php接口开发 安全

// 不安全的代码
$query = "SELECT * FROM users WHERE username = '" . $_GET['username'] . "'";

// 安全的代码
$username = mysqli_real_escape_string($conn, $_GET['username']);
$query = "SELECT * FROM users WHERE username = '$username'";

// 不安全的代码
echo $_GET['input'];

// 安全的代码
$input = htmlspecialchars($_GET['input'], ENT_QUOTES, 'UTF-8');
echo $input;

// 生成CSRF令牌
session_start();
$token = bin2hex(random_bytes(32));
$_SESSION['csrf_token'] = $token;

// 验证CSRF令牌
if ($_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    die("Invalid CSRF token");
}

// 检查文件类型和大小
if ($_FILES['file']['type'] !== 'image/jpeg' || $_FILES['file']['size'] > 1000000) {
    die("Invalid file");
}

// 保存文件
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["file"]["name"]);
if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
    echo "The file " . basename($_FILES["file"]["name"]) . " has been uploaded.";
} else {
    echo "Sorry, there was an error uploading your file.";
}