Upgrade to Pro — share decks privately, control downloads, hide ads and more …

PHP Güvenlik Notları

D55de538259751cc08d16a0843e1c69f?s=47 Hidayet Doğan
November 07, 2012
Programming
0
890

PHP Güvenlik Notları

XVII. Türkiye'de İnternet Konferansı - Anadolu Üniversitesi, Eskişehir

D55de538259751cc08d16a0843e1c69f?s=128

Hidayet Doğan

November 07, 2012
Tweet

More Decks by Hidayet Doğan

See All by Hidayet Doğan
Swoole ile Asenkron PHP
D55de538259751cc08d16a0843e1c69f?s=48 hdogan
0
340
Asenkron PHP
D55de538259751cc08d16a0843e1c69f?s=48 hdogan
0
1.1k
PHP Senfoni Orkestrası: Composer
D55de538259751cc08d16a0843e1c69f?s=48 hdogan
1
350
PHP ile Soket Programlama ve Ağ Servisleri
D55de538259751cc08d16a0843e1c69f?s=48 hdogan
5
3.8k
CakePHP ile Pasta Pişirmek
D55de538259751cc08d16a0843e1c69f?s=48 hdogan
1
810
PHP 101
D55de538259751cc08d16a0843e1c69f?s=48 hdogan
1
650
Web Uygulamalarında Güvenlik
D55de538259751cc08d16a0843e1c69f?s=48 hdogan
1
410
Phalcon - Eklenti olarak sunulan PHP çatısı - PHP Günleri 2013#1
D55de538259751cc08d16a0843e1c69f?s=48 hdogan
5
1.6k
İnsanlar için PHP
D55de538259751cc08d16a0843e1c69f?s=48 hdogan
0
500

Other Decks in Programming

See All in Programming
C言語でメモリ管理を考えた話
F17bbe02fb6dda24d29196c2479121b1?s=48 hkawai
0
180
Android入門
180bbdf8267422d5814fd498ecea043a?s=48 hn410
0
300
CIでAndroidUIテストの様子を録画してみた
46b3bc302e3a40f8df60cfb60d59c313?s=48 mkeeda
0
130
확장 가능한 테라폼 코드 관리 (Scalable Terraform Code Management)
330c5e37fb238d6b319ae6e18770f44b?s=48 posquit0
1
310
Modern Web Apps with Spring Boot, Angular & TypeScript
A0aae1297a0593c1316abdcdb4131e3a?s=48 toedter
12
14k
Loom is Blooming
F784a8de872a5d98f67ac5ccbd6683d0?s=48 josepaumard
3
510
Git Rebase
E0e036f89c14b3e59640318eedf9670b?s=48 bkuhlmann
7
1k
書籍『良いコード/悪いコードで学ぶ設計入門』でエンジニアリングの当たり前を変える
8ec2b967e38f000eb63ae345cd7c58e6?s=48 minodriven
3
1k
Monadic Java
9eafc29df96e6aaf4a3eb4c0209086ae?s=48 mariofusco
4
250
読みやすいコードを書こう
A7048be18b1c2e712e5b564b1adb1f7e?s=48 yutorin
0
370
もしも、 上司に鬼退治を命じられたら~プロジェクト計画編~
Fb0a40e5e7a9dc85520f1646fd41eb44?s=48 higuuu
0
260
Keep Your Cache Always Fresh With Debezium
8e25c0ca4bf25113bd9c0ccc5d118164?s=48 gunnarmorling
0
180

Featured

See All Featured
JazzCon 2018 Closing Keynote - Leadership for the Reluctant Leader
3ab1249be442027903e1180025340b3f?s=48 reverentgeek
172
8.3k
ParisWeb 2013: Learning to Love: Crash Course in Emotional UX Design
651dcfe41723207fbb0aa044a4f7c07f?s=48 dotmariusz
100
5.9k
No one is an island. Learnings from fostering a developers community.
6bb82b13cda86d3b821fa44100335ddf?s=48 thoeni
9
1.1k
The Language of Interfaces
Fde6c3a50ca518a909ef35c22c0ee0e4?s=48 destraynor
148
20k
Typedesign – Prime Four
A0517b08532aec8ab2aae3f65d40ad86?s=48 hannesfritz
33
1.3k
How to train your dragon (web standard)
053e75a5b48b44d6dd0612795dfb326d?s=48 notwaldorf
57
3.8k
Documentation Writing (for coders)
61857dafbd287b3027c4dcea9008ad3c?s=48 carmenhchung
48
2.5k
Designing on Purpose - Digital PM Summit 2013
7653c7c449918ff6542880a8c284f5e7?s=48 jponch
106
5.6k
Support Driven Design
1519587b1a0febb658c36c94f6272b0d?s=48 roundedbygravity
86
8.4k
Side Projects
027d1ebf66cc039a0bd3b55eeadbe75d?s=48 sachag
449
37k
Music & Morning Musume
A60068bce2e73de3a37ca9d2dbe36092?s=48 bryan
35
4.1k
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
E195ae45320d9202eaa01c9f1d31a416?s=48 marktimemedia
15
910

Transcript

  1. PHP Güvenlik Notları Friday, November 9, 12

  2. PHP Güvenlik Notları Kod Okunurluğu PHP Ayarları SQL Injection Cross-site

    Scripting (XSS) Cross-site Request Forgery (CSRF) Friday, November 9, 12

  3. Kod Okunurluğu Friday, November 9, 12

  4. PHP Ayarları Her zaman: register_globals = Off allow_url_include, allow_url_fopen error_reporting,

    display_errors, log_errors Friday, November 9, 12

  5. SQL Injection SELECT * FROM tablo WHERE id = $id

    register_globals = Off mysql_real_escape_string, pg_escape_string, PDO filter_input, filter_var Typecasting (integer) (boolean) (double) (float) addslashes = Yeterli değil! Friday, November 9, 12

  6. Cross-site Scripting (XSS) include($dosya); echo $kullanicidan_gelen_veri; register_globals = Off allow_url_include

    = Off basename, realpath, preg_match htmlspecialchars, htmlentities, strip_tags Friday, November 9, 12

  7. Cross-site Request Forgery (CSRF) <img src=”http://adres.com/gonder.php?yorum=Örnek”> Oturum bazlı doğrulayıcı anahtarlar

    (token) $_SERVER[‘HTTP_REFERER’] kontrol Ajax: $_SERVER[‘HTTP_X_REQUESTED_WITH’] kontrol Friday, November 9, 12

  8. Sorular? Friday, November 9, 12

  9. PHP ve Web Güvenliği ezber kartları! Friday, November 9, 12

  10. Teşekkürler! http://php.net/manual/tr/security.php http://shiflett.org/php-security.pdf http://hi.do http://github.com/hdogan Twitter @hdogan Friday, November 9,

    12