Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

0
votes
2answers
34 views

Calling string functions safely

I wish to implement some user callable functions in my code. I use something like this: function funcTest(){ echo "This is test function"; } if (isset($_GET['cmd'])) { $func = ...
0
votes
1answer
87 views

Good password hashing algorithm compatible with PHP and Linux apps

I'm looking for a password hash method for a new server system. The hashes must be generated from PHP code and verified from PHP as well as by a number of applications on a Linux system. I know that ...
0
votes
1answer
41 views

PHP: Save e-mail address hashed or plain [duplicate]

I've been wondering about something, is it more secure to store an encrypted (hashed with password_hash) email address in the database, or just as plain text? I've google'd this matter and saw that ...
-5
votes
0answers
25 views

Session cookies not been retrieved or copied anymore? [closed]

Can sessions cookies be retrieved now Google changed they way they are created? Any php examples would be appreciated
3
votes
1answer
55 views

Security concerns about purchased PHP script (web app)

I have been thinking about buying a ready-made PHP script (i.e. a web application) that provides a specific functionality. Say, for example one of these sold by Agriya: http://www.agriya.com/products ...
5
votes
3answers
132 views

prevent session hijacking in PHP

I wrote the log In/log Out scripts of my web page and when the user logs in I store in the $_SESSION variable the user agent. Now each time a page is loaded I check if the user is logged in or not and ...
0
votes
1answer
42 views

Use password_hash() with a system-wide salt and a user-specific salt

This is somewhat a followup to "About password_hash() in PHP and storing (part of) its salt outside DB". Is there a way or any advantage to have a system-wide salt and a user-specific salt vs just a ...
0
votes
0answers
23 views

Sessions in php, how to handle log ins [migrated]

I am getting confused about how the $_SESSION variable should be used. So far I learned it is used to store temporary data for example if a user logs in I can set some session variables to be able to ...
1
vote
0answers
34 views

Is this PHP TOTP (time based one time password) idea sound?

Disclaimer: I am not very familiar with safety techniques in general. The problem: Quickly create lots of small files in server from a bash script. I used to use scp (secure copy) in order to create ...
1
vote
1answer
103 views

PHP unserialize() object injection

So I came across with this authentication bypass security notice and the fix for it was just simply changing all serialization to json encoding. I am just wondering how this really is exploitable? ...
0
votes
2answers
92 views

How CryptoPHP: Sneaky malware works?

This malware is hidden in pirated themes and plug-ins for CMS . the ‘social.png’ file confirmed we had found the backdoor; as it contained a big blob of obfuscated PHP code . My question is how ...
3
votes
2answers
85 views

Passing session id in query string to maintain state in third party iframe - good practice?

I would like to allow the user to be "logged in" and maintain state / logged in status between pages within an iframe. The iframe content is ours, and will be hosted on various clients' websites. ...
-1
votes
1answer
70 views

php execution possibility in img src

I am creating a simple application. There is an option to download a generated image. For that, my PHP code is: <?php if (isset($_GET['img_name'])){ ?> <html> <img src="<?php echo ...
0
votes
1answer
52 views

question regarding php upload form security

I read here http://blog.insicdesigns.com/2009/01/secure-file-upload-in-php-web-applications/ and question is related with text near However, if the attacker is able to upload files, even outside ...
5
votes
6answers
2k views

Techniques to make a login page safe without using SSL

I am developing a web page where people can write and comment things (no personal informations required) and I need to put a log in form so users can see all their actions on my web page. My idea is ...
4
votes
3answers
1k views

Is this PHP code XSS proof?

Is the following PHP code XSS proof? <?php $site = $_GET["url"]; echo "<a href='".str_replace(array("\"", "'", "javascript:", "vbscript:"), array("%22", "%27", "", ""), ...
2
votes
1answer
134 views

Evil PHP code I need help analyzing

I found on my server something like this at the beginning of my php files: <?php ...
0
votes
1answer
72 views

How does this wordpress XSS work?

