How are input keys exploitable by malicious users?

后端 未结 5 1094
清歌不尽
清歌不尽 2020-12-29 23:14

In the CodeIgniter PHP framework, there is a function that automatically runs on each request that, among other things, filters the GET/POST/COOKIE array keys, and kills the

5条回答
  •  既然无缘
    2020-12-30 00:06

    Perhaps it is trying to prevent this attack.

    The attack works by using knowledge of how PHP builds its hashing structures to make keys in $_POST which take an arbitrarily long time to process.

    I suspect it is probably just trying to prevent the more mundane SQL injection attacks though.

提交回复
热议问题