javascript - 使用 PHP 创建一个新的 PHP 文件

Question

我有一个动态管理面板，我需要在其中实现一项功能来帮助用户添加新类别或子类别页面。

我有一个表单，用户可以在其中输入类别名称、图像和类别描述。我希望整个页面都是动态的，但结果却是静态的。我想不出在新创建的页面上运行查询的方法。

<script src="ckeditor/ckeditor.js"></script>

<?php
include'header.php';
include'connection.php'; 
?>
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js"></script>
<script>
function CreateURL()
{
    var CatName = document.getElementById("Catname").value;
    var URL = CatName.toLowerCase();
    var replacedString = URL.replace(/ /g, "-");
    var FinalURL = replacedString + ".php";
    var a = document.getElementById("CreatedURl");
    a.value = FinalURL;
}
</script>
<?php
 if(isset($_POST['sub']))
 {
 $catname=$_POST['category_name'];
 $url=$_POST['url'];

 $desc=$_POST['category_description'];



$myFile = "../$url"; // or .php   
$fh = fopen($myFile, 'w');
$stringData = "<?php \n";
$stringData .= "include'header.php' \n";
$stringData .= "?> \n";
$stringData .= "<div class='clearfix mb5'></div> \n"; 
$stringData .= "<div class='inner-banner'><img src='images/inner-banner.jpg' alt='' class='img-responsive' id='innban' /></div> \n";
$stringData .= "<div class='clearfix'></div> \n";
$stringData .= "<h1 class='fl'></h1>  <p class='clearfix'></p> <div class='tree'> \n";
$stringData .= "<div class='breadcrumb_outer hidden-xs'> \n";
$stringData .= "<div class='container'> \n";
$stringData .=    "<ul class='breadcrumb'> \n";
$stringData .=   "<li class='pl5'><a class='brd' href='index.php'>Home</a></li><li id='brt' class='active'><?php echo $catname; ?></li> \n";
$stringData .= "</ul> \n";
$stringData .= "</div> \n";
$stringData .= "</div> \n";
$stringData .= "<div itemscope='' itemtype='http://data-vocabulary.org/Breadcrumb' class='dib'><span itemprop='title'></span></div> \n";
$stringData .= "</div> \n";
$stringData .= "<div class='container'> \n";
$stringData .= "<div class='mid_area'> \n";

$stringData .= "<div class='pl5 pr5'> \n";

$stringData .="<div class='row'> \n";

$stringData .= "<div class='col-md-9' style='background-color:#deebf7;'> \n";
$stringData .= "<h1 class='mb20'><?php echo $catname; ?></h1> \n";
$stringData .= "<p1 class='innertext'> \n";
$stringData .=   "<?php echo $desc; ?> \n";
$stringData .= "</p1> \n";
$stringData .= "<br> \n";
$stringData .= "<br> \n";
$stringData .= "<p2 class='innertex'>Please click the adjacent tool bar to explore the <?php echo $catname; ?> undertaken by Racon Marine. </p2> \n";
$stringData .= "<?php include'sidebar.php'; ?> \n";
$stringData .= "<div class='clearfix mb10'></div> \n"; 
$stringData .= "</div></div></div></div><br><br><br> \n";
$stringData .= "<?php include'footer.php'; ?>";
fwrite($fh, $stringData);

$dir=explode(".",$url);


$image = $_FILES['image']['name'];
    $temp_name = $_FILES['image']['tmp_name'];
    move_uploaded_file($temp_name, "homethumbs/$image");

$sql="INSERT INTO category(name,image,url,description) VALUES('$catname','$image','$url','$desc')";
$query = mysqli_query($conn, $sql);
if($query)
    {
$directoryName = "../".$dir[0];
if(!is_dir($directoryName)){
//Directory does not exist, so lets create it.
mkdir($directoryName, 0755, true);
 }

echo"<script> alert('Category added successfully...');</script>";


 }
else
 {
echo"<script> alert('Unsuccessful..');</script>";
 }

fclose($fh);


