$30 off During Our Annual Pro Sale. View Details »

20年ものの巨大レガシープロダクトを PHP 8.0にアップデートした際の対策と得られた知見

Akama Hitoshi
September 24, 2022

20年ものの巨大レガシープロダクトを PHP 8.0にアップデートした際の対策と得られた知見

Akama Hitoshi

September 24, 2022
Tweet

More Decks by Akama Hitoshi

Other Decks in Programming

Transcript


  1. 1)1$POGFSFODF+BQBO
    ೥΋ͷͷڊେϨΨγʔϓϩμΫτΛ
    1)1ʹΞοϓσʔτͨ͠ࡍͷରࡦͱಘΒΕͨ஌ݟ
    αΠϘ΢ζגࣜձࣾ
    ੺ؒਔࢤ

    View Slide

  2. 1)1ͷ&0-͸΋͏͙͢ʂ
    w 1)1ͷηΩϡϦςΟमਖ਼ͷఏڙ͸·Ͱ
    IUUQTXXXQIQOFUTVQQPSUFEWFSTJPOTQIQ
    ŘŵŠŠʂ

    View Slide

  3. 1)1ͷ&0-͸΋͏͙͢ʂ
    w 1)1ͷηΩϡϦςΟमਖ਼ͷఏڙ͸·Ͱ
    IUUQTXXXQIQOFUTVQQPSUFEWFSTJPOTQIQ
    ŘŵŠŠʂ

    1)1ܥʹΞοϓσʔτ͠Α͏ʂ

    View Slide

  4. ࣗݾ঺հ
    w ੺ؒਔࢤ ͔͋·ͻͱ͠

    ग़਎஍ɿౡࠜݝদߐࢢ
    झຯ͸ϓϥϨʔϧͰܭࢉ͢Δ͜ͱ
    w αΠϘ΢ζגࣜձࣾʹ೥৽ଔೖࣾ
    (BSPPO։ൃνʔϜʹॴଐ
    w 1)1ྺ͸ʙ೥͘Β͍

    ϓϥϨʔϧCJUΧ΢ϯλ

    View Slide

  5. ຊηογϣϯͷ֓ཁ
    w ϨΨγʔϓϩμΫτͷ1)1ͷόʔδϣϯΛ͔Βʹߋ৽͠·ͨ͠
    ؙҰ೥͔͔Γ·ͨ͠
    େ͖ͳτϥϒϧͳ͘׬਱Ͱ͖·ͨ͠
    w Ͳ͏͍ͬͨ՝୊͕͋ΓɺͲͷΑ͏ͳରࡦΛͱ͔ͬͨΛڞ༗͠·͢

    ͱʹ͔͘ޓ׵ੑʹ·ͭΘΔ໰୊Λૣظൃݟ͢Δ͜ͱ͕ॏཁ

    View Slide

  6. ΞδΣϯμ
    w എܠ
    w ϦϦʔεαΠΫϧͱϒϥϯνઓུ
    w ൺֱԋࢉࢠͷରࡦ
    w ઈົʹڍಈ͕มΘΔඪ४ϥΠϒϥϦؔ਺
    w ·ͱΊ

    View Slide

  7. αΠϘ΢ζͷ(BSPPOʹ͍ͭͯ
    w தن໛ʙେن໛ͳ૊৫޲͚ͷάϧʔϓ΢ΣΞ
    ༧ఆڞ༗ɺίϛϡχέʔγϣϯͳͲɺ૊৫ͷνʔϜϫʔΫΛࢧԉ
    w DZCP[VDPN͕ఏڙ͢ΔΫϥ΢υ൛ͱɺΦϯϓϨ൛Λఏڙ
    w ࠓ೥Ͱఏڙ։͔࢝Βप೥ʢΫϥ΢υ൛͸೥͔Βʣ
    w όοΫΤϯυ͸1)1.Z42-
    ಠࣗϑϨʔϜϫʔΫ

    View Slide


  8. View Slide

  9. (BSPPOͷ։ൃঢ়گ
    w 1)1ͷ࣌୅͔Β೥ଓ͘఻౷ͷιʔείʔυ
    SFRVJSF@PODFɺԋࢉࢠΛଟ༻ɻݹ͍ίʔυͷՄಡੑ͕௿͍
    w ௒ڊେͳίʔυϕʔεʢ1)1͚ͩͰ໿ສߦʣ
    w ϢχοτςετͷΧόϨοδ͸໿

