Question

我有一个动态管理面板，我需要实现一项功能，以帮助用户添加新的类别或子类别页面。

我有一个表单，用户可以在其中输入类别的名称，图像和类别说明。我希望整个页面都是动态的，但事实证明它是静态的。我无法找到在新创建的页面上运行查询的方法。

<script src="ckeditor/ckeditor.js"></script>

<?php
include'header.php';
include'connection.php'; 
?>
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js"></script>
<script>
function CreateURL()
{
    var CatName = document.getElementById("Catname").value;
    var URL = CatName.toLowerCase();
    var replacedString = URL.replace(/ /g, "-");
    var FinalURL = replacedString + ".php";
    var a = document.getElementById("CreatedURl");
    a.value = FinalURL;
}
</script>
<?php
 if(isset($_POST['sub']))
 {
 $catname=$_POST['category_name'];
 $url=$_POST['url'];

 $desc=$_POST['category_description'];



$myFile = "../$url"; // or .php   
$fh = fopen($myFile, 'w');
$stringData = "<?php \n";
$stringData .= "include'header.php' \n";
$stringData .= "?> \n";
$stringData .= "<div class='clearfix mb5'></div> \n"; 
$stringData .= "<div class='inner-banner'><img src='images/inner-banner.jpg' alt='' class='img-responsive' id='innban' /></div> \n";
$stringData .= "<div class='clearfix'></div> \n";
$stringData .= "<h1 class='fl'></h1>  <p class='clearfix'></p> <div class='tree'> \n";
$stringData .= "<div class='breadcrumb_outer hidden-xs'> \n";
$stringData .= "<div class='container'> \n";
$stringData .=    "<ul class='breadcrumb'> \n";
$stringData .=   "<li class='pl5'><a class='brd' href='index.php'>Home</a></li><li id='brt' class='active'><?php echo $catname; ?></li> \n";
$stringData .= "</ul> \n";
$stringData .= "</div> \n";
$stringData .= "</div> \n";
$stringData .= "<div itemscope='' itemtype='http://data-vocabulary.org/Breadcrumb' class='dib'><span itemprop='title'></span></div> \n";
$stringData .= "</div> \n";
$stringData .= "<div class='container'> \n";
$stringData .= "<div class='mid_area'> \n";

$stringData .= "<div class='pl5 pr5'> \n";

$stringData .="<div class='row'> \n";

$stringData .= "<div class='col-md-9' style='background-color:#deebf7;'> \n";
$stringData .= "<h1 class='mb20'><?php echo $catname; ?></h1> \n";
$stringData .= "<p1 class='innertext'> \n";
$stringData .=   "<?php echo $desc; ?> \n";
$stringData .= "</p1> \n";
$stringData .= "<br> \n";
$stringData .= "<br> \n";
$stringData .= "<p2 class='innertex'>Please click the adjacent tool bar to explore the <?php echo $catname; ?> undertaken by Racon Marine. </p2> \n";
$stringData .= "<?php include'sidebar.php'; ?> \n";
$stringData .= "<div class='clearfix mb10'></div> \n"; 
$stringData .= "</div></div></div></div><br><br><br> \n";
$stringData .= "<?php include'footer.php'; ?>";
fwrite($fh, $stringData);

$dir=explode(".",$url);


$image = $_FILES['image']['name'];
    $temp_name = $_FILES['image']['tmp_name'];
    move_uploaded_file($temp_name, "homethumbs/$image");

$sql="INSERT INTO category(name,image,url,description) VALUES('$catname','$image','$url','$desc')";
$query = mysqli_query($conn, $sql);
if($query)
    {
$directoryName = "../".$dir[0];
if(!is_dir($directoryName)){
//Directory does not exist, so lets create it.
mkdir($directoryName, 0755, true);
 }

echo"<script> alert('Category added successfully...');</script>";


 }
else
 {
echo"<script> alert('Unsuccessful..');</script>";
 }

fclose($fh);


