Eric @ EricBess WebHome

Originally written PAYPAL IPN response when used repeatedly to try to prevent a function of the protection of the poor, later changed to address the original audit ($ hostname = gethostbyaddr ($ _SERVER [ 'REMOTE_ADDR']); if (! Preg_match ( '/ paypal \. com $ / ', $ hostname)) {.....), it abandoned on the 000. In the record before the cut did not come, there should be a better algorithm, the study who do not know.

 1 
 2 
 3 
 4 
 5 
 6 
 7 
 8 
 9 
 10 
 11 
 12 
 13 
 14 
 15 
 16 
 17 
 18 
 19 

  ! avoid_refresh ( '15' ) ) die ( "Hacking Attempt!!" ) ; if (! avoid_refresh ('15 ')) die ( "Hacking Attempt!!"); 
  ..... 
  ..... 
  ..... 
  $time ) { function avoid_refresh ($ time) ( 
	  ; session_start (); 
    isset ( $_SESSION [ "post_sep" ] ) ) { if (isset ($ _SESSION [ "post_sep"])) ( 
        time ( ) - $_SESSION [ "post_sep" ] < $time ) { if (time () - $ _SESSION [ "post_sep"] <$ time) ( 
      	  "post_sep" ] = time ( ) ; $ _SESSION [ "Post_sep"] = time (); 
          ; return false; 
        { ) Else ( 
            "post_sep" ] = time ( ) ; $ _SESSION [ "Post_sep"] = time (); 
            ; return true; 
        ) 
    { ) Else ( 
        "post_sep" ] = time ( ) ; $ _SESSION [ "Post_sep"] = time (); 
        ; return true; 
    ) 
  ) 

Data encryption in our life has become increasingly important, especially in light of the network took place on a large number of transactions and transfer of large amounts of data. If you are interested in the adoption of safety measures, are also bound to be interested in learning PHP to provide a range of security features. In this article, we will introduce these features to provide some basic usage, so that you can own application software to add security features.

Prior knowledge

PHP in the details of the security function, we need to spend a bit of time has not come into contact with the contents of this area's readers some basic knowledge of cryptography, if the basic concepts of cryptography is already very familiar with, you can skip this part of the past .

Cryptography can be described as popular on the encryption / decryption of research and experiments, the encryption is easy to understand information is not easily converted to process information, not easily moving to decrypt the data is converted to the original easy-to-understand information. Do not understand the information referred to as passwords, easy-to-understand information, known as code.

The data encryption / decryption requires a certain algorithms can be very simple, such as the famous Caesar code, but the current encryption algorithm to be relatively much more complex, some of which make use of existing methods can not even decipher the.

PHP encryption function as long as there is one thing to use non-Windows platforms may experience crypt () is also quite familiar with the completion of this function is called a one-way encryption function, it can be a number of encryption codes, passwords can not be converted to the original The codes. Despite the face of it this seems to be a useless function, but it is widely used to guarantee the integrity of the system password. This is because once the one-way encrypted passwords fall into the hands of a third party who, as can not be reduced to express and therefore not much use. In the validation of user input a password, the user input is also used in a one-way algorithm, if the importation and storage of encrypted password after the match, then entered a message must be correct.

crypt () function

PHP also offers the use of its crypt () function to complete a one-way encryption. I will be here a brief introduction to the function:

string crypt (string input_string [, string salt])

Input_string the parameters need to be encrypted string, the second optional salt is a bit string, it can affect the encryption code, known as rule out further attacks are expected to count. By default, PHP using a 2-character string interfere with DES, if you are using the system MD5 (I will be introduced later in the MD5 algorithm), it will use a 12-character string of interference. By the way, can be found in order to implement the following system will be used to interfere with the length of the string:

print "My system salt size is:". CRYPT_SALT_LENGTH;

System may also support other encryption algorithm. crypt () to support four algorithm, which is supported by the following algorithm and the corresponding parameters of the length of salt:

Salt length of the algorithm
CRYPT_STD_DES 2-character (Default)
CRYPT_EXT_DES 9-character
CRYPT_MD5 12-character beginning with $
CRYPT_BLOWFISH 16-character beginning with $