    ίʔυͷอक͚ͩͰ΋ෛ୲͕େ͖͍

    View Slide

  10. 1)1ຊମͷϏϧυ
    w (BSPPOͰ͸1)1ຊମΛࣗલͰϏϧυ͍ͯ͠Δ
    w (BSPPOಠࣗͷ1)1֦ு͕͋Δʢ$ݴޠͰॻ͔Ε͍ͯΔʣ
    w 1)1ຊମͷίʔυΛվ଄͍ͯ͠Δ
    ύονϑΝΠϧͱͯ͠վ଄ՕॴΛϦϙδτϦʹ഑ஔ

    1)1ͷϏϧυपΓ΋(BSPPOͷ։ൃʹؚ·ΕΔ

    View Slide

  11. 1)1Ξοϓσʔτͷಈػ
    ηΩϡϦςΟ
    άϧʔϓ΢ΣΞ͸ར༻ऀͷϏδωεʹ௚݁͢Δ
    ৗʹηΩϡϦςΟमਖ਼ΛऔΓࠐΊΔঢ়ଶʹ͢Δ
    ࠷৽ͷݴޠػೳΛར༻ͨ͠։ൃޮ཰ͷ޲্

    ҆શʹ࢖͍ଓ͚͍ͯͨͩͨ͘Ίʹɺ΍Βͳ͚Ε͹ͳΒͳ͍

    View Slide

  12. (BSPPOʹ͓͚Δ1)1Ξοϓσʔτ
    w ೥ʹҰ౓ɺ1)1ͷϦϦʔεαΠΫϧΑΓগʑ஗Ε࣮ͯࢪ
    ೥݄ɿˠ
    w ϦϦʔε࣌͸1)1ΞοϓσʔτҎ֎ͷมߋΛۃྗ͠ͳ͍
    w ຊ൪؀ڥ΁ͷద༻લʹɺαΠϘ΢ζࣾ಺ͰҰϲ݄΄Ͳӡ༻͢Δ

    1)1ͷΞοϓσʔτʹ͸༷ʑͳߟྀ͕ඞཁ

    View Slide

  13. Ϗδωεཁ݅ͱͷંΓ߹͍
    w Ϋϥ΢υ൛ͷϦϦʔε͸݄Ұͷఀࢭϝϯςφϯε࣌ͷΈՄೳ
    ͦΕҎ֎ͷఀࢭ͸ڐ͞Εͳ͍
    w ΦϯϓϨ൛͸೥ʹҰ౓ͷϦϦʔε
    ෆ۩߹मਖ਼ʹ͸௥ՃͰϦϦʔε͕ඞཁ
    w طଘͷػೳʹෆ۩߹Λग़͞ͳ͍͜ͱ͕࠷༏ઌ

    ϓϩμΫτͷ඼࣭ʹର͢Δཁٻ͕ߴ͍

    View Slide

  14. 1)1Ξοϓσʔτͷεέδϡʔϧ

    ೥ ೥

    ϦϦʔε
    ࣄલௐࠪɾ৘ใऩू ຊௐࠪ
    Ͱͷ࣮૷
    ςετ
    Ͱͷ࣮૷
    ෆ۩߹मਖ਼ɾςετ
    ࣾ಺ద༻
    ௐࠪ༻ϒϥϯνͰͷ࡞ۀ
    ໰୊ݕग़

    View Slide

  15. ΞδΣϯμ
    w എܠ
    wϦϦʔεαΠΫϧͱϒϥϯνઓུ
    w ൺֱԋࢉࢠͷରࡦ
    w ઈົʹڍಈ͕มΘΔඪ४ϥΠϒϥϦؔ਺
    w ·ͱΊ

    View Slide

  16. 1)1ΞοϓσʔτͷྲྀΕ

    ·ͣ͸ӨڹͷௐࠪΛ͢Δͱ͜Ζ͔Β
    Өڹௐࠪ ࣮૷ ςετ ϦϦʔε

    View Slide

  17. Өڹௐࠪ
    w ੡඼ͷػೳʹӨڹΛ༩͑ͳ͍ͨΊʹ
    w 1)1Ͱมߋ͞Εͨશͯͷ߲໨Λ
    w (BSPPOͷϦϙδτϦͷશͯͷ1)1ίʔυʹରͯ͠

    పఈతʹௐࠪ

    View Slide

  18. ௐࠪ಺༰
    w 1)1ϚχϡΞϧʹैͬͯߦ͏
    w 1)1͸໿݅ͷมߋ
    1)1͸݅ऑ
    w ௐࠪ݁ՌΛݩʹόοΫϩά࡞੒

    IUUQTXXXQIQOFUNBOVBMKBNJHSBUJPOQIQ

    View Slide

  19. ϦϦʔεεύϯ
    w Ϋϥ΢υ൛(BSPPOͷϦϦʔεεύϯ͸௕͍
    ϲ݄ʹճͷ৽ػೳ
    ϲ݄͝ͱʹෆ۩߹मਖ਼ͳͲ
    w ෳ਺ͷόʔδϣϯ͕ฒߦͰ։ൃ͕ਐΉ
    w 1)1ͷ։ൃதͰ΋ɺผͷϒϥϯνʹͲΜͲΜίϛοτ͞ΕΔ

    ৽ػೳ։ൃͱฒߦͯ͠1)1ΞοϓσʔτΛߦ͏ඞཁ͕͋Δ

    View Slide

  20. ฒߦͰ։ൃ͢Δࡍͷ໰୊఺
    w ฒߦ͢Δػೳ։ൃϒϥϯνͷ1)1͸·ͩ
    কདྷతʹ1)1ʹͨ͠ࡍʹ໰୊͕ൃੜ͢ΔՄೳੑ
    w ৽ن։ൃ෼ͷίʔυʹରͯ͠΋ɺ1)1ͷӨڹΛௐࠪɾରࡦ͢Δඞཁ͋Γ

    1)1ϒϥϯν
    ओྲྀϒϥϯν

    View Slide


  21. ৽͍͠ίϛοτʹରͯ͠
    ݅ͷӨڹௐࠪΛ౎౓ߦ͏ඞཁ͕͋Δ
    1)1։ൃϒϥϯν
    ཌ݄൛(BSPPO
    ཌʑ݄൛(BSPPO

    View Slide

  22. ௐࠪίετ΁ͷରࡦ
    w ֤߲໨ͷௐࠪํ๏ͱௐࠪ݁ՌΛ෼͚Δ

    มߋ఺
    ௐࠪํ๏
    ௐࠪ݁Ռ ϒϥϯν
    ϑΝΠϧ9ͰBCT
    Λ࢖༻
    ϒϥϯν
    ֘౰ͳ͠
    TUSJDU@UZQFTͷϑΝΠϧͰ͜ΕΒͷؔ਺Λ࢖༻͢Δ͔ௐࠪ
    BCT
    ͳͲͷ਺ֶؔ਺͕TUSJDU@UZQFTʹਖ਼͘͠ै͏Α͏ʹͳͬͨ

    View Slide


  23. View Slide

  24. ෼͚ͨ͜ͱͷޮՌ
    w ͦΕͧΕͷมߋ఺ʹ͍ͭͯ஌ݟ͕ਂ·ΓɺνʔϜ಺Ͱௐࠪํ๏Λ౷ҰͰ͖ͨ
    w ߲໨ʹΑͬͯ͸ࣗಈతʹௐࠪͰ͖ͨ
    w ࣗಈௐࠪ༻ͷεΫϦϓτΛ࡞੒
    ਓྗͰௐࠪ͢Δ߲໨͸݅΄Ͳʹ

    Ϛʔδ࣌ͷӨڹௐࠪͷίετΛ࡟ݮͰ͖ͨ

    View Slide

  25. ϚχϡΞϧΛಡΜ͚ͩͩͰશͯ͏·͍͔͘͘ʁ
    w ࣮ࡍʹͲΕ͘Β͍໰୊͕ग़Δ͔͸ະ஌਺
    w ϚχϡΞϧʹॻ͍ͯͳ͍͜ͱ͕Өڹ͢Δ͔΋͠Εͳ͍

    Ͳ͜·Ͱमਖ਼ΛՃ͑Ε͹$*͕௨ΔΑ͏ʹͳΔʁ

    View Slide

  26. (BSPPOͷ$* $JSDMF$*

    w 1)1Ξοϓσʔτʹେ͖ؔ͘ΘΔͷ͸ҎԼͷεςοϓ

    1)1ຊମͷϏϧυ͸ঢ়گ͕ෳࡶ
    1)1ͷϏϧυ
    Ϣχοτςετ
    1)16OJU
    &&ςετ
    4FMFOJVN

    View Slide

  27. 1)1ͷόʔδϣϯ্͚ͩ͛ͨϒϥϯν
    w ςετɾϨϏϡʔෆཁͷঢ়ଶͰΨϯΨϯ໰୊Λղফ͍ͯͬͯ͠ΈΔ
    w ݟ͔ͭͬͨ໰୊ɿ
    1)1ຊମ͕มߋ͞ΕͨͨΊύονϑΝΠϧ͕ద༻Ͱ͖ͳ͍
    1)1֦ுͰఆٛ͞ΕͨΫϥεͷίϯετϥΫλ໊͕ݹ͍ܗࣜͩͬͨ

