blocks|key|4279749|text|您可以/应该使用IP限制或登录来保护这些脚本。这两者都可以通过.htaccess文件来完成。对于简单的实用程序脚本来说，这可能就足够了。但是，您不应该在复杂和安全的应用程序中使用这样的东西。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4279750|示例.htaccess文件：|4279751|#+BAN+USER+BY+IP
<Limit+GET+POST>
+order+allow,deny
+allow+from+all
+deny+from+1.2.3.4
</Limit>

#+login
AuthName+"Test"
AuthType+Basic
AuthUserFile+test/.htpasswd
require+valid-user|code-block|syntax|javascript|4279752|示例.htpasswd文件|4279753|test:Qh8a4zM4Z/i1c|4279754|甚至还有这些文件的生成器。谷歌发现的一些例子：http://www.toshop.com/htaccess-generator.cfm|offset|length|4279755|entityMap|0|LINK|mutability|MUTABLE|url|http://www.toshop.com/htaccess-generator.cfm^0|0|0|0|0|0|N|18|0|0^^$0|@$1|2|3|4|5|6|7|Y|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Z|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|10|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|11|8|@]|9|@]|A|$]]|$1|K|3|L|5|F|7|12|8|@]|9|@]|A|$G|H]]|$1|M|3|N|5|6|7|13|8|@]|9|@$O|14|P|15|1|16]]|A|$]]|$1|Q|3|-4|5|6|7|17|8|@]|9|@]|A|$]]]|R|$S|$5|T|U|V|A|$W|X]]]]

You could/should protecte those scripts with IP restrictions or logins. Both can be done with .htaccess files. This is probably enough for simple utility scripts. You should not use something like this for a complex and secure application though.

Sample .htaccess file:

<pre><code># BAN USER BY IP
&lt;Limit GET POST&gt;
 order allow,deny
 allow from all
 deny from 1.2.3.4
&lt;/Limit&gt;

# login
AuthName "Test"
AuthType Basic
AuthUserFile test/.htpasswd
require valid-user
</code></pre>

Sample .htpasswd file

<pre><code>test:Qh8a4zM4Z/i1c
</code></pre>

There are even generators for these files.
Some sample that Google found: <a href="http://www.toshop.com/htaccess-generator.cfm" rel="nofollow">http://www.toshop.com/htaccess-generator.cfm</a>

blocks|key|1269757|text|不要直接调用PHP脚本，也不要使脚本可以直接调用。这是最终目标。很可能你现在还不能实现。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1269758|如果采用面向对象的方法，那么所有的PHP文件都只包含类。这意味着当您运行一个文件时，什么都不会发生。|1269759|只有1文件才是实际的脚本，这是您的入口点。|offset|length|style|BOLD|1269760|1269761|您收到这些undefined+index消息可能是因为您没有验证您的输入(或者有bug)。|CODE|1269762|看到这样的脚本是很常见的：|1269763|if+($_GET["action"]+===+"edit")+{
++++//+edit
}+else+if+($_GET["action"]+===+"delete")+{
++++//+delete
}|code-block|syntax|javascript|1269764|您希望调用脚本为：action.php?action=edit，但是如果您将它称为：action.php呢？你会得到undefined+index+"action"|1269765|添加输入验证，如：|1269766|if+(isset($_GET["action"])+===+false)+{
++++throw+new+Exception("Invalid+input");
}|1269767|1269768|如果文件不再使用，请删除它。如果您不希望从网络上访问文件，请将其移出webroot。|1269769|entityMap^0|0|0|2|1|0|0|5|F|0|0|0|9|M|16|A|1M|O|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|15|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|16|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|17|8|@$F|18|G|19|H|I]]|9|@]|A|$]]|$1|J|3|-4|5|6|7|1A|8|@]|9|@]|A|$]]|$1|K|3|L|5|6|7|1B|8|@$F|1C|G|1D|H|M]]|9|@]|A|$]]|$1|N|3|O|5|6|7|1E|8|@]|9|@]|A|$]]|$1|P|3|Q|5|R|7|1F|8|@]|9|@]|A|$S|T]]|$1|U|3|V|5|6|7|1G|8|@$F|1H|G|1I|H|M]|$F|1J|G|1K|H|M]|$F|1L|G|1M|H|M]]|9|@]|A|$]]|$1|W|3|X|5|6|7|1N|8|@]|9|@]|A|$]]|$1|Y|3|Z|5|R|7|1O|8|@]|9|@]|A|$S|T]]|$1|10|3|-4|5|6|7|1P|8|@]|9|@]|A|$]]|$1|11|3|12|5|6|7|1Q|8|@]|9|@]|A|$]]|$1|13|3|-4|5|6|7|1R|8|@]|9|@]|A|$]]]|14|$]]

Don't call PHP script directly, or make scripts that are directly callable. This is the end goal. Probably not something you can implement right now.