}
?>
<div class="content">
<div id="content">

<div class="breadcrumb_sitepanel"><a href="dashboard.php">Home</a> &raquo; 
<a href="categories.php">Back To Listing</a> &raquo; Add Category </a></div>
<div class="box">
<div class="heading">
<h1><img src="image/category.png" alt="" /> Add Category</h1>
<div class="buttons"><a href="categories.php" class="button" ><span>Cancel</span></a></div>
</div>
<div class="content">
 <form action="" enctype="multipart/form-data" method="post" accept-charset="utf-8">
 <div id="tab_pinfo">
 <table width="90%"  class="form"  cellpadding="3" cellspacing="3">
  <tr><th colspan="2" align="center" > </th></tr>
    <tr class="trOdd">
  <td height="26" align="right" ><span class="required">*</span> Name :</td>
  <td>
    <input type="text" name="category_name" value=""  class="url_creator" placeholder="Your Catgeory Name" size="40" id="Catname" required /> <a href="#" class="url_from_title" onclick="CreateURL()">Create URL</a><br />

    <div id="error_url_creator" class="red"></div>
  </td>
  </tr>
  <tr class="trOdd">
   <td height="26" align="right"><span class="required">**</span> 
    Page URL :</td>
   <td>
   <div class="seo_url">
              <input type="text" id="CreatedURl" name="url" required/>
   </div>
   <div id="error_friendly_url" class="red"></div>
    </td>
     </tr>

        <tr class="trOdd">
         <td width="28%" height="26" align="right" >Image :</td>
         <td align="left"><input type="file" name="image" required/><br /><br />[ ( File should be .jpg, .png, .gif format and file size should not be more then 1 MB (1024 KB)) ( Best image size 225X218) ]</td>
        </tr>

        <tr class="trOdd">
         <td width="28%" height="26" align="right" >Alt :</td>
         <td align="left"><input type="text" name="category_alt" value="" /><br /></td>
        </tr>
        <tr class="trOdd">
         <td height="26" align="right"> Description :</td>
         <td><textarea class="ckeditor" name="category_description" rows="5" cols="50" id="cat_desc" required></textarea></td>
        </tr>

        <tr class="trOdd">
         <td align="left">&nbsp;</td>
         <td align="left">
          <input type="submit" name="sub" value="Add" class="button2" />

                     </td>
        </tr>
     </table>
    </div>
    </form>  </div>
   </div>
  </div>
  </div>
  </div>
 <div id="footer">Racon Marine &copy; 2017 All Rights Reserved.</div>
 </body></html>

Answer 1

所提供的代码易受以下攻击:

• SQL 注入(inject)攻击($catname 未在任何地方验证)
• XSS 攻击(任何人都可以向网站发布 javascript)
• 任意代码上传攻击 通过将任何数据传递给 fopen() 而不进行检查，$url 变量可能包含恶意字符串，例如 ../../../some_other_folder.php

考虑以下几点:

• 验证用户输入(如果将输入到 fopen，删除斜杠并考虑使用 escapeshellcmd
• 将用户数据存储在数据库中，而不是 php 文件。
• 磁盘很慢请改用数据库。

---

$catname=$_POST['category_name'];
//some lines later:
$sql="INSERT INTO category(name,image,url,description) VALUES('$catname','$image','$url','$desc')";
$query = mysqli_query($conn, $sql);
//SQL Injection attack happens here ---------------------------^

用户的输入没有经过验证，所以任何人都可以在数据库的任何表的任何字段上放置任何他们想要的东西，他们可以刷新数据库，等等。 这可不好。

我认为更好的方法是简单地从用户接收数据并将其存储在数据库中，并结合使用 .htaccess 文件 mod_rewrite 重定向和单个 php 文件来处理所有动态请求。

我去过那里，动态生成 php 文件，这不是一个好主意，不可扩展，一旦你在一个文件夹中有数千个 php 文件，文件系统就会出现问题，FTP 客户端变得缓慢等等。

还有这个:

$fh = fopen($myFile, 'w');
$stringData = "<?php \n";
$stringData .= "include'header.php' \n";
$stringData .= "?> \n";

//some lines elided

$stringData .=   "<?php echo $desc; ?> \n";

//vulnerability -------------^


//some lines elided

$stringData .= "</p1> \n";
fwrite($fh, $stringData);

任何人都可以向 $desc 发送任何字节，这意味着他们可以将任意和恶意的 php 上传到服务器，并运行任意命令，例如，下载所有源代码，破坏网站等。

除非用户的输入经过清理，否则此代码将很危险。

HTH.