    ϚχϡΞϧΛಡΉ͚ͩͰ͸෼͔Βͳ͍໰୊ΛૣظൃݟͰ͖ͨ

    View Slide

  28. ϒϥϯνઓུɿ·ͱΊ
    w 1)1ͷΞοϓσʔτ͸ฒߦ͢ΔϒϥϯνͰߦΘΕΔ
    1)1ͷόʔδϣϯΛৗʹҙࣝͯ͠։ൃΛਐΊΔ
    w ௐࠪํ๏ͱௐࠪ݁ՌΛ෼཭͢Δ͜ͱͰௐࠪͷݟ௨͕͠Α͘ͳΔ
    ࠶ݱੑͷ͋Δௐࠪํ๏ΛνʔϜͰڞ༗Ͱ͖Δ
    w 1)1ͷόʔδϣϯ্͚ͩ͛ΔϒϥϯνͰࢼͯ͠ΈΔ
    ੡඼ݻ༗ͷ໰୊Λૣ͍ஈ֊Ͱચ͍ग़͢͜ͱ͕Ͱ͖Δ

    View Slide

  29. ΞδΣϯμ
    w എܠ
    w ϦϦʔεαΠΫϧͱϒϥϯνઓུ
    wൺֱԋࢉࢠͷରࡦ
    w ઈົʹڍಈ͕มΘΔඪ४ϥΠϒϥϦؔ਺
    w ·ͱΊ

    View Slide

  30. 1)1Ͱ͸ൺֱԋࢉ͕มΘΔ
    1)13'$4BOFSTUSJOHUPOVNCFSDPNQBSJTPOT
    1)13'$4BOFSOVNFSJDTUSJOHT
    w ͲͪΒ΋ڍಈΛ௚ײతͰ੔߹ੑΛͱΔΑ͏ʹ͢ΔఏҊ
    ੈͷதʹ͸ͦ͏͍ͬͨڍಈʹʢ҉໧తʹʣґଘ͍ͯ͠ΔγεςϜ΋͋Δ

    ϓϩάϥϛϯάݴޠͷࠜװʹؔΘΔಈ࡞͕มΘΔ

    View Slide

  31. ൺֱԋࢉࢠͷڍಈมԽ

    w จࣈྻWT਺஋ͷൺֱํ๏͕มԽ

    1)1 1)1 1)1 ਺஋ܗࣜ

    'hoge' == 0 'hoge' == 0 '25.0' == 25
    (int)'hoge' == 0 'hoge' == (string)0 (double)'25.0' == 25
    0 == 0 'hoge' == '0' 25.0 == 25
    true false true (ͱมΘΒͣ)

    View Slide

  32. ൺֱԋࢉࢠͷڍಈมԽ

    w จࣈྻಉ࢜ͷൺֱ΋มΘΔ

    1)1 1)1
    '42' == '42 ' '42' == '42 '
    '42 ' ͕਺஋ܗࣜͰ͸ͳ͍ '42 ' ͕਺஋ܗࣜͱͳΔ
    จࣈྻͱͯ͠ൺֱ ਺஋ʹม׵ͯ͠ൺֱ
    false true

    View Slide

  33. มԽ͢Δԋࢉࢠɾؔ਺
    w ݫີͰͳ͍ൺֱԋࢉࢠ͢΂ͯ
    ==, != ͷଞʹ΋ >, >=, <, <=, <=> ΋Өڹ
    w ഑ྻૢ࡞ܥͷඪ४ؔ਺ɿin_array(), array_search(), array_keys()
    w ιʔτܥͷؔ਺ɿsort(), rsort(), ...