There is a new Wordpress exploit in wp-includes/formatting.php $textarr = preg_split('/(<.*>|\[.*\])/Us', $text, -1, PREG_SPLIT_DELIM_CAPTURE); General problem here is that they try to parse ...
-3
votes
1answer
34 views

PHP get_file_contents & curl [closed]

These two are the functions can capture remote address, for example this is a social network site example.com/user?privacyemail.php, this site is containing email of user or some kind of private info, ...
0
votes
1answer
100 views

Why does this CSRF vulnerability work?

Recently Laravel 4 was updated to address a security concern: there was a CSRF vulnerability in their code. Here's the old code: if (Session::token() != Input::get('_token')) { throw new ...
0
votes
0answers
81 views

Active Directory Injection attack

Is there a possible way of injecting code to pull data from Active directory? I have written a PHP page that executes Powershell and is able to change passwords to a controlled group of people. ...
0
votes
1answer
49 views

With SSL: not saving sessions, cookies not being sent

My purpose is to have a fully SSL site. The web host gave this format of URL for my shared server SSL: https://hostaddress.net/example/ where www.example.com is the domain name. I conducted the ...
-4
votes
2answers
89 views

What is the best exploit of XSS within 100 characters? [closed]

I found a vulnerable php script on my website. The script allows an user input (textarea), which is not encoded by htmlspecialchars(). Therefore it is possible to add html and javascript code. The ...
1
vote
1answer
51 views

Do PHP/SQLI Prepared Statements Need Special Character Escaping?

I'm using php/mysqli queries such as this: $stmt = $con -> prepare("INSERT INTO `comments` (`uid`, `article_id`, `status`, `comment`) VALUES (?, ?, ?, ?)"); $stmt -> bind_param('iiis', $uid, ...
2
votes
1answer
149 views

Is it possible to exploit a file upload with whitelist and filename hashing?

I have a small web application. Because it is necessary to upload some files I check the file extensions with a whitelist (tgz, jpg, png, pdf, zip, rar, txt, gif, py, c, rb). In addition to that, I ...
2
votes
3answers
111 views

Can password_verify() be used to identify password after database breach?

I am a newbie to PHP and password hashing. I am following the instructions provided here to hash my user password before storing. My questions are: PHP recommends password_hash() method as a ...
2
votes
1answer
67 views

Why protect files with sensative information with .htacces?

I was taught that an important step to securing a website (primarily with PHP) was to store all sensitive information such as database connection info, salt generation, etc. in a separate ...
0
votes
2answers
165 views

PHP - Need help to understand injected code

I discovered a lot of requests to a fishy file in a plugin on my Wordpress site. There, I found a long string, a mapping function for each character used in the string, and an excecution of the ...
0
votes
1answer
144 views

AES 128bit decryption using a key longer than 16 bytes

I got a little problem regarding AES decryption. I have to decrypt some text that has been encrypted using 128bit AES / ECB with PHP mcrypt. The thing is, the key that is being used to encrypt/decrypt ...
2
votes
2answers
101 views

Attackers posting large HTML pages - just spam? or something more sinister?

More and more, lately - I've seen attackers posting complete HTML pages that seem to have nothing malicious - to php pages that aren't even listening to their POST (sometimes, it's a contact form, ...
5
votes
2answers
758 views

Should every output element be filtered, or just those which contain user-editable data? [duplicate]

I'm combing through a legacy app updating SQL to prevent Injections and XSS vulnerabilities. I know to apply PHP's htmlspecialchars() anything that is directly passed to a script and displayed on a ...
1
vote
1answer
84 views

Encrypting sensitive data in a financial form

I'm currently building a B2B E-Commerce site for a client using WordPress. We sell industrial machinery ranging in the upper $100k-$400k price range. My client would like to have their financing form ...
4
votes
2answers
151 views

SQL Injection Modify / Insert Table Values

Is it possible to update a field in a MySQL database or insert a new row using SQL injection in this case: The only protection in the PHP code is mysql_real_escape_string(). The query is ...
3
votes
1answer
127 views

HTTP attack taking down PHP-FPM [closed]

Someone started attacking my site a few minutes ago and its caused PHP-FPM to max out all cores (4) on my vps and NGINX is now serving 502 to all users. I'm seeing a bunch of these requests with tons ...
-2
votes
2answers
57 views

What sort of vulnerability is this?

