How to secure sending Post data through cURL?

问题:

I'm using Client URL to send POST data. Link to the source: http://hayageek.com/php-curl-post-get/#curl-post. The code is as following:

<?php
function httpPost($url,$params){
  $postData = '';
   //create name value pairs seperated by &
   foreach($params as $k => $v){
      $postData .= $k . '='.$v.'&';
   }
rtrim($postData, '&');
$ch = curl_init(); 

curl_setopt($ch,CURLOPT_URL,$url);
curl_setopt($ch,CURLOPT_RETURNTRANSFER,true);
curl_setopt($ch,CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_POST, count($postData));
curl_setopt($ch, CURLOPT_POSTFIELDS, $postData);   

$output=curl_exec($ch);

curl_close($ch);
return $output;

}

$params = array(
   "name" => "Ravishanker Kusuma",
   "age" => "32",
   "location" => "India"
);

echo httpPost("http://www.jmediatechnology.eu/script.php",$params);
?>

I want to know wether this method is safe from hijacking or any other security issues.

回答1:

You are sending a plain HTTP request. If anybody is in an appropriate position on the network to intercept the request, it's all plainly visible to him. You have to either:

1. Use HTTPS.
2. Roll your own encryption scheme as part of the protocol and encrypt the data in some way that's coordinated with the remote server which will decrypt it.

I hope it's pretty obvious that you really want option 1. Having said that, using HTTPS is not an absolute guarantee that you're "safe" (for whatever definition of "safe" you want to apply). If used correctly, HTTPS effectively protects data in transit from snooping 3rd parties. But that doesn't mean the whole rest of your system is safe and that you don't have any glaring security holes elsewhere.