    ԋࢉࢠҎ֎ʹ΋มԽ͕͋Δʂ

    View Slide

  34. (BSPPOʹର͢ΔӨڹ
    w ߦҎ্
    ԋࢉࢠ͕࢖ΘΕ͍ͯΔՕॴ
    w ϩδοΫʹؒҧ͍ͳ͘Өڹ͢Δ

    σʔλϕʔεʹෆ੔߹͕ى͜Δ͜ͱ͸ઈରʹආ͚͍ͨ

    View Slide

  35. Կ͔ରࡦ͸ͳ͍͔ʁ
    w ίʔυ্ͰӨڹΛௐ΂Δͷ͸ݱ࣮తͰ͸ͳ͍
    ຊ൪σʔλϕʔεͷ஋͸ଟछଟ༷
    w ࣮ࡍʹςετ͢Δ͔͠ͳ͍
    ࡉ͔͍ϩδοΫ͕มΘͬͨ͜ͱΛݕग़Ͱ͖Δ͔ʁ

    if ($id == 0) {


    ...
    ࣮ߦ࣌ʹ݁Ռ͕Θ͔Δ͜ͱΛݕ஌Ͱ͖ͳ͍͔ʁ
    if ($id == 0) {


    ...
    if ($id == 0) {


    ...
    if ($id == 0) {


    ...

    View Slide

  36. ରࡦ
    w 1)1ຊମΛվ଄͢ΔύονΛ࡞੒
    w 1)1ͱͰ݁Ռ͕มΘΔΑ͏ͳൺֱԋࢉΛݕग़
    w &@8"3/*/(Ϩϕϧͷ1)1ΤϥʔΛ౤͛ΔΑ͏ʹ͢Δ

    1)1ຊମͷൺֱԋࢉΛߦ͏ॲཧʹػೳ௥Ճ

    View Slide

  37. σϞ

    View Slide

  38. ύονͷ࣮૷
    w 1)1಺෦Ͱ͸ݫີͰͳ͍ൺֱԋࢉΛߦ͏ॲཧΛվ଄
    w 1)1ʹ1)1ͷൺֱॲཧΛҠ২͠ɺ྆ํͷ݁ՌΛൺ΂Δ

    Ҡ২͞Εͨ
    1)1ͷൺֱॲཧ
    ΦϦδφϧͷ
    1)1ͷൺֱॲཧ
    ݁Ռ͕ҟͳΕ͹ܯࠂ

    View Slide

  39. ύονΛ࡞ͬͨޮՌ
    w ൺֱԋࢉࢠҎ֎ͷؔ਺Ͱ΋มԽΛݕग़Ͱ͖Δ
    in_array, sort, ...


    w ຊ൪؀ڥͰ΋͠ൃੜͯ͠΋ϦΫΤετΛதஅͰ͖Δ

    ൺֱԋࢉͷมԽʹΑΔϩδοΫͷมԽΛະવʹ๷͛ͨ

    View Slide

  40. ςετͰͷ׆༻
    w ύονΛ༗ޮʹͨ͠ঢ়ଶͰࣗಈςετΛ࣮ߦ
    w 2"νʔϜʹΑΔςετʹߩݙ
    ϩδοΫͷมԽΛ1)1ΤϥʔͰՄࢹԽ

    ൺֱԋࢉͷ໰୊ΛΑΓޮ཰Α͘ݕग़

    View Slide

  41. 1)1؀ڥͰͷௐࠪ
    w ҟৗܥΛ͢΂ͯςετ͢Δͷ͸ࠔ೉
    w Քಇதͷ1)1؀ڥΛ࢖ͬͯ໰୊ݕग़Ͱ͖ͳ͍͔ʁ
    w 1)1؀ڥ޲͚ʹύονΛ࡞੒

    ࣄલʹຊ൪؀ڥͰ΋໰୊ͷચ͍ग़͠Λߦͬͨ

    View Slide

  42. 1)1؀ڥͰͷௐࠪͷྲྀΕ

    ύονΛ౰ͯͨ1)1
    Τϥʔϋϯυϥ
    ϩάϑΝΠϧ(SBZMPH
    ൺֱԋࢉࢠͷ&@8"3/*/(
    ൃੜͨ͠ϑΝΠϧɾߦΛه࿥
    ؂ࢹɾमਖ਼
    'hoge' == 0


    ԋࢉ݁ՌͷมԽΛݕग़

    View Slide

  43. ௐࠪͷ݁Ռ
    w ϲ݄Ͱ໿݅ͷ໰୊Λݕग़
    w ൺֱԋࢉࢠʹΑΔݒ೦͕΄ͱΜͲͳ͍ঢ়ଶͰ1)1΁ҠߦͰ͖ͨ
    w ݱࡏͷ(BSPPOͰ΋ɺൺֱԋࢉࢠ·ΘΓͷτϥϒϧ͸ൃੜ͍ͯ͠ͳ͍

