Question

我只是一个周末编码员，仅在自己的项目上工作，但我想以相当安全的方式使用$ _GET。我通常从表中使用$ _GET，其中有许多项目要对（编辑，删除）执行一些操作。你们中的任何资深人士是否发现我所创建的功能存在任何安全性问题，或更简单，更优雅的实现方式？感谢您的投入，谢谢。

<?php session_start();
if (empty($_SESSION['SecretKey'])) {
    $_SESSION['SecretKey'] = bin2hex(openssl_random_pseudo_bytes(16));
}

function GetURLEncode($ArrayData,$SecretKey,$Echo = true) {
    $GetQuery = http_build_query($ArrayData,'','&');
    $Checksum = http_build_query(Array("Checksum" => hash_hmac('ripemd160', $GetQuery, $SecretKey)));
    if ($Echo) {
        echo '<a href="?'.$GetQuery.'&'.$Checksum.'">'.htmlspecialchars($ArrayData['Action']).'</a>';
    } else {
        return "?".$GetQuery."&".$Checksum;
    }
}

function GetURLDecode($GetData,$SecretKey,&$ReturnData) {
    $Checksum = $GetData['Checksum'];
    unset($GetData['Checksum']);
    $GetQuery = http_build_query($GetData,'','&');
    if (hash_equals(hash_hmac('ripemd160', $GetQuery, $SecretKey),$Checksum)) {
        $ReturnData = $GetData;
        return true;
    }
    $ReturnData = "";
    return false;
}

if (!empty($_GET)) {
    if (GetURLDecode($_GET,$_SESSION['SecretKey'],$ReturnData)) {
        echo "Array Returned<br>";
        echo var_dump($ReturnData)."<br><Br>";
    } else {
        echo "Checksum Error<br><br>";
    }
}

//Example 1
$MyArray1 = Array ("FirstName" => "John",
                   "LastName" => "Doe",
                   "Adderss" => "12345 MyStreet",
                   "City" => "Apple Valley",
                   "State" => "California");

echo "Sample 1<br>";
$URL = GetURLEncode($MyArray1,$_SESSION['SecretKey'],false);
echo '<a href="'.$URL.'">Click Me</a>';

//Example 2
$MyArray2 = Array(Array("Id" => 0,"Make" => "Chevy","Model" => "HHR"),
                  Array("Id" => 1,"Make" => "Chevy","Model" => "Corvette"),
                  Array("Id" => 2,"Make" => "Ford","Model" => "Mustang"),
                  Array("Id" => 3,"Make" => "Nissan","Model" => "Sentra"),
                  Array("Id" => 4,"Make" => "Ford","Model" => "Ranger"),
                  Array("Id" => 5,"Make" => "Dodge","Model" => "Charger"));?>
<br><br>
<table>
    <th>sample 2</th>
<?php foreach ($MyArray2 as $Array) { ?>

    <tr>
        <td><?= $Array['Make'];?></td>
        <td><?= $Array['Model'];?></td>
        <td><?php GetURLEncode(array("Id"=>$Array['Id'],"Action"=>"Edit"),$_SESSION['SecretKey']);?></td>
        <td><?php GetURLEncode(array("Id"=>$Array['Id'],"Action"=>"Delete"),$_SESSION['SecretKey']);?></td>
    </tr>
<?php } ?>

</table>

这是使用$ _GET的合理安全方法吗？

0 个答案: