Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

1
vote
3answers
71 views

Would this generated CSRF token be considered cryptographically strong?

I am working on enhancing the security of an existing web application which currently has not implemented the use of anti-CSRF tokens, so it is up to me to generate one, add the hidden fields and ...
-1
votes
0answers
27 views

how to create a secure session in php with cookies [on hold]

I am new to php I am familiar with creating basic level sessions in php using \\TO START A SESSION session_start(); $_SESSSION['VARIABLE]='VARIAK'; \\TO DESTROY session_destroy(); I want to know ...
-1
votes
1answer
48 views

my table is dropped in PDO [on hold]

This is my PDO method i used this method to save input value to SQL After reading this pdo-prepared-statements-sufficient-to-prevent-sql-injection Since Am started learning PHP i don't know this ...
0
votes
1answer
67 views

Is SQL Injection possible in this PHP registration script? [on hold]

I've recently created a PHP registration script for a website that a friend and I are working on. I've read up on the dangers of MySQL injection, and I was wondering if my current code is protected ...
0
votes
0answers
30 views

How can I use parameterized PHP PDO to drop a MySQL event? [migrated]

public function dMySQLEvent($my_env, $my_event_name) { $my_success = 0; $my_message = ''; try { # declare & set variables using $my_env list ...
1
vote
1answer
50 views

Hydra from Kali Linux + Tamper http post form syntax of the failure login attempt

I had asked this question in the general forum I think it is more adequate to place it here. ...
-1
votes
1answer
73 views

Which PHP encryption method is most incidentally-secure?

just started researching on the latest PHP encryption methods, I've found out my favorite algorithms are compromised. MD5 is no good, SHA-1 has "found flaws", SHA-512 isn't "meant for passwords", ...
0
votes
2answers
37 views

Calling string functions safely

I wish to implement some user callable functions in my code. I use something like this: function funcTest(){ echo "This is test function"; } if (isset($_GET['cmd'])) { $func = ...
0
votes
1answer
108 views

Good password hashing algorithm compatible with PHP and Linux apps

I'm looking for a password hash method for a new server system. The hashes must be generated from PHP code and verified from PHP as well as by a number of applications on a Linux system. I know that ...
0
votes
1answer
42 views

PHP: Save e-mail address hashed or plain [duplicate]

I've been wondering about something, is it more secure to store an encrypted (hashed with password_hash) email address in the database, or just as plain text? I've google'd this matter and saw that ...
3
votes
1answer
57 views

Security concerns about purchased PHP script (web app)

I have been thinking about buying a ready-made PHP script (i.e. a web application) that provides a specific functionality. Say, for example one of these sold by Agriya: http://www.agriya.com/products ...
5
votes
3answers
136 views

prevent session hijacking in PHP

I wrote the log In/log Out scripts of my web page and when the user logs in I store in the $_SESSION variable the user agent. Now each time a page is loaded I check if the user is logged in or not and ...
0
votes
1answer
44 views

Use password_hash() with a system-wide salt and a user-specific salt

This is somewhat a followup to "About password_hash() in PHP and storing (part of) its salt outside DB". Is there a way or any advantage to have a system-wide salt and a user-specific salt vs just a ...
0
votes
0answers
23 views

Sessions in php, how to handle log ins [migrated]

I am getting confused about how the $_SESSION variable should be used. So far I learned it is used to store temporary data for example if a user logs in I can set some session variables to be able to ...
1
vote
0answers
35 views

Is this PHP TOTP (time based one time password) idea sound?

Disclaimer: I am not very familiar with safety techniques in general. The problem: Quickly create lots of small files in server from a bash script. I used to use scp (secure copy) in order to create ...
1
vote
1answer
106 views

PHP unserialize() object injection

So I came across with this authentication bypass security notice and the fix for it was just simply changing all serialization to json encoding. I am just wondering how this really is exploitable? ...
0
votes
2answers
96 views

How CryptoPHP: Sneaky malware works?

