راهنمای جامع ایمن‌سازی PHP و مقابله با باگ‌های RCE

# Nginx Rule to Block PHP-CGI Argument Injection
server {
 location ~ \.php$ {
 # Block direct option injection via query strings
 if ($query_string ~* "(%2d|-)[dsqftv]") {
 return 403;
 }
 fastcgi_pass 127.0.0.1:9000;
 include fastcgi_params;
 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
 }
}

# Upgrade PHP Core Packages on Ubuntu Server
sudo apt update
sudo apt install -y php8.3 php8.3-fpm php8.3-cli php8.3-mbstring php8.3-xml php8.3-curl
sudo systemctl restart php8.3-fpm nginx

 PDO::ERRMODE_EXCEPTION,
 PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
 PDO::ATTR_EMULATE_PREPARES => false
]);

$stmt = $pdo->prepare('SELECT id, username, email FROM users WHERE email = :email AND status = :status');
$stmt->execute(['email' => $userInputEmail, 'status' => 'active']);
$user = $stmt->fetch();
?>

; Secure Session Directives in php.ini
session.use_strict_mode = 1
session.cookie_httponly = 1
session.cookie_secure = 1
session.cookie_samesite = "Lax"
session.use_only_cookies = 1
session.gc_maxlifetime = 1800