If you take an Object Oriented approach all your PHP files will contain just classes. This means that when you run a file nothing happens.

Only 1 file will be an actual script and that is your entry point.

<hr>

You're getting these <code>undefined index</code> messages probably because you're not validating your input (or there is a bug).

It's common to see a script like:

<pre><code>if ($_GET["action"] === "edit") {
 // edit
} else if ($_GET["action"] === "delete") {
 // delete
}
</code></pre>

You expect to call the script like: <code>action.php?action=edit</code> but what if you call it like: <code>action.php</code>? You will get <code>undefined index "action"</code>

Add input validation like:

<pre><code>if (isset($_GET["action"]) === false) {
 throw new Exception("Invalid input");
}
</code></pre>

<hr>

If a file is no longer used, delete it. If you don't want a file accessible from the web move it out of the webroot.

blocks|key|1813328|text|我通过cron作业运行脚本，并通过GET通过密码对它们进行保护，如下所示：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1813329|$password+=+$_GET['password'];

if($password+==+"somethingcool")+{

++++//the+rest+of+your+code+here.

}|code-block|syntax|javascript|1813330|然后我像这样调用我的脚本：script.php?password=somethingcool。如果密码不正确，则不会执行脚本。|offset|length|style|CODE|1813331|不过，这也有不好的一面。如果它是从公共页面调用的，请确保使用javascript变量设置密码，否则bot将简单地遵循源代码中的链接。|1813332|确保你过滤$_GET‘密码’，这个例子是不安全的。|1813333|entityMap^0|0|0|D|X|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|T|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|U|8|@$I|V|J|W|K|L]]|9|@]|A|$]]|$1|M|3|N|5|6|7|X|8|@]|9|@]|A|$]]|$1|O|3|P|5|6|7|Y|8|@]|9|@]|A|$]]|$1|Q|3|-4|5|6|7|Z|8|@]|9|@]|A|$]]]|R|$]]

I run scripts via a cronjob and have them protected by a password I pass through the GET, like this:

<pre><code>$password = $_GET['password'];

if($password == "somethingcool") {

 //the rest of your code here.

}
</code></pre>

Then I call my script like this: <code>script.php?password=somethingcool</code>. If the password is incorrect, the script isn't executed.

There's a downside to this though.. if it's called from a public page, make sure you use javascript variables to set the password, or the bot will simple follow the link in the source code.

PS: Make sure you filter $_GET['password'], this current example is not safe to use.

blocks|key|1269802|text|我添加了一个选项来防止目录列表到我的.htaccess中。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1269803|这使得机器人将脚本的执行降低到几乎为零。我可以接受我现在收到的电话号码。|1269804|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

I added the option to prevent directory listings to my .htaccess.

This brought down the execution fo the scripts by bots down to almost zero. I can live with the number I'm receiving now.

We have a directory that is open to the web where we place utility scripts, some of them used for submitting Email, others for calling generic functions on our web service.

In my PHP error log, I am constantly getting notices and warning that the data that is used in the script has an issue, like "undefined index" or "trying to get property of non-object".

Several of these script I know are not being used anymore, yet there are still entries in the log file from someone attempting to run those scripts.

What can I do to prevent this from happening in my legitimate scripts? They need to be avail to the web due to them being called via ajax from multiple pages.

Update --- 
I figured out that the reason they were even able to be run by bots was that the directory didn't have protection from directory listings; meaning that the bots had read the listing and ran them from there without really knowing what they did.

I added the option to prevent directory listings to my .htaccess and I am going to monitor things to see if it helps.

On another note to all those suggesting blocking via IP or password protect them...
After checking some log files, checking for IP will not work because the scripts are being called both from the server, in PHP scripts, AND via ajax from the client. Also, to protect with password means I'd have to modify every place that calls the scripts to pass that password.

Hopefully my mods will help tremendously but it may not prevent bots that already know the scripts are there.

Preventing bots from running PHP scripts

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我们有一个目录是开放的网站，我们放置实用程序脚本，其中一些用于提交电子邮件，另一些用于调用我们的web服务的通用功能。在我的PHP错误日志中，我经常收到通知和警告，脚本中使用的数据存在问题，比如“未定义的索引”或“试图获取非对象的属性”。这些脚本中有几个我知道已经不再被使用了，但是在日志文件中仍然有来自试图运行这些脚本...

问防止机器人运行PHP脚本
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问防止机器人运行PHP脚本EN