<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token keyword\">public<\/span> <span class=\"token keyword type-declaration\">int<\/span> <span class=\"token variable\">$id<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token keyword\">public<\/span> <span class=\"token keyword type-declaration\">string<\/span> <span class=\"token variable\">$name<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p>\u5b89\u5168\u4ef7\u503c:<\/p>\n<ul>\n<li>\u51cf\u5c11\u7c7b\u578b\u6df7\u6dc6<\/li>\n<li>\u964d\u4f4e\u201c\u52a8\u6001\u5c5e\u6027\u6c61\u67d3\u201d\u7684\u98ce\u9669<\/li>\n<\/ul>\n<h5>4.5.4 __serialize \/ __unserialize<\/h5>\n<p>7.4 \u63d0\u4f9b\u66f4\u660e\u786e\u7684\u5e8f\u5217\u5316\u63a7\u5236\u5165\u53e3,\u4fbf\u4e8e\u663e\u5f0f\u58f0\u660e\u201c\u54ea\u4e9b\u5b57\u6bb5\u53ef\u5e8f\u5217\u5316\u201d\u3002<\/p>\n<p><span class=\"token keyword\">class<\/span> <span class=\"token class-name-definition class-name\">TokenBox<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token keyword\">private<\/span> <span class=\"token keyword type-declaration\">string<\/span> <span class=\"token variable\">$token<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token keyword\">public<\/span> <span class=\"token keyword\">function<\/span> <span class=\"token function-definition function\">__serialize<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">:<\/span> <span class=\"token keyword return-type\">array<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token keyword\">return<\/span> <span class=\"token punctuation\">[<\/span><span class=\"token string single-quoted-string\">&#039;token&#039;<\/span> <span class=\"token operator\">&#061;&gt;<\/span> <span class=\"token variable\">$this<\/span><span class=\"token operator\">-&gt;<\/span><span class=\"token property\">token<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><\/p>\n<p>    <span class=\"token keyword\">public<\/span> <span class=\"token keyword\">function<\/span> <span class=\"token function-definition function\">__unserialize<\/span><span class=\"token punctuation\">(<\/span><span class=\"token keyword type-hint\">array<\/span> <span class=\"token variable\">$data<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">:<\/span> <span class=\"token keyword return-type\">void<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token variable\">$this<\/span><span class=\"token operator\">-&gt;<\/span><span class=\"token property\">token<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token keyword type-casting\">string<\/span><span class=\"token punctuation\">)<\/span><span class=\"token variable\">$data<\/span><span class=\"token punctuation\">[<\/span><span class=\"token string single-quoted-string\">&#039;token&#039;<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p>\u5ba1\u8ba1\u63d0\u793a:<\/p>\n<ul>\n<li>\u4f7f\u7528\u663e\u5f0f\u5e8f\u5217\u5316\u65b9\u6cd5\u65f6,\u66f4\u6613\u505a\u5b57\u6bb5\u767d\u540d\u5355<\/li>\n<li>\u53cd\u5e8f\u5217\u5316\u65f6\u5fc5\u987b\u8fdb\u884c\u7c7b\u578b\/\u7ed3\u6784\u6821\u9a8c<\/li>\n<\/ul>\n<hr \/>\n<h3>5. \u5bf9\u68c0\u6d4b\u4e0e\u5ba1\u8ba1\u7684\u76f4\u63a5\u5f71\u54cd<\/h3>\n<p>\u7ed3\u5408\u672c\u9879\u76ee\u7684\u77e5\u8bc6\u5e93\u4e0e\u68c0\u6d4b\u7ecf\u9a8c,\u6211\u5efa\u8bae\u628a\u201c\u7248\u672c\u5dee\u5f02\u201d\u5f53\u4f5c\u68c0\u6d4b\u89c4\u5219\u7684\u7b2c\u4e00\u7ef4\u5ea6\u3002<\/p>\n<h4>5.1 \u89c4\u5219\u4e0e\u68c0\u6d4b\u5c42\u9762<\/h4>\n<ul>\n<li>\n<p>\u4f4e\u7248\u672c\u7279\u6027\u8981\u4fdd\u7559\u5355\u72ec\u7279\u5f81<br \/>\n\u4f8b\u5982 preg_replace \/e \u53ea\u5728\u8001\u7248\u672c\u5b58\u5728,\u89c4\u5219\u5e94\u6309\u7248\u672c\u5206\u5c42<\/p>\n<\/li>\n<li>\n<p>\u65b0\u589eAPI\u5e26\u6765\u65b0\u68c0\u6d4b\u9762<br \/>\n7.2&#043; \u7684 libsodium,7.4 \u7684 FFI,\u90fd\u53ef\u80fd\u6210\u4e3a\u65b0\u98ce\u9669\u70b9<\/p>\n<\/li>\n<li>\n<p>\u540c\u540d\u51fd\u6570\u5728\u4e0d\u540c\u7248\u672c\u7684\u8bed\u4e49\u5dee\u5f02<br \/>\n\u8fd9\u7c7b\u5dee\u5f02\u5bb9\u6613\u5f15\u53d1\u201c\u89c4\u5219\u8bef\u5224\u201d,\u9700\u8981\u7ed3\u5408\u7248\u672c\u89e3\u91ca<\/p>\n<\/li>\n<\/ul>\n<h4>5.2 \u5ba1\u8ba1\u5c42\u9762: \u7248\u672c\u5dee\u5f02\u7684\u5178\u578b\u5751<\/h4>\n<table>\n<tr>\u573a\u666f\u98ce\u9669\u5ba1\u8ba1\u8981\u70b9<\/tr>\n<tbody>\n<tr>\n<td>\u8001\u9879\u76ee\u8fc1\u79fb\u52307.x<\/td>\n<td>\u4e34\u65f6\u66ff\u6362\u4ee3\u7801\u5f15\u5165\u6f0f\u6d1e<\/td>\n<td>\u68c0\u67e5\u201c\u517c\u5bb9\u5c42\u4ee3\u7801\u201d\u662f\u5426\u5b89\u5168<\/td>\n<\/tr>\n<tr>\n<td>\u52a0\u5bc6\u903b\u8f91\u8de8\u7248\u672c<\/td>\n<td>\u7b97\u6cd5\u6df7\u7528\u3001\u5f31\u968f\u673a<\/td>\n<td>\u7edf\u4e00 password_hash\/random_bytes<\/td>\n<\/tr>\n<tr>\n<td>\u53cd\u5e8f\u5217\u5316\u4f7f\u7528\u573a\u666f<\/td>\n<td>\u65e7\u903b\u8f91\u672a\u52a0\u9650\u5236<\/td>\n<td>\u7edf\u4e00\u52a0\u5165 allowed_classes \u6216\u66ff\u6362\u4e3aJSON<\/td>\n<\/tr>\n<tr>\n<td>Cookie\u4e0eSession<\/td>\n<td>SameSite\u7f3a\u5931\u6216\u914d\u7f6e\u4e0d\u5f53<\/td>\n<td>7.3&#043;\u5efa\u8bae\u542f\u7528,\u4f4e\u7248\u672c\u9700\u624b\u52a8\u8865\u5145<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>5.3 \u7248\u672c\u5dee\u5f02\u5bfc\u81f4\u7684\u8bef\u62a5\/\u6f0f\u62a5<\/h4>\n<ul>\n<li>\u8bef\u62a5: \u89c4\u5219\u547d\u4e2d preg_replace \/e,\u4f46\u76ee\u6807\u73af\u5883\u5df2\u662f 7.0&#043;<\/li>\n<li>\u6f0f\u62a5: \u89c4\u5219\u53ea\u5173\u6ce8 eval,\u5374\u5ffd\u7565\u4e86 create_function \u6216 assert \u7684\u5386\u53f2\u7528\u6cd5<\/li>\n<\/ul>\n<p>\u5e94\u5bf9\u7b56\u7565:<\/p>\n<ul>\n<li>\u89c4\u5219\u4e2d\u660e\u786e\u6807\u6ce8\u201c\u9002\u7528\u7248\u672c\u201d<\/li>\n<li>\u5728\u626b\u63cf\u7ed3\u679c\u4e2d\u8f93\u51fa\u201c\u7248\u672c\u524d\u63d0\u201d<\/li>\n<li>\u9488\u5bf9\u591a\u7248\u672c\u90e8\u7f72\u505a\u5206\u5c42\u7b56\u7565<\/li>\n<\/ul>\n<hr \/>\n<h3>6. \u5347\u7ea7\u4e0e\u52a0\u56fa\u6e05\u5355(\u53ef\u76f4\u63a5\u6267\u884c)<\/h3>\n<p>\u4e0b\u9762\u662f\u4e00\u4efd\u53ef\u76f4\u63a5\u843d\u5730\u7684\u5b89\u5168\u6e05\u5355,\u6211\u5728\u5ba1\u8ba1\u9879\u76ee\u65f6\u7ecf\u5e38\u7528\u5b83\u505a\u201c\u7b2c\u4e00\u8f6e\u4f53\u68c0\u201d\u3002<\/p>\n<h4>6.1 \u8d44\u4ea7\u76d8\u70b9<\/h4>\n<ul>\n<li>\u786e\u8ba4 PHP \u7248\u672c\u3001SAPI \u7c7b\u578b\u4e0e\u5173\u952e\u6269\u5c55<\/li>\n<li>\u6807\u6ce8\u662f\u5426\u5b58\u5728 5.x \u8001\u7248\u672c\u9057\u7559\u4ee3\u7801<\/li>\n<li>\u5217\u51fa\u4f9d\u8d56\u7684\u5916\u90e8\u5e93\u7248\u672c,\u8bc6\u522b EOL \u4f9d\u8d56<\/li>\n<\/ul>\n<h4>6.2 \u4ee3\u7801\u8fc1\u79fb<\/h4>\n<ul>\n<li>\u66ff\u6362\u65e7\u6269\u5c55 (mysql_*, mcrypt)<\/li>\n<li>\u5bc6\u7801\u5b58\u50a8\u7edf\u4e00\u4e3a password_hash()<\/li>\n<li>\u968f\u673a\u6570\u7edf\u4e00\u4e3a random_bytes() \/ random_int()<\/li>\n<li>\u53cd\u5e8f\u5217\u5316\u903b\u8f91\u52a0 allowed_classes \u6216\u66ff\u6362\u4e3a JSON<\/li>\n<li>\u65e7\u4ee3\u7801\u7684\u201c\u4e34\u65f6\u66ff\u6362\u903b\u8f91\u201d\u9700\u8981\u91cd\u70b9\u590d\u5ba1<\/li>\n<\/ul>\n<h4>6.3 \u5b89\u5168\u914d\u7f6e\u57fa\u7ebf<\/h4>\n<p>expose_php &#061; Off<br \/>\ndisplay_errors &#061; Off<br \/>\nlog_errors &#061; On<br \/>\nallow_url_include &#061; Off<\/p>\n<p>\u5efa\u8bae\u8ffd\u52a0:<\/p>\n<p>session.use_strict_mode &#061; 1<br \/>\nsession.use_only_cookies &#061; 1<br \/>\nsession.cookie_httponly &#061; 1<\/p>\n<p>Session\u5b89\u5168\u5efa\u8bae(7.3&#043;):<\/p>\n<p><span class=\"token function\">ini_set<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string single-quoted-string\">&#039;session.cookie_httponly&#039;<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token string single-quoted-string\">&#039;1&#039;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token function\">ini_set<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string single-quoted-string\">&#039;session.cookie_secure&#039;<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token string single-quoted-string\">&#039;1&#039;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token function\">ini_set<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string single-quoted-string\">&#039;session.cookie_samesite&#039;<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token string single-quoted-string\">&#039;Lax&#039;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<h4>6.4 \u8fd0\u884c\u65f6\u6743\u9650\u4e0e\u76ee\u5f55\u9694\u79bb<\/h4>\n<ul>\n<li>\u9650\u5236\u53ef\u5199\u76ee\u5f55,\u907f\u514d\u201c\u4e0a\u4f20\u5373\u6267\u884c\u201d<\/li>\n<li>\u5f00\u542f\u5b8c\u6574\u6027\u68c0\u6d4b\u6216\u53ea\u8bfb\u90e8\u7f72,\u964d\u4f4e\u9884\u52a0\u8f7d\/\u7f13\u5b58\u88ab\u7be1\u6539\u7684\u98ce\u9669<\/li>\n<li>\u5b9a\u671f\u590d\u6838 disable_functions \u4e0e\u6269\u5c55\u767d\u540d\u5355<\/li>\n<\/ul>\n<h4>6.5 \u5347\u7ea7\u540e\u7684\u5b89\u5168\u56de\u5f52\u9a8c\u8bc1<\/h4>\n<p>\u6700\u5c0f\u5b89\u5168\u56de\u5f52\u6e05\u5355:<\/p>\n<ul>\n<li