    (BSPPOͰ͸ൺֱԋࢉࢠͷ໰୊Λ͢΂ͯղফͰ͖ͨ

    View Slide

  44. ൺֱԋࢉࢠɿ·ͱΊ
    w ൺֱԋࢉͷมԽ͸ൺֱԋࢉࢠҎ֎ʹ΋ӨڹΛ༩͑Δ
    w (BSPPOͰ͸1)1ຊମΛվ଄͠ɺൺֱԋࢉͷڍಈมԽΛݕग़
    ڍಈͷมԽΛΤϥʔͱͯ͠Θ͔ΔܗͰදࣔ
    खಈɾࣗಈςετͰམͱ͢͜ͱ͕Ͱ͖ͨ
    w ຊ൪؀ڥΛར༻ͨ͠໰୊ͷݕग़͕ޭΛ૗ͨ͠
    w Ҏ্ͷରࡦͰɺൺֱԋࢉʹ·ͭΘΔ໰୊Λղܾͨ͠

    View Slide

  45. ΞδΣϯμ
    w എܠ
    w ϦϦʔεαΠΫϧͱϒϥϯνઓུ
    w ൺֱԋࢉࢠͷରࡦ
    wઈົʹڍಈ͕มΘΔඪ४ϥΠϒϥϦؔ਺
    w ·ͱΊ

    View Slide

  46. ઈົʹڍಈ͕มΘΔඪ४ؔ਺
    w 1)1ϚχϡΞϧͷʮԼҐޓ׵ੑͷͳ͍มߋ఺ʯʹ·ͱΊΒΕ͍ͯΔ
    w େମͷ৔߹͸%FQSFDBUFEͷܯࠂ͕1)1Ͱ͸ൃੜ͢Δ
    w ͦ͏Ͱ͸ͳ͍ؔ਺Λத৺ʹ঺հ
    NLUJNF
    HNNLUJNF

    BSSBZ@TQMJDF

    TVCTUS

    TUSQPT
    NC@TUSQPT


    View Slide

  47. Ҿ਺ʹOVMM͕ࢦఆͰ͖ΔΑ͏ʹͳΔؔ਺
    w 1)1͔ΒɺҰ෦ͷҾ਺ʹOVMM͕ࢦఆͰ͖Δ
    • substr(), array_splice()


    • mktime(), gmmktime()

    OVMMΛࢦఆͨ͠৔߹ͷڍಈ͕มΘΔ

    View Slide

  48. TVCTUS
    BSSBZ@TQMJDF

    w ͲͪΒ΋MFOHUIҾ਺ʹOVMMΛࢦఆՄೳʹͳͬͨ
    w 1)1Ҏલ͸OVMM͕ͱղऍ͞ΕΔ
    w 1)1Ҏ߱͸ɺҾ਺Λ༩͑ͳ͍ͷͱಉ͡Α͏ʹղऍ͞ΕΔ
    IUUQTWMPSH

    View Slide

  49. NLUJNF
    HNNLUJNF

    w ೔෇͔Β6OJYλΠϜελϯϓΛٻΊΔ
    mktime($hour, $minute, $second, $month, $day, $year)


    w 1)1Ҏલ͸OVMM͸ʹΩϟετ͞Ε͍ͯͨ
    w 1)1Ҏ߱͸OVMM͕ݱࡏ࣌ࠁΛද͢Α͏ʹͳͬͨ

    ݱࡏͷ೔࣌ʹΑͬͯ݁Ռ͕มΘΔόάͷՄೳੑ

    View Slide

  50. จࣈྻݕࡧܥؔ਺ͷOFFEMFҾ਺
    w TUSQPT
    NC@TUSQPT
    ͳͲͷݕࡧର৅ OFFEMF
    ʹۭจࣈྻΛࢦఆՄೳʹ
    1)1·Ͱɿܯࠂ͕ൃੜ͠ɺGBMTF͕ฦͬͯ͘Δ
    1)1͔Βɿจࣈྻͷઌ಄ʹҰக͕ͯ͠ฦͬͯ͘Δ

