drupal top 10 危险检查

1 SQL Injection

index.php?id=12

mysql_query("UPDATE mytable SET value = '". $value ."' WHERE id = ". $_GET['id']);

推荐:

db_query("UPDATE {mytable} SET value = :value WHERE id = :id", array(':value' => $value, ':id' => $id);

就是等号也有可能有问题，还有db_like, db_escape_table 函数.

2. Cross Site Scripting (XSS)

　文章的标题也可能是<script>alert('abc');</script>比较危险
输出一般可以加上check_plain() -->
<h1 id="page-title" class="title"> <script>alert('abc');</script> </h1> '<script>alert('abc');</script>' 原封不动的保存在数据表node和field_data_comment里
JS code to a page是不允许到页面中的。 页面中含有JS代码

Use placeholders in functions like t() or format_plural(): %name, @url, !insecure:

t('%name has a blog at <a href=" @url " _fcksavedurl=" @url " _fcksavedurl=" @url " _fcksavedurl=" @url "> @url </a>', array('@url' => valid_url($user->profile_blog), '%name' => $user->name));

Use Drupal.t() , Drupal.formatPlural() in JavaScript

3. Authentications and sessions

Drupal has good solutions for that, so don't need to worry too much about these:

当权限改变的时候SESSION_id也会变动的

4. Insecure direct object references

index.php?id=12

db_query("SELECT * FROM {node} WHERE nid = :id", array(':id' => $_GET['id'] ));

$select->addtag('node_access');

这种就是不对的，最好是加些TAG
　One common issue is forget to add "published = Yes" to the view filters. 别忘了

有权限设置的地方都尽量设置考虑一下权限

5. Cross Site Request Forgery (CSRF)

这个就是说从别的站点放进来一个段代码，里面包含一个URL，如果用户加载含有这个URL的页面或者点击某个连接，则会被伪造了一个请求，但这个请求会发生意向不到的结果。

[b]6： Security misconfiguration[/b]

服务器和系统软件的安全隐患
security_review模块
网站用户权限设置 特别是administer *** 之类的权限 要谨慎
Update 这个模块其实很有用的 可以不时查看是否有安全级别的软件更新

7. Insecure cryptographic storage

还可以人为的去增加密码的难度

8. Failure to restrict URL access

Drupal approach:

Menu system uses access callback and access arguments

Continually review permissions

如果忘了写 那就是大家都有权限 这样是比较危险的

9. Insufficient transport protection

尽量使用SSL

[b]10. Unvalidated redirects[/b]

Look for use of drupal_goto() and Form API #redirect instances in your modules to validate their compliance

当说要跳转到某个地方，这是要注意安全性

http://www.cameronandwilding.com/blog/pablo/10-most-critical-drupal-security-risks