Напади со инјектирање барања
Почист и полокален преглед на PHP референцата, со задржана структура од PHP.net и подобра читливост за примери, секции и белешки.
Напади со инјектирање барања
Референца за `mongodb.security.request_injection.php` со подобрена типографија и навигација.
Напади со инјектирање барања
If you are passing $_GET (или $_POST) parameters to your queries, make sure that they are cast to strings first. Users can insert associative arrays in GET and POST requests, which could then become unwanted $-queries.
A fairly innocuous example: suppose you are looking up a user's information with the request http://www.example.com?username=bob. Your application creates the query
$q = new \MongoDB\Driver\Query( [ 'username' => $_GET['username'] ]).
Someone could subvert this by getting
http://www.example.com?username[$ne]=foo, which PHP will magically turn into an associative array, turning your query into
$q = new \MongoDB\Driver\Query( [ 'username' => [ '$ne' => 'foo' ] ] ), which will return all users not named "foo" (all of your users, probably).
This is a fairly easy attack to defend against: make sure $_GET and $_POST parameters are the type you expect before you send them to the database. PHP has the filter_var() function to assist with this.
Note that this type of attack can be used with any database interaction that locates a document, including updates, upserts, deletes, and findAndModify commands.
Константи за известување за грешки » the main documentation for more information about SQL-injection-like issues with MongoDB.