php网站留言板漏洞

// 原始代码
$query = "SELECT * FROM messages WHERE id = " . $_GET['id'];

// 改进后的代码
$id = mysqli_real_escape_string($conn, $_GET['id']);
$query = "SELECT * FROM messages WHERE id = '$id'";

// 原始代码
echo $_POST['message'];

// 改进后的代码
echo htmlspecialchars($_POST['message'], ENT_QUOTES, 'UTF-8');

// 生成CSRF令牌
session_start();
$csrfToken = bin2hex(random_bytes(32));
$_SESSION['csrfToken'] = $csrfToken;

// 验证CSRF令牌
if ($_POST['csrfToken'] !== $_SESSION['csrfToken']) {
    die("CSRF验证失败");
}

// 检查文件类型和大小
if ($_FILES['file']['type'] !== 'image/jpeg' || $_FILES['file']['size'] > 1024 * 1024) {
    die("无效的文件类型或大小");
}

// 移动文件到安全目录
$uploadDir = 'uploads/';
$file = $uploadDir . basename($_FILES['file']['name']);
if (move_uploaded_file($_FILES['file']['tmp_name'], $file)) {
    echo "文件上传成功";
} else {
    echo "文件上传失败";
}