}
?>
<div class="content">
<div id="content">

<div class="breadcrumb_sitepanel"><a href="dashboard.php">Home</a> &raquo; 
<a href="categories.php">Back To Listing</a> &raquo; Add Category </a></div>
<div class="box">
<div class="heading">
<h1><img src="image/category.png" alt="" /> Add Category</h1>
<div class="buttons"><a href="categories.php" class="button" ><span>Cancel</span></a></div>
</div>
<div class="content">
 <form action="" enctype="multipart/form-data" method="post" accept-charset="utf-8">
 <div id="tab_pinfo">
 <table width="90%"  class="form"  cellpadding="3" cellspacing="3">
  <tr><th colspan="2" align="center" > </th></tr>
    <tr class="trOdd">
  <td height="26" align="right" ><span class="required">*</span> Name :</td>
  <td>
    <input type="text" name="category_name" value=""  class="url_creator" placeholder="Your Catgeory Name" size="40" id="Catname" required /> <a href="#" class="url_from_title" onclick="CreateURL()">Create URL</a><br />

    <div id="error_url_creator" class="red"></div>
  </td>
  </tr>
  <tr class="trOdd">
   <td height="26" align="right"><span class="required">**</span> 
    Page URL :</td>
   <td>
   <div class="seo_url">
              <input type="text" id="CreatedURl" name="url" required/>
   </div>
   <div id="error_friendly_url" class="red"></div>
    </td>
     </tr>

        <tr class="trOdd">
         <td width="28%" height="26" align="right" >Image :</td>
         <td align="left"><input type="file" name="image" required/><br /><br />[ ( File should be .jpg, .png, .gif format and file size should not be more then 1 MB (1024 KB)) ( Best image size 225X218) ]</td>
        </tr>

        <tr class="trOdd">
         <td width="28%" height="26" align="right" >Alt :</td>
         <td align="left"><input type="text" name="category_alt" value="" /><br /></td>
        </tr>
        <tr class="trOdd">
         <td height="26" align="right"> Description :</td>
         <td><textarea class="ckeditor" name="category_description" rows="5" cols="50" id="cat_desc" required></textarea></td>
        </tr>

        <tr class="trOdd">
         <td align="left">&nbsp;</td>
         <td align="left">
          <input type="submit" name="sub" value="Add" class="button2" />

                     </td>
        </tr>
     </table>
    </div>
    </form>  </div>
   </div>
  </div>
  </div>
  </div>
 <div id="footer">Racon Marine &copy; 2017 All Rights Reserved.</div>
 </body></html>

Answer 1

提供的代码容易受到：

SQL注入攻击（$ catname未在任何地方验证）
XSS攻击（任何人都可以将javascript发布到网站上）
任意代码上传攻击通过将任何数据传递给fopen（）而不进行检查，$ url变量可能包含恶意字符串，如../../../some_other_folder.php

请考虑以下事项：

验证用户输入（如果它将被输入fopen，删除斜杠并考虑使用escapeshellcmd
将用户数据存储在数据库而不是php文件中。
磁盘缓慢使用db。

$catname=$_POST['category_name'];
//some lines later:
$sql="INSERT INTO category(name,image,url,description) VALUES('$catname','$image','$url','$desc')";
$query = mysqli_query($conn, $sql);
//SQL Injection attack happens here ---------------------------^

用户的输入未经过验证，因此任何人都可以在数据库的任何表上的任何字段上放置他们想要的任何内容，他们可以刷新数据库等。这不好。

我认为更好的方法是简单地从用户接收数据并存储在数据库中，并将.htaccess文件mod_rewrite重定向和单个php文件组合起来处理所有动态请求。

我一直在那里，动态生成php文件，不是一个好主意，不可扩展，一旦你在一个文件夹上有数千个php文件，FTP客户端变得迟钝等文件系统就会出现问题。

还有这个：

$fh = fopen($myFile, 'w');
$stringData = "<?php \n";
$stringData .= "include'header.php' \n";
$stringData .= "?> \n";

//some lines elided

$stringData .=   "<?php echo $desc; ?> \n";

//vulnerability -------------^


//some lines elided

$stringData .= "</p1> \n";
fwrite($fh, $stringData);

任何人都可以向$ desc发送任何字节，这意味着他们可以将任意和恶意的php上传到服务器，并运行任意命令，例如，下载所有源代码，破坏网站等。

除非用户的输入被清理，否则此代码将是危险的。

HTH。

Answer 2

而不是这个 $stringData .= "<h1 class='mb20'><?php echo $catname; ?></h1> \n"; 这样做$stringData .= "<h1 class='mb20'>$catname</h1> \n";

使用PHP创建一个新的PHP文件

2 个答案: