0
votes
1answer
74 views

Is it possible to avoid PHP string validation with malformed UTF-8 string?

Some of the old PHP string functions for example explode() are working with UTF-8 strings, but they don't work properly on malformed UTF-8 strings. Is this a security issue? Is it possible to avoid ...
6
votes
2answers
606 views

PHP: if charset mismatches (htmlentities UTF-8) viewed by client as ISO-8859-1 (or vice versa)

Short Question: Question: Could any security vulnerabilities arise if a server runs htmlentities as UTF-8 but the client views the results as ISO-8859-1? Assumption: No vulnerabilities exist when ...
8
votes
2answers
2k views

Exploiting PHP via GET params

To be clear, this is in the interest of ethical testing to secure an application on behalf of my work. Now that that's out of the way, here are the details: Un-sanitised GET params are used in a ...
12
votes
4answers
3k views

Is $_SERVER[ ] a safe source of data in PHP?

Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]? Thanks. OVERVIEW OF RESPONSES: So it seems there is a consensus that some ...