class=\"task-list-item\"> \u767b\u5f55\/\u9274\u6743\u662f\u5426\u53d7\u5f71\u54cd<\/li>\n<li class=\"task-list-item\"> CSRF\u4e0eCookie\u7b56\u7565\u662f\u5426\u751f\u6548<\/li>\n<li class=\"task-list-item\"> \u4e0a\u4f20\/\u6587\u4ef6\u8bfb\u5199\u662f\u5426\u53d7\u9650<\/li>\n<li class=\"task-list-item\"> \u5173\u952e\u63a5\u53e3\u5f02\u5e38\u5904\u7406\u662f\u5426\u53ef\u63a7<\/li>\n<li class=\"task-list-item\"> \u65e5\u5fd7\u662f\u5426\u5b8c\u6574\u53ef\u8ffd\u8e2a<\/li>\n<\/ul>\n<hr \/>\n<h3>7. \u5c0f\u7ed3\u4e0e\u5ef6\u4f38<\/h3>\n<h4>7.1 \u5173\u952e\u8981\u70b9\u56de\u987e<\/h4>\n<li>\u7248\u672c\u5dee\u5f02\u5c31\u662f\u5b89\u5168\u5dee\u5f02<\/li>\n<li>5.4-5.6 \u6e05\u7406\u5386\u53f2\u5305\u88b1,\u5960\u5b9a\u5b89\u5168\u57fa\u7840<\/li>\n<li>7.0 \u5f15\u64ce\u91cd\u6784\u8ba9\u8bed\u4e49\u4e0e\u9519\u8bef\u5904\u7406\u66f4\u53ef\u63a7<\/li>\n<li>7.1-7.4 \u5b89\u5168\u80fd\u529b\u73b0\u4ee3\u5316,\u4f46\u65b0\u80fd\u529b\u4e5f\u5e26\u6765\u65b0\u653b\u51fb\u9762<\/li>\n<li>\u68c0\u6d4b\u4e0e\u5ba1\u8ba1\u5fc5\u987b\u5f15\u5165\u201c\u7248\u672c\u7ef4\u5ea6\u201d<\/li>\n<h4>7.2 \u5e38\u89c1\u95ee\u9898\u901f\u7b54<\/h4>\n<p>Q1: \u5347\u7ea7\u540eHTTPS\u8bf7\u6c42\u7a81\u7136\u5931\u8d25?<br \/>\n\u5f88\u53ef\u80fd\u662f\u8bc1\u4e66\u6821\u9a8c\u66f4\u4e25\u683c\u3002\u68c0\u67e5 cafile\u3001\u7cfb\u7edf\u8bc1\u4e66\u94fe\u914d\u7f6e,\u4e0d\u8981\u76f4\u63a5\u5173\u95ed\u6821\u9a8c\u3002<\/p>\n<p>Q2: JSON\u89e3\u6790\u201c\u7a81\u7136\u62a5\u9519\u201d?<br \/>\n7.3&#043; \u53ef\u80fd\u542f\u7528\u4e86 JSON_THROW_ON_ERROR\u3002\u5efa\u8bae\u6355\u83b7\u5f02\u5e38\u5e76\u505a\u8f93\u5165\u6821\u9a8c\u3002<\/p>\n<p>Q3: \u8fc1\u79fb\u540e\u767b\u5f55\u5f02\u5e38?<br \/>\n\u5e38\u89c1\u539f\u56e0\u662f\u5bc6\u7801hash\u7b97\u6cd5\u5347\u7ea7\u6216\u53c2\u6570\u53d8\u5316\u3002\u9700\u8981\u4f7f\u7528 password_needs_rehash() \u505a\u5e73\u6ed1\u5347\u7ea7\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>1. \u4e3a\u4ec0\u4e48\u7248\u672c\u6f14\u8fdb\u4f1a\u6539\u53d8\u5b89\u5168\u8fb9\u754c<br \/>\n\u4ece\u5b89\u5168\u89c6\u89d2\u770b,\u7248\u672c\u5347\u7ea7\u4e0d\u662f\u201c\u6027\u80fd\u66f4\u5feb\u201d\u8fd9\u4e48\u7b80\u5355,\u800c\u662f\u4e09\u7c7b\u8fb9\u754c\u5728\u53d8\u5316:\u53ef\u7528\u7684\u5371\u9669\u80fd\u529b\u5728\u53d8\u5316<br \/>\n\u67d0\u4e9b\u5386\u53f2\u7279\u6027\u88ab\u79fb\u9664\u3001\u67d0\u4e9b\u6269\u5c55\u88ab\u66ff\u4ee3,\u653b\u51fb\u9762\u76f4\u63a5\u51cf\u5c11\u6216\u8fc1\u79fb\u3002\u9ed8\u8ba4\u884c\u4e3a\u5728\u53d8\u5316<br \/>\n\u52a0\u5bc6\u3001SSL\/TLS \u6821\u9a8c\u3001Session Cookie \u5c5e\u6027\u7b49\u9ed8\u8ba4\u503c\u53d8\u5316,\u4f1a\u5f71\u54cd\u5b9e\u9645\u5b89\u5168\u7b49\u7ea7\u3002\u9519\u8bef\u5904\u7406\u4e0e\u5f15\u64ce\u884c\u4e3a\u5728\u53d8\u5316<br \/>\n\u5f15\u64ce\u7ea7\u522b\u7684\u201c\u8bed\u4e49\u7edf\u4e00\u5316\u201d,\u4f1a\u6539\u53d8\u6f0f\u6d1e\u89e6\u53d1\u6761\u4ef6\u548c\u68c0\u6d4b\u7279\u5f81\u3002\u5b89\u5168\u5ba1\u8ba1\u5efa\u8bae:<br \/>\n\u522b\u53ea\u95ee\u201c\u4ee3\u7801\u91cc\u6709\u6ca1\u6709\u5371\u9669\u51fd\u6570\u201d,\u8fd8\u8981\u95ee\u201c\u8fd9\u4e2a\u7248\u672c\u91cc\u8fd9\u4e2a\u51fd\u6570\u7684\u884c\u4e3a\u662f\u5426\u53d8\u5316\u6216\u5df2\u88ab\u5e9f\u5f03\u201d\u3002<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[7368,230,61],"topic":[],"class_list":["post-70162","post","type-post","status-publish","format-standard","hentry","category-server","tag-webshell","tag-php","tag-61"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>\u4e8c\u3001PHP 5.4-7.4\u7248\u672c\u6f14\u8fdb\u4e0e\u5b89\u5168\u6539\u8fdb - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/70162.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u4e8c\u3001PHP 5.4-7.4\u7248\u672c\u6f14\u8fdb\u4e0e\u5b89\u5168\u6539\u8fdb - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"1. \u4e3a\u4ec0\u4e48\u7248\u672c\u6f14\u8fdb\u4f1a\u6539\u53d8\u5b89\u5168\u8fb9\u754c \u4ece\u5b89\u5168\u89c6\u89d2\u770b,\u7248\u672c\u5347\u7ea7\u4e0d\u662f\u201c\u6027\u80fd\u66f4\u5feb\u201d\u8fd9\u4e48\u7b80\u5355,\u800c\u662f\u4e09\u7c7b\u8fb9\u754c\u5728\u53d8\u5316:\u53ef\u7528\u7684\u5371\u9669\u80fd\u529b\u5728\u53d8\u5316 \u67d0\u4e9b\u5386\u53f2\u7279\u6027\u88ab\u79fb\u9664\u3001\u67d0\u4e9b\u6269\u5c55\u88ab\u66ff\u4ee3,\u653b\u51fb\u9762\u76f4\u63a5\u51cf\u5c11\u6216\u8fc1\u79fb\u3002\u9ed8\u8ba4\u884c\u4e3a\u5728\u53d8\u5316 \u52a0\u5bc6\u3001SSL\/TLS \u6821\u9a8c\u3001Session Cookie \u5c5e\u6027\u7b49\u9ed8\u8ba4\u503c\u53d8\u5316,\u4f1a\u5f71\u54cd\u5b9e\u9645\u5b89\u5168\u7b49\u7ea7\u3002\u9519\u8bef\u5904\u7406\u4e0e\u5f15\u64ce\u884c\u4e3a\u5728\u53d8\u5316 \u5f15\u64ce\u7ea7\u522b\u7684\u201c\u8bed\u4e49\u7edf\u4e00\u5316\u201d,\u4f1a\u6539\u53d8\u6f0f\u6d1e\u89e6\u53d1\u6761\u4ef6\u548c\u68c0\u6d4b\u7279\u5f81\u3002\u5b89\u5168\u5ba1\u8ba1\u5efa\u8bae: \u522b\u53ea\u95ee\u201c\u4ee3\u7801\u91cc\u6709\u6ca1\u6709\u5371\u9669\u51fd\u6570\u201d,\u8fd8\u8981\u95ee\u201c\u8fd9\u4e2a\u7248\u672c\u91cc\u8fd9\u4e2a\u51fd\u6570\u7684\u884c\u4e3a\u662f\u5426\u53d8\u5316\u6216\u5df2\u88ab\u5e9f\u5f03\u201d\u3002\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/70162.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-02-01T07:36:35+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/70162.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/70162.html\",\"name\":\"\u4e8c\u3001PHP 5.4-7.4\u7248\u672c\u6f14\u8fdb\u4e0e\u5b89\u5168\u6539\u8fdb - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-02-01T07:36:35+00:00\",\"dateModified\":\"2026-02-01T07:36:35+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/70162.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/70162.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/70162.