This malware is hidden in pirated themes and plug-ins for CMS . the ‘social.png’ file confirmed we had found the backdoor; as it contained a big blob of obfuscated PHP code . My question is how ...
3
votes
2answers
91 views

Passing session id in query string to maintain state in third party iframe - good practice?

I would like to allow the user to be "logged in" and maintain state / logged in status between pages within an iframe. The iframe content is ours, and will be hosted on various clients' websites. ...
-1
votes
1answer
73 views

php execution possibility in img src

I am creating a simple application. There is an option to download a generated image. For that, my PHP code is: <?php if (isset($_GET['img_name'])){ ?> <html> <img src="<?php echo ...
0
votes
1answer
56 views

question regarding php upload form security

I read here http://blog.insicdesigns.com/2009/01/secure-file-upload-in-php-web-applications/ and question is related with text near However, if the attacker is able to upload files, even outside ...
5
votes
7answers
3k views

Techniques to make a login page safe without using SSL

I am developing a web page where people can write and comment things (no personal informations required) and I need to put a log in form so users can see all their actions on my web page. My idea is ...
4
votes
3answers
1k views

Is this PHP code XSS proof?

Is the following PHP code XSS proof? <?php $site = $_GET["url"]; echo "<a href='".str_replace(array("\"", "'", "javascript:", "vbscript:"), array("%22", "%27", "", ""), ...
2
votes
1answer
137 views

Evil PHP code I need help analyzing

I found on my server something like this at the beginning of my php files: <?php ...
0
votes
1answer
74 views

How does this wordpress XSS work?

There is a new Wordpress exploit in wp-includes/formatting.php $textarr = preg_split('/(<.*>|\[.*\])/Us', $text, -1, PREG_SPLIT_DELIM_CAPTURE); General problem here is that they try to parse ...
-3
votes
1answer
35 views

PHP get_file_contents & curl [closed]

These two are the functions can capture remote address, for example this is a social network site example.com/user?privacyemail.php, this site is containing email of user or some kind of private info, ...
0
votes
1answer
101 views

Why does this CSRF vulnerability work?

Recently Laravel 4 was updated to address a security concern: there was a CSRF vulnerability in their code. Here's the old code: if (Session::token() != Input::get('_token')) { throw new ...
0
votes
0answers
87 views

Active Directory Injection attack

Is there a possible way of injecting code to pull data from Active directory? I have written a PHP page that executes Powershell and is able to change passwords to a controlled group of people. ...
0
votes
1answer
57 views

With SSL: not saving sessions, cookies not being sent

My purpose is to have a fully SSL site. The web host gave this format of URL for my shared server SSL: https://hostaddress.net/example/ where www.example.com is the domain name. I conducted the ...
-4
votes
2answers
94 views

What is the best exploit of XSS within 100 characters? [closed]

I found a vulnerable php script on my website. The script allows an user input (textarea), which is not encoded by htmlspecialchars(). Therefore it is possible to add html and javascript code. The ...
1
vote
1answer
51 views

Do PHP/SQLI Prepared Statements Need Special Character Escaping?

I'm using php/mysqli queries such as this: $stmt = $con -> prepare("INSERT INTO `comments` (`uid`, `article_id`, `status`, `comment`) VALUES (?, ?, ?, ?)"); $stmt -> bind_param('iiis', $uid, ...
2
votes
1answer
153 views

Is it possible to exploit a file upload with whitelist and filename hashing?

I have a small web application. Because it is necessary to upload some files I check the file extensions with a whitelist (tgz, jpg, png, pdf, zip, rar, txt, gif, py, c, rb). In addition to that, I ...
2
votes
3answers
111 views

Can password_verify() be used to identify password after database breach?

I am a newbie to PHP and password hashing. I am following the instructions provided here to hash my user password before storing. My questions are: PHP recommends password_hash() method as a ...
2
votes
1answer
68 views

Why protect files with sensative information with .htacces?

