Download as PDF, PPTX
Uploaded byJoe Ferguson
Memphis php html form processing with php
This document discusses best practices for processing HTML forms with PHP. It begins by introducing the presenter and describing common types of forms. It then discusses how to safely, securely, and reliably get input from users, emphasizing the importance of sanitizing and validating user data to prevent vulnerabilities like SQL injection. It provides examples of bad code and explains why it is insecure. The document then demonstrates how to properly sanitize and validate form input in PHP to avoid these risks. It concludes by offering tips, tricks, and additional resources on secure form handling.
Memphis php html form processing with php
- 1. HTML Form Processing with PHP Tips,Tricks, and Bad Ideas
- 2. Who is thisguy? Joe Ferguson - joe@joeferguson.me Professionally ● Web Developer at RocketFuel ● PHP / LAMP Focused Semi Professional ● Co-Organizer for MemphisPHP.org ● MidsouthMakers - Hackerspace Leader ● HACKmemphis.com Organizer
- 3. Types of Forms ● ● ● ● ● LoginForm Contact Form Questionnaire Sign Up Form Order Form Every application that interacts with the user uses forms in some manner.
- 4. The Problem (UseCase) I have a PHP Application that needs input: How do I… ● safely ● securely ● reliably ... get that input or other data from my users?
- 5.
- 6. Bad Ideas: Code stolenfrom someone I follow on twitter that was pointing out bad code…
- 7. Whiskey... What is thiscode even doing?! open a database connection... insert some data... run the insert query….
- 8. Tango... What is thiscode even doing?! create a new query… run the new query and return data...
- 9. Foxtrot... What is thiscode even doing?! close all open connections… get us the heck out of here...
- 10. Why is thecode bad? ● Using PHP short tags ○ Must be enabled in php.ini use sparingly if at all ● No data sanitization ○ Security?! never important ● No data validation ○ who cares! he trusts his users ● Directly saving user input into a database ○ Begging for a little bobby tables incident ● Not using prepared statements ○ PDO - it’s the wave of the future!
- 11. How do Isafely get form data? Sanitize it!
- 12. How do Isecurely get form data? HTTPS (SSL)
- 13. How do Ireliably get form data? Validate it!
- 14. Assumptions for ourexamples ● Existing JavaScript validation that input exists. ● You are using a POST or GET method ● You’re using SSL You can find these slides and examples: https://github.com/Svpernova09
- 15. Oh PHP, youso easy…. Create our form:
- 16. Oh PHP, youso easy…. Add our form processing:
- 17. I’m REALLY goodat this PHP thing Output when the form has been submitted:
- 18. What if .... ...someoneclever comes along? ...someone malicious comes along?
- 19. Wait a minute…. HOWDID THIS HAPPEN!!!111>>!??
- 20. It was allgoing so beautifully... Where did we go wrong? Line 53: We used the raw input from the user. This leaves us WIDE open to many attacks.
- 21. WTF! But PHPis so EASY! The user put JavaScript in our field: Since we just echoed the input, we injected the user’s JavaScript directly into our page:
- 22. How do weprevent such attacks? We must go Back... to line 53! htmlentities() = don’t parse as HTML Browser: Source:
- 23. Different ways tosanitize data Data Filters ● Validate Filters ○ FILTER_VALIDATE_EMAIL ○ FILTER_VALIDATE_INT ● Sanitize Filters ○ FILTER_SANITIZE_STRING ○ FILTER_SANITIZE_NUMBER_INT ● htmlspecialchars() ● htmlentities()
- 24. htmlentities OR htmlspecialchars? ● htmlspecialchars() will encode only characters that have special significance in HTML ○ Example: ■ echo htmlspecialchars('<Il était une fois un être>.'); ■ // Outputs: <Il était une fois un être>. ● htmlentities() all characters which have HTML character entity equivalents are translated into these entities ○ Example: ■ ■ echo htmlentities('<Il était une fois un être>.'); // Outputs: <Il était une fois un être> GREAT Explanation: http://stackoverflow.com/questions/46483/htmlentities-vs-htmlspecialchars
- 25. filter_var or html*? Data Filters are newer than html* functions They are the “better” way. They also depend on newer versions of PHP
- 26. But I’m asmall shop, & trust users You can’t trust input from ANYONE! ● ● ● ● ● ● ● You Your Parents Your Co Workers Your Boss Your App’s Users Other Apps The Internet
- 27. Should I sanitizeor validate? BOTH! SANITIZING your data is removing (or encoding) a specific set of characters from your data. VALIDATING your data is making sure the data is in the format you expect to be in.
- 28. Sanitizing Data Our newform (Example: 02 - Sanitizing Data)
- 29. Sanitizing Data Form CodeView (Example: 02 - Sanitizing Data)
- 30. Sanitizing Data -Data Entry This is the type of input we want...
- 31. Sanitizing Data -Data Entry Make sure no malicious code is in the data... Output:
- 32. Sanitizing Data -BETTER way The more modern way: filter_var with flags: Output is the same:
- 33. Testing our DataSanitization
- 34. What about checkboxes? Let’s add a check box to our form
- 35. Sanitize everything! Even checkboxes should be sanitized
- 36. Validating User Input Ournew form (Example: 03 - Validating Data)
- 37. Validating User Input FormCode View (Example: 03 - Validating Data)
- 38. Validating User Input- Data Entry This is the type of input we want...
- 39. Validating Data -Data Entry Make sure the data conforms to expectations
- 40. Validating Data -Data Entry Output
- 41.
- 42. Testing Our Validation Ifwe don’t enter an age… if we don’t enter our email...
- 43. What do wedo with the data? No matter what you do from here… - the hard part is over. Your data is now: ● Validated! ● Sanitized!
- 44. Remember that BadIdea?
- 45.
- 46. Tips ● ALWAYS Sanitizeyour data. ○ Even if you don’t validate it. ○ Some data is harder to validate than others ● Use JavaScript to enforce requirements ○ JavaScript is great for checking data before it gets submitted. This makes PHP’s job easier ○ Don’t rely on JS to sanitize. Let PHP handle it. ● Offload your PHP processing via Ajax ○ Keeps your code cleaner by separating heavy lifting of data validation out of your form code. ● Show your users where they failed. ○ This also makes your own debugging easier
- 47. Tricks - AjaxForm Handling Form Code View (Example: 04 Ajax Form Handling)
- 48. Tricks Ajax FormHandling Ajax JavaScript to post the form
- 49. Tricks Ajax FormHandling This is the file we’re posting the form data to
- 50. Tricks Ajax FormHandling Output This allows you to separate logic away from the file that contains your form.
- 51. Tricks - Sometricks won’t last... Issue: Application Form getting spammed. Steps taken: ● We added reCAPTCHA Issue slowed, after some time they continued Further steps: For some reason the spam stopped...
- 52. Tricks - GettingCreative Add a question to your form:
- 53. Tricks - GettingCreative If the user answers correctly: If the user answers incorrectly:
- 54. Better Ideas: CSI:php- csiphp.com CSI:PHP is a great site to see not only bad code, but WHY it’s bad and how to make it better.
- 55. Links - Q& A ● ● ● ● MemphisPHP.org phptherightway.com CSIPHP.com Slides & Code Samples: ○ https://github.com/svpernova09 ● htmlentities() or htmlspecialchars()? ○ http://stackoverflow.com/questions/46483/htmlentities-vs-htmlspecialchars ● xkcd: http://xkcd.com/