0

我正在编写一个基本的许可证验证 PHP 下载脚本。目标文件大约 50MB，它适用于某些人。别人做不完，有时候重试也行。

这是脚本：

$method = $_GET['method'];
    if($method == "webdownload") {
        $airlineid = $_GET['airline'];

        $sql = "SELECT * FROM airlines WHERE airlineid='$airlineid'";   
        $result = mysql_query($sql) or die(mysql_error());
        $row = mysql_fetch_array($result);
        if($row['licensekey'] == "")
            die("Invalid airline id");

        $filename = $row['code'].'_installer.exe';
        $file_path = '../resources/application/files/'.$row['airlineid'].'/'.$row['clientversion'].'/application_installer.exe';
        if($row['licensestate'] != "OK")
            die("The license associated with this downloaded has been deauthorized.");

        if(!is_file($file_path))
            die("The file associated with this version for this airline appears to be invalid.");
        //download code here - it runs once only, if refreshed it will not allow it.                

        header('Content-type: application/exe');
        header("Content-Disposition: attachment; filename=".$filename);
        header("Content-Length: ".filesize($file_path));
        header("Content-Transfer-Encoding: binary");    

        header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
        header('Pragma: public');   

        //header('X-Sendfile: '.$file_path); I tried this - it had no effect and I want the portability.

        $file = @fopen($file_path,"rb");
        while(!feof($file)) {           
            $buffer = fread($file, 1024 * 8);
            print($buffer);
            flush();            
        }
        close($file);       
    }

编辑：根据建议，我发现脚本等非常容易受到 SQL 注入的攻击。我已使用此函数替换了直接变量 SQL 表达式：

        function secure_string($raw) {
    $sid = strtolower($raw);
    $sid = str_replace("'","_SINGLE_QUOTE", $sid);
    $sid = str_replace('"','_DOUBLE_QUOTE', $sid);


    $cmd[0] = "insert";
    $cmd[1] = "select";
    $cmd[2] = "union";
    $cmd[3] = "delete";
    $cmd[4] = "modify";
    $cmd[5] = "replace";
    $cmd[6] = "update";
    $cmd[7] = "create";
    $cmd[8] = "alter";


    for($index = 0; $index <= 8; $index++) {
        $sid = str_replace($cmd[$index],"_SQL_COMMAND", $sid);
    }

    return $sid;        
}

这足以阻止 SQL 注入吗？

EDIT2：我已将此功能与 PDO 准备功能结合使用以消除此漏洞。感谢 100x 让我在没有灾难性后果的情况下学习了这一课。

4

1 回答 1

0

readfile()是一个将整个文件一次性放入缓冲区的函数。可能会阻止 PHP 超时。使用它代替底部的fopen()and循环。print()

另一个解决方案是查看您的服务器是否具有mod_x_sendfile，因为这会将下载从 PHP 中取出并放入 apache 内部。

编辑：我注意到你说你已经尝试过 sendfile。如果你能让它工作，可能是一个更好的选择。

于 2012-11-09T04:05:07.097 回答