I am testing one web application build using PHP. I found one vulnerability in which multiple user can log-in using same browser, without destroying others session. What this sort of vulnerabilities ...
2
votes
2answers
53 views

Writing errors to Apache's log file from PHP - are there any pitfalls?

I'm updating an application to write slightly more verbose errors to the system log file (in this case, /var/log/apache2/mysite_error_log). I hope that I'm not asking the proverbial stupid question ...
1
vote
1answer
69 views

What is the difference between OWASP PHPSEC and PHP-ESAPI?

On the surface it looks like both libraries are designed to preform the same functionality with similar "drop-in" capabilities. Are there differences that I need to take into account when making a ...
1
vote
1answer
44 views

How much access to the file system does the recent Drupal vulnerability give?

A friends drupal site was hacked. What is strange is that the root directory of the installation at the hosting company (let us call it rootdir) was copied (or renamed) rootdir_hacked and the ...
1
vote
1answer
162 views

Is there a secure way to share sessions in the same server with different sub domains?

I'm studing a case that I have a RESTful backend (php-based) and a hybrid HTML+JS+PHP front-end in different subdomains: backend.example.com <-- A RESTful API to provide some XHR requests. ...
0
votes
1answer
102 views

Posssible hack on site?

I found a strange file on one of my servers containing the code below. The file was last modified one week ago at 1.40AM in the night, which is a bit odd. I have done lots of changes on this site ...
0
votes
3answers
979 views

Does this simple function add something to prepared statements?

I've been researching how to completely prevent against SQL injection, but there are so many different forms of injecting that completely preventing it looks impossible to me. I am using prepared ...
1
vote
1answer
53 views

PHP would this be risky (using hackable data for includes)

mysql_select_db($db.'_'.$table); include("/home/site/includes/".$type."/functions.php"); Would this be a bad idea if $table and $type are values passed via ajax from a JS script? And this.. ...
1
vote
4answers
162 views

How to exploit this include_once vulnerability in PHP?

I'm performing static analisys on a PHP code and came across with this situation: include_once SYSTEM_PATH . 'languages/content-' . $_COOKIE ['lang'] . '.php'; If I try to hack with this HTTP ...
1
vote
1answer
64 views

Can the following function be somehow exploited/used for malicious behaviour?

I am using a main Site Engine class which is constructing most of my pages. I'm using this language function to change language website for all of my pages in the start of the Site Engine class: ...
1
vote
3answers
78 views

Make all form inputs safe but allow any type of input including code

Pastebin allow you to (along with plenty of other sites) input code into there forms. I know that this can be a huge security threat if not done properly so I would like to know how they go about ...
3
votes
4answers
111 views

Lock a website login to a certain computer

I've got a web based system where a specific site only shall be available on a certain computer. On that computer I have a desktop application. The desktop application and the website communicate ...
0
votes
1answer
33 views

owasp esapi php implementation for xss attacks

I searched extensively for good materials for prevention of xss attacks using OWASP ESAPI. But could not find any beginner material. I found a blog for basic security but not explicitly for XSS ...
1
vote
1answer
290 views

Why add “***” in user-agent in this malicious code?

I found the following in every index file of my sites on a server I have. It looks like its redirecting all android users to some spooky Russian site. $ua = $_SERVER['HTTP_USER_AGENT']; ...
4
votes
1answer
1k views

Is this a backdoor?

I found the code below on my customers site. It looks like a typical backdoor hidden with hexadecimal, but I'm not 100% sure. <?php if(!isset($GLOBALS["\x61\156\x75\156\x61"])) { ...
0
votes
1answer
106 views

PHP sprintf vulnerability?

On some sites such as WriteCodeOnline, sprintf, vsprintf and other related formatted string functions are disabled for security reasons: Warning: vsprintf() has been disabled for security reasons ...