如何解决PHP开发中的安全漏洞和攻击面

// 参数化查询
$username = $_POST['username'];
$password = $_POST['password'];
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username AND password = :password");
$stmt->bindParam(':username', $username);
$stmt->bindParam(':password', $password);
$stmt->execute();

// 预编译语句
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = ? AND password = ?");
$stmt->execute([$username, $password]);

// 过滤用户输入
$username = $_POST['username'];
$username = filter_var($username, FILTER_SANITIZE_STRING);

// 转义输出
echo htmlspecialchars($username);

// 设置允许上传的文件类型和大小
$allowedTypes = ['jpg', 'png', 'gif'];
$maxSize = 1024 * 1024; // 1MB

// 获取上传的文件信息
$file = $_FILES['file'];

// 验证文件类型和大小
if (in_array(strtolower(pathinfo($file['name'], PATHINFO_EXTENSION)), $allowedTypes) && $file['size'] <= $maxSize) {
    // 处理上传文件
} else {
    // 文件类型或大小不符合要求，进行错误处理
}

// 设置cookie的httponly和secure属性
ini_set('session.cookie_httponly', true);
ini_set('session.cookie_secure', true);