I was taught that an important step to securing a website (primarily with PHP) was to store all sensitive information such as database connection info, salt generation, etc. in a separate ...
0
votes
2answers
180 views

PHP - Need help to understand injected code

I discovered a lot of requests to a fishy file in a plugin on my Wordpress site. There, I found a long string, a mapping function for each character used in the string, and an excecution of the ...
0
votes
1answer
159 views

AES 128bit decryption using a key longer than 16 bytes

I got a little problem regarding AES decryption. I have to decrypt some text that has been encrypted using 128bit AES / ECB with PHP mcrypt. The thing is, the key that is being used to encrypt/decrypt ...
2
votes
2answers
101 views

Attackers posting large HTML pages - just spam? or something more sinister?

More and more, lately - I've seen attackers posting complete HTML pages that seem to have nothing malicious - to php pages that aren't even listening to their POST (sometimes, it's a contact form, ...
5
votes
2answers
758 views

Should every output element be filtered, or just those which contain user-editable data? [duplicate]

I'm combing through a legacy app updating SQL to prevent Injections and XSS vulnerabilities. I know to apply PHP's htmlspecialchars() anything that is directly passed to a script and displayed on a ...
1
vote
1answer
84 views

Encrypting sensitive data in a financial form

I'm currently building a B2B E-Commerce site for a client using WordPress. We sell industrial machinery ranging in the upper $100k-$400k price range. My client would like to have their financing form ...
4
votes
2answers
166 views

SQL Injection Modify / Insert Table Values

Is it possible to update a field in a MySQL database or insert a new row using SQL injection in this case: The only protection in the PHP code is mysql_real_escape_string(). The query is ...
3
votes
1answer
132 views

HTTP attack taking down PHP-FPM [closed]

Someone started attacking my site a few minutes ago and its caused PHP-FPM to max out all cores (4) on my vps and NGINX is now serving 502 to all users. I'm seeing a bunch of these requests with tons ...
-2
votes
2answers
57 views

What sort of vulnerability is this?

I am testing one web application build using PHP. I found one vulnerability in which multiple user can log-in using same browser, without destroying others session. What this sort of vulnerabilities ...
2
votes
2answers
55 views

Writing errors to Apache's log file from PHP - are there any pitfalls?

I'm updating an application to write slightly more verbose errors to the system log file (in this case, /var/log/apache2/mysite_error_log). I hope that I'm not asking the proverbial stupid question ...
1
vote
1answer
71 views

What is the difference between OWASP PHPSEC and PHP-ESAPI?

On the surface it looks like both libraries are designed to preform the same functionality with similar "drop-in" capabilities. Are there differences that I need to take into account when making a ...
1
vote
1answer
44 views

How much access to the file system does the recent Drupal vulnerability give?

A friends drupal site was hacked. What is strange is that the root directory of the installation at the hosting company (let us call it rootdir) was copied (or renamed) rootdir_hacked and the ...
1
vote
1answer
176 views

Is there a secure way to share sessions in the same server with different sub domains?

I'm studing a case that I have a RESTful backend (php-based) and a hybrid HTML+JS+PHP front-end in different subdomains: backend.example.com <-- A RESTful API to provide some XHR requests. ...
0
votes
1answer
107 views

Posssible hack on site?

I found a strange file on one of my servers containing the code below. The file was last modified one week ago at 1.40AM in the night, which is a bit odd. I have done lots of changes on this site ...
0
votes
3answers
982 views

Does this simple function add something to prepared statements?

I've been researching how to completely prevent against SQL injection, but there are so many different forms of injecting that completely preventing it looks impossible to me. I am using prepared ...
1
vote
1answer
53 views

PHP would this be risky (using hackable data for includes)

mysql_select_db($db.'_'.$table); include("/home/site/includes/".$type."/functions.php"); Would this be a bad idea if $table and $type are values passed via ajax from a JS script? And this.. ...
1
vote
4answers
