phpparser

『壹』 當前市面上的代碼審計工具哪個比較好

第一類：Seay源代碼審計系統
這是基於C#語言開發的一款針對php代碼安全性審計的系統，主要運行於Windows系統上。這款軟體能夠發現SQL注入、代碼執行、命令執行、文件包含、文件上傳、繞過轉義防護、拒絕服務、XSS跨站、信息泄露、任意URL跳轉等漏洞，基本上覆蓋常見的PHP漏洞。在功能上，它支持一鍵審計、代碼調試、函數定位、插件擴展、自定會規則配置、代碼高亮、編碼調試轉換、資料庫執行監控等數十項強大功能。
第二類：Fortify SCA
Fortify
SCA是由惠普研發的一款商業軟體產品，針對源代碼進行專業的白盒安全審計。當然，它是收費的，而且這種商業軟體一般都價格不菲。它有Windows、Linux、Unix以及Mac版本，通過內置的五大主要分析引擎對應用軟體的源代碼進行靜態分析。
第三類：RIPS
RIPS是一款基於PHP開發的針對PHP代碼安全審計的軟體。另外，它也是一款開源軟體，由國外安全研究員開發，程序只有450KB，目前能下載到的最新版本是0.54，不過這款程序已經停止更新了。它最大的亮點在於調用了PHP內置解析器介面token_get_all，並且使用Parser做了語法分析，實現了跨文件的變數及函數追蹤，掃描結果中非常直觀地展示了漏洞形成及變數傳遞過程，誤報率非常低。RIPS能夠發現SQL注入、XSS跨站、文件包含、代碼執行、文件讀取等多種漏洞，文件多種樣式的代碼高亮。

『貳』 php程序出現錯誤提示：Parser error "'}' expected." 這是什麼意思求助，在線等

解析錯誤，拋出異常

『叄』 nick/PHPParser怎麼解密goto混淆後的php代碼

可以在網上找解密goto 的，不過需要付一點費用

『肆』 如何將excel表格的數據導入到mysql數據中去

工具：office excel、mysql

步驟：

1、打開mysql，用mysql命令創建一個表。

『伍』 php-fpm start報錯：/etc/php-fpm.conf:1: parser error : Document is empty，parser error :

這個明顯的是php-fpm.conf配置文件的問題，我給你份我用的

<configuration>
All relative paths in this config are relative to php's install prefix
<section name="global_options">
Pid file
<value name="pid_file">/opt/php/logs/php-fpm.pid</value>
Error log file
<value name="error_log">/opt/php/logs/php-fpm.log</value>
Log level
<value name="log_level">notice</value>
When this amount of php processes exited with SIGSEGV or SIGBUS ...
<value name="emergency_restart_threshold">10</value>
... in a less than this interval of time, a graceful restart will be initiated.
Useful to work around accidental curruptions in accelerator's shared memory.
<value name="emergency_restart_interval">1m</value>
Time limit on waiting child's reaction on signals from master
<value name="process_control_timeout">5s</value>
Set to 'no' to debug fpm
<value name="daemonize">yes</value>
</section>
<workers>
<section name="pool">
Name of pool. Used in logs and stats.
<value name="name">default</value>
Address to accept fastcgi requests on.
Valid syntax is 'ip.ad.re.ss:port' or just 'port' or '/path/to/unix/socket'
<value name="listen_address">/tmp/php-cgi.sock</value>
<value name="listen_options">
Set listen(2) backlog
<value name="backlog">-1</value>
Set permissions for unix socket, if one used.
In Linux read/write permissions must be set in order to allow connections from web server.
Many BSD-derrived systems allow connections regardless of permissions.
<value name="owner"></value>
<value name="group"></value>
<value name="mode">0666</value>
</value>
Additional php.ini defines, specific to this pool of workers.
<value name="php_defines">
<value name="sendmail_path">/usr/sbin/sendmail -t -i</value>
<value name="display_errors">1</value>
</value>
Unix user of processes
<value name="user">www</value>
Unix group of processes
<value name="group">www</value>
Process manager settings
<value name="pm">
Sets style of controling worker process count.
Valid values are 'static' and 'apache-like'
<value name="style">static</value>
Sets the limit on the number of simultaneous requests that will be served.
Equivalent to Apache MaxClients directive.
Equivalent to PHP_FCGI_CHILDREN environment in original php.fcgi
Used with any pm_style.
<value name="max_children">128</value>
Settings group for 'apache-like' pm style
<value name="apache_like">
Sets the number of server processes created on startup.
Used only when 'apache-like' pm_style is selected
<value name="StartServers">20</value>
Sets the desired minimum number of idle server processes.
Used only when 'apache-like' pm_style is selected
<value name="MinSpareServers">5</value>
Sets the desired maximum number of idle server processes.
Used only when 'apache-like' pm_style is selected
<value name="MaxSpareServers">35</value>
</value>
</value>
The timeout (in seconds) for serving a single request after which the worker process will be terminated
Should be used when 'max_execution_time' ini option does not stop script execution for some reason
'0s' means 'off'
<value name="request_terminate_timeout">0s</value>
The timeout (in seconds) for serving of single request after which a php backtrace will be mped to slow.log file
'0s' means 'off'
<value name="request_slowlog_timeout">0s</value>
The log file for slow requests
<value name="slowlog">logs/slow.log</value>
Set open file desc rlimit
<value name="rlimit_files">65535</value>
Set max core size rlimit
<value name="rlimit_core">0</value>
Chroot to this directory at the start, absolute path
<value name="chroot"></value>
Chdir to this directory at the start, absolute path
<value name="chdir"></value>
Redirect workers' stdout and stderr into main error log.
If not set, they will be redirected to /dev/null, according to FastCGI specs
<value name="catch_workers_output">yes</value>
How much requests each process should execute before respawn.
Useful to work around memory leaks in 3rd party libraries.
For endless request processing please specify 0
Equivalent to PHP_FCGI_MAX_REQUESTS
<value name="max_requests">10240</value>
Comma separated list of ipv4 addresses of FastCGI clients that allowed to connect.
Equivalent to FCGI_WEB_SERVER_ADDRS environment in original php.fcgi (5.2.2+)
Makes sense only with AF_INET listening socket.
<value name="allowed_clients">127.0.0.1</value>
Pass environment variables like LD_LIBRARY_PATH
All $VARIABLEs are taken from current environment
<value name="environment">
<value name="HOSTNAME">$HOSTNAME</value>
<value name="PATH">/usr/local/bin:/usr/bin:/bin</value>
<value name="TMP">/tmp</value>
<value name="TMPDIR">/tmp</value>
<value name="TEMP">/tmp</value>
<value name="OSTYPE">$OSTYPE</value>
<value name="MACHTYPE">$MACHTYPE</value>
<value name="MALLOC_CHECK_">2</value>
</value>
</section>
</workers>
</configuration>

『陸』 php微信支付開發獲取返回值獲取不到

這么幾行代碼看不出什麼問題，我是這樣處理的。

$data=file_get_contents("php://input");
$result_xml=xml_parser_create();
xml_parse_into_struct($result_xml,$data,$vals,$index);
xml_parser_free($result_xml);
foreach($valsas$k)
{
if(strtolower($k['tag'])!='xml')$result_array[strtolower($k['tag'])]=$k['value'];
}
var_mp($result_array);
//$result_array這個變數對應的就是你代碼中的$result