    TUSQPT
    GBMTFͷ݁Ռ͕มΘΔ

    View Slide

  51. TVCTUS
    ͷڥքΛӽ͑ͨ৔߹ͷॲཧ
    1)1·ͰɿMFOHUIͷਖ਼ෛͳͲʹΑΓGBMTF͔ۭจࣈྻ
    1)1͔ΒɿඞۭͣจࣈྻʹͳΔ

    w TUSJOH
    P
    ff
    TFU
    " # $
    MFOHUI

    View Slide

  52. (BSPPOͰͷରॲํ਑
    w ݸผରॲ͕Մೳͳ਺ͳΒͦͷ··ରॲΛਐΊΔ
    w ෆՄೳͳΒݹ͍ڍಈΛΤϛϡϨʔτ͢Δؔ਺Ͱஔ͖׵͑
    ྫNC@TUSQPT

    function cb_mb_strpos($haystack, $needle, $offset = 0, $encoding = null)
    {
    if ($needle === "" || $needle === null) {
    return false;
    }
    return mb_strpos($haystack, $needle, $offset, $encoding);
    }

    View Slide

  53. ઈົʹڍಈ͕มΘΔඪ४ؔ਺ɿ·ͱΊ
    OVMMΛड͚ೖΕΔΑ͏ʹͳΔؔ਺
    OVMMΛ౉ͨ͠Βڍಈ͕มΘΔؔ਺
    w TVCTUS
    BSSBZ@TQMJDF
    NLUJNF
    HNNLUJNF
    ʹ஫ҙ

    View Slide

  54. ·ͱΊ

    View Slide

  55. 1)1Ξοϓσʔτ૯·ͱΊ
    w ϓϩμΫτͷϒϥϯνͷಈ͖Λҙࣝͨ͠1)1Ξοϓσʔτ
    ໿Ұ೥ؒͷ׆ಈظؒΛܦͯແࣄʹΞοϓσʔτ׬ྃ
    1)1ϚχϡΞϧʗ࣮ࡍͷϓϩμΫτΛ΋ͱʹͨ͠ૣظͷௐࠪͰ஌ݟΛಘΔ
    w ൺֱԋࢉࢠͷมԽΛݕ஌͢Δ࢓૊Έ͕ޭΛ૗ͨ͠
    ຊ൪؀ڥΛ༻͍ͨௐࠪͰෆ҆Λ෷১Ͱ͖ͨ
    w ͱʹ͔͘ɺޓ׵ੑʹ·ͭΘΔ໰୊Λૣظൃݟ͢Δ͜ͱ͕ॏཁͩͬͨ
    ͝ਗ਼ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠

    View Slide

  56. એ఻ɿ࠲ஊձ΍Γ·͢

    IUUQTDZCP[VDPOOQBTTDPNFWFOU

    View Slide

  57. ະ࢖༻εϥΠυ

    View Slide

  58. 1)1ͷ಺෦"1*ʹ·ͭΘΔมߋ
    w $JSDMF$*ͷδϣϒͰ1)1Λιʔε͔ΒϏϧυ
    ಠࣗͷ1)1֦ுʢ$ݴޠͰॻ͔Ε֦ͨுϞδϡʔϧʣ͕͋Δ
    1)1ຊମͷιʔείʔυΛมߋ͢ΔύονϑΝΠϧΛ͍͔ͭ͘ద༻
    w Ϗϧυ͞Ε࣮ͨߦϑΝΠϧҰࣜ͸4ʹΞοϓϩʔυ͞ΕΔ
    w -JOVY8JOEPXT޲͚ͷϏϧυ؀ڥ͕͋Δ

    View Slide

  59. 1)1ͷ಺෦"1*ʹ·ͭΘΔมߋ
    w 1)1֦ுͷ࡞ऀͷͨΊͷҠߦϚχϡΞϧ͕QIQTSDʹ͋Δ
    IUUQTHJUIVCDPNQIQQIQTSDCMPCNBTUFS
    61(3"%*/(*/5&3/"-4
    w (BSPPO͸ຖ೥ͳʹ͔͠Βͷ໰୊Λ౿ΜͰ֦ுͷίʔυΛमਖ਼͍ͯ͠Δ
    w ͪ͜Β΋ಉ͡Α͏ʹɺௐࠪͯ͠վमΛߦ͏
    w ͨͩ͠ɺมߋස౓͕গͳ͍ͨΊجຊతʹௐࠪ͸ճ͖ΓͰे෼

