Menekali  Just another IT Blog.

Rob Miller wrote a really great article on PHP Security. He makes a lot of good points, and suggestions, with real world examples and scenarios. Definitely worth reading. The article covers: XSS, SQL Injection, CSRF, among an array of other possible vulnerable avenues in PHP programming. Check it out if you ever do any kind of PHP programming, and want to keep it safe.

Link: PHP Security Guide

Just thought I'd end the night with a simple script. This PHP script will list all file, directory, and sub directories, and will even make links out of them.

If you're just starting to get into PHP you may be a bit confused about how the GD Library works, and how to implement that into things such a CAPTCHA. This is a very easy implementation of a captcha. This will help stop spammers, and spam bots from abusing your form, or spamming your server.

I won't however, prevent the abuse as noted in Jeff Atwoods post, it will however help.

So, let's say you have a public submission or contact form on your website, that looks somewhat like the following:

We'll use a captcha to keep this form somewhat safe ().

Obviously you need a PHP engine enabled for your Web server to execute PHP scripts, and GD (PHP graphics library) to generate the image. The solution below is tested for Apache (Windows and Unix), IIS (Windows), PHP-4, PHP-5, GD and GD2.

1) Make a PHP script (separate file captcha.php) which will generate the image:

2) Add the following line at the top of the page where you need to implement CAPTCHA:

3) Add the following line to check whether the CAPTCHA string entered by the visitor is valid, before the line where you will proceed with a submitted message:

4) Finaly add the CAPTCHA to the form:

There you go! A quick, and dirty captcha for easy implementation. Of course there are much more secure and stronger methods to achieve this feature, but this is just the quick and dirty.

Hope this helped.

PHP MySQL Web Development Security Tips - 14 tips you should know when developing with PHP and MySQL

I read about many of these points in books and tutorials but I was rather lazy to think about many of them initially learned some of these lessons the hard way. Fortunately I didn't lose any major data over security issues with PHP MySQL, but my suggestion to everyone who is new to PHP is to read these tips and apply them *before* you end up with a big mess.
1.

Do not trust user input

If you are expecting an integer call intval() (or use cast) or if you don't expect a username to have a dash (-) in it, check it with strstr() and prompt the user that this username is not valid.

Here is an example:

Now $post_id will be an integer for sure

2. Validate user input on the server side

If you are validating user input with JavaScript, be sure to do it on the server side too, because for bypassing your JavaScript validation a user just needs to turn their JavaScript off.
JavaScript validation is only good to reduce the server load.

3. Do not use user input directly in your SQL queries

Use mysql_real_escape_string() to escape the user input.
PHP.net recommends this function: (well a little different)

Then you can use it like this:

4. In your SQL queries don't put integers in quotes

For example $id is suppose to be an integer:

Note that, using intval() would fix the problem here.

5. Always escape the output

This will prevent XSS (Cross Site Scripting) attacks, imagine you receive and save some data from a user and you want to display this data on a web page later (maybe his/her bio or username) and the user puts this bit of code in the input field along with his bio:

If you display the raw user input on a web page this will be very ugly, it can even be worse if a user inputs this code instead:

With this, an attacker can steal cookies from whoever visits that certain page (containing bio etc.) and this includes session cookies with session IDs in them so the attacker can hijack your users' sessions and appear to be logged in as other users.

When displaying user input on a page use htmlentities($user_bio, ENT_QUOTES, 'UTF-8');

6. When uploading files, validate the file mime type

If you are expecting images, make sure the file you are receiving is an image or it might be a PHP script that can run on your server and does whatever damage you can imagine.

One quick way is to check the file extension:

Note that validating extension is a very simple way, and not the best way, to validate file uploads but it's effective;
simply because unless you have set your server to interpret .jpg files as PHP scripts then you are fine.

7. If you are using 3rd party code libraries, be sure to keep them up to date

If you are using code libraries like Smarty or ADODB etc. be sure to always download the latest version.

8. Give your database users just enough permissions

If a database user is never going to drop tables, then when creating that user don't give it drop table permissions, normally just SELECT, UPDATE, DELETE, INSERT should be enough.

9. Do not allow hosts other than localhost to connect to your database

If you need to, add only that particular host or IP as necessary but never, ever let everyone connect to your database server.

10. Your library file extensions should be PHP

.inc files will be written to the browser just like text files (unless your server is setup to interpret them as PHP scripts), users will be able to see your messy code (kidding) and possibly find exploits or see your passwords etc.
Have extensions like config.inc.php or have a .htaccess file in your extension (templates, libs etc.) folders with this one line:

11. Have register globals off or define your variables first

Register globals can be very dangerous, consider this bit of code:

Now with register globals on an attacker can view this page like this and bypass your authentication:
http://yourwebsite.com/admin.php?auth=1

If you have registered globals on and you can't turn it off for some reason you can fix these issues by defining your variables first:

Defining your variables first is a good programming practice that I suggest you follow anyway.

12. Keep PHP itself up to date

Just take a look at www.php.net and see release announcements and note how many security issues they fix on every release to understand why this is important.

13. Read security books

Always find new books about PHP security to read; you can start by reading the 4th book in the Learning PHP Thread, which is one of the best books on PHP security and the author is a member of the PHP team so he knows the internals very well.

14. Contribute to this list

Feel free to reply to this post and add to this list, it will be helpful for everyone!

If you find this useful, please Digg   and / or comment please!