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u4e8c\u3001PHP 5.4-7.4\u7248\u672c\u6f14\u8fdb\u4e0e\u5b89\u5168\u6539\u8fdb\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\u4e8c\u3001PHP 5.4-7.4\u7248\u672c\u6f14\u8fdb\u4e0e\u5b89\u5168\u6539\u8fdb - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/70162.html","og_locale":"zh_CN","og_type":"article","og_title":"\u4e8c\u3001PHP 5.4-7.4\u7248\u672c\u6f14\u8fdb\u4e0e\u5b89\u5168\u6539\u8fdb - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"1. \u4e3a\u4ec0\u4e48\u7248\u672c\u6f14\u8fdb\u4f1a\u6539\u53d8\u5b89\u5168\u8fb9\u754c \u4ece\u5b89\u5168\u89c6\u89d2\u770b,\u7248\u672c\u5347\u7ea7\u4e0d\u662f\u201c\u6027\u80fd\u66f4\u5feb\u201d\u8fd9\u4e48\u7b80\u5355,\u800c\u662f\u4e09\u7c7b\u8fb9\u754c\u5728\u53d8\u5316:\u53ef\u7528\u7684\u5371\u9669\u80fd\u529b\u5728\u53d8\u5316 \u67d0\u4e9b\u5386\u53f2\u7279\u6027\u88ab\u79fb\u9664\u3001\u67d0\u4e9b\u6269\u5c55\u88ab\u66ff\u4ee3,\u653b\u51fb\u9762\u76f4\u63a5\u51cf\u5c11\u6216\u8fc1\u79fb\u3002\u9ed8\u8ba4\u884c\u4e3a\u5728\u53d8\u5316 \u52a0\u5bc6\u3001SSL\/TLS \u6821\u9a8c\u3001Session Cookie \u5c5e\u6027\u7b49\u9ed8\u8ba4\u503c\u53d8\u5316,\u4f1a\u5f71\u54cd\u5b9e\u9645\u5b89\u5168\u7b49\u7ea7\u3002\u9519\u8bef\u5904\u7406\u4e0e\u5f15\u64ce\u884c\u4e3a\u5728\u53d8\u5316 \u5f15\u64ce\u7ea7\u522b\u7684\u201c\u8bed\u4e49\u7edf\u4e00\u5316\u201d,\u4f1a\u6539\u53d8\u6f0f\u6d1e\u89e6\u53d1\u6761\u4ef6\u548c\u68c0\u6d4b\u7279\u5f81\u3002\u5b89\u5168\u5ba1\u8ba1\u5efa\u8bae: \u522b\u53ea\u95ee\u201c\u4ee3\u7801\u91cc\u6709\u6ca1\u6709\u5371\u9669\u51fd\u6570\u201d,\u8fd8\u8981\u95ee\u201c\u8fd9\u4e2a\u7248\u672c\u91cc\u8fd9\u4e2a\u51fd\u6570\u7684\u884c\u4e3a\u662f\u5426\u53d8\u5316\u6216\u5df2\u88ab\u5e9f\u5f03\u201d\u3002","og_url":"https:\/\/www.wsisp.com\/helps\/70162.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-02-01T07:36:35+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"3 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/70162.html","url":"https:\/\/www.wsisp.com\/helps\/70162.html","name":"\u4e8c\u3001PHP 5.4-7.4\u7248\u672c\u6f14\u8fdb\u4e0e\u5b89\u5168\u6539\u8fdb - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-02-01T07:36:35+00:00","dateModified":"2026-02-01T07:36:35+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/70162.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/70162.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/70162.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"\u4e8c\u3001PHP 5.4-7.4\u7248\u672c\u6f14\u8fdb\u4e0e\u5b89\u5168\u6539\u8fdb"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/70162","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=70162"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/70162\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=70162"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=70162"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=70162"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=70162"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}