    View Slide

  60. 1)1ͷ಺෦"1*ʹ·ͭΘΔมߋ
    w ؔ਺ɾϝιουʹBSHJOGPΛ༩͑ͳ͍ͱ8BSOJOHʹͳΔ
    Ҿ਺ͷ৘ใʢ໊લɺܕʣͷ৘ใΛ1)1֦ுͰఆٛͨؔ͠਺ʹ༩͑Δ
    w 543.ϚΫϩͷഇࢭ
    εϨουηʔϑܥͷରԠɻ1)1ܥͰ࣮࣭ແޮԽ͞ΕͨͨΊ࡟আ͢Δ͚ͩ
    w Ϋϥεͱಉ໊ͷϝιου͕ίϯετϥΫλ໊ͱͯ͠ೝࣝ͞Εͳ͘ͳͬͨ
    1)1εΫϦϓτͰ͸ܯࠂ͕ग़͍͕ͯͨɺ1)1֦ுͰ͸ܯࠂ͞Εͳ͔ͬͨ

    View Slide

  61. 1)1Τϥʔ
    w Τϥʔͷൃੜ࣍ୈɺΤϥʔϋϯυϥʹΑΓॲཧ͞ΕΔ
    w ྫ֎ͷΑ͏ʹݺग़ݩ΁ͱ఻೻͠ͳ͍ɻׂΓࠐΈϋϯυϥʹ͍ۙ
    w &@%&13&$"5&% &@/05*$& &@8"3/*/(ͳͲɺ͍͔ͭ͘ͷϨϕϧ͕͋Δ
    w FSSPS@SFQPSUJOHؔ਺ͰɺಛఆͷϨϕϧͷΤϥʔΛແࢹͤ͞Δ͜ͱ͕Ͱ͖Δ
    w 1)1ϓϩάϥϜશମͰ༗ޮͳΧελϜͷϋϯυϥΛهड़Մೳ
    w ΧελϜϋϯυϥͰ1)1ΤϥʔΛ཈੍͠ɺॲཧΛଓߦՄೳ

    View Slide

  62. 1)1Τϥʔ
    w ͍͔ͭ͘ͷ&@/05*$&͕&@8"3/*/(ʹঢ֨
    • Attempting to read an unde
    fi
    ned variable.
    • Attempting to read an unde
    fi
    ned property.
    • Attempting to read an unde
    fi
    ned array key.
    • Attempting to read a property of a non-object.
    • Attempting to access an array index of a non-array.
    • Attempting to convert an array to string.
    • Attempting to use a resource as an array key.
    • Attempting to use null, a boolean, or a
    fl
    oat as a string offset.
    • Attempting to read an out-of-bounds string offset.
    • Attempting to assign an empty string to a string offset.
    • جຊతʹ͸ @ ԋࢉࢠ͸ґવͱͯ͠༗ޮɻΤϥʔϋϯυϥͰͷରॲ΋໰୊ͳ͘Ͱ͖Δ

    View Slide

  63. 1)1Τϥʔ
    w ͋Δ044ͷதͰFSSPS@SFQPSUJOH
    Ͱ&@/05*$&Λແޮʹ͍ͯͨ͠ʂ
    w ͦͷ044͔ΒίʔϧόοΫ͞ΕΔܗͰҰ෦ͷίʔυ͕ಈ࡞ͯͨ͠
    w ࠓ·Ͱ཈੍͞Ε͍ͯͨ&@/05*$&͕&@8"3/*/(ʹͳΓɺ๫ΕճΔ
    w Өڹ͕͋·Γʹ΋޿͔ͬͨ
    w ରॲɿFSSPS@SFQPSUJOH
    Ͱ&@/05*$&͕੾ΒΕͯͨͱ͖ͷΈɺಛఆͷ
    &@8"3/*/(ΛΤϥʔϋϯυϥͰ཈੍ͤ͞Δ

    View Slide

  64. 1)1Τϥʔ
    w ͍··ͰجຊతʹΤϥʔϋϯυϥͰ཈੍͍ͯ͠ͳ͚Ε͹໰୊ͳ͍
    • Attempting to write to a property of a non-object.
    • Attempting to append an element to an array for which the PHP_INT_MAX key is already used.
    • Attempting to use an invalid type (array or object) as an array key or string offset.
    • Attempting to write to an array index of a scalar value.
    • Attempting to unpack a non-array/Traversable.
    • Attempting to access unquali
    fi
    ed constants which are unde
    fi
    ned.
    w ͨͩɺ!ԋࢉࢠͰ཈੍͞Εͯͨ৔߹͸؏௨͢Δ
    w ରॲ1)1؀ڥͰ͜ΕΒͷ&@8"3/*/(Λัଊ͠ɺϞχλ͢Δ
    /6--ʹର͢ΔϓϩύςΟͷॻ͖ࠐΈ͕݅ݟ͔ͭͬͨ

    View Slide