phpcms安全设置

// 使用PDO进行参数化查询
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username AND password = :password');
$stmt->bindParam(':username', $username);
$stmt->bindParam(':password', $password);
$stmt->execute();

// 输出编码
echo htmlspecialchars($user_input, ENT_QUOTES, 'UTF-8');

// 生成CSRF令牌
session_start();
if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
$csrf_token = $_SESSION['csrf_token'];

// 验证CSRF令牌
if ($_POST['csrf_token'] !== $csrf_token) {
    die("Invalid CSRF token");
}

// 检查文件类型和大小
if ($_FILES['file']['size'] > 1000000) {
    die("File size exceeds limit");
}
$allowed_types = array('jpg', 'jpeg', 'png', 'gif');
$file_type = strtolower(pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION));
if (!in_array($file_type, $allowed_types)) {
    die("Invalid file type");
}

// 移动文件到安全目录
$upload_dir = 'uploads/';
if (!file_exists($upload_dir)) {
    mkdir($upload_dir, 0777, true);
}
$target_file = $upload_dir . basename($_FILES['file']['name']);
if (move_uploaded_file($_FILES['file']['tmp_name'], $target_file)) {
    echo "File uploaded successfully";
} else {
    echo "Failed to upload file";
}