dedecms网站入侵

// 示例代码：使用PDO防止SQL注入
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');
$stmt->execute(['username' => $username]);
$result = $stmt->fetchAll();

// 示例代码：文件上传安全检查
if ($_FILES['file']['size'] > 1024 * 1024) {
    die('文件大小超过限制');
}
$allowed_types = ['jpg', 'png', 'gif'];
$file_ext = pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION);
if (!in_array($file_ext, $allowed_types)) {
    die('不支持的文件类型');
}
$upload_path = '/uploads/' . uniqid() . '.' . $file_ext;
move_uploaded_file($_FILES['file']['tmp_name'], $upload_path);

// 示例代码：HTML转义
function escapeHtml($string) {
    return htmlspecialchars($string, ENT_QUOTES | ENT_HTML5, 'UTF-8');
}
echo escapeHtml($_POST['input']);

// 示例代码：CSRF令牌验证
session_start();
if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
if ($_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    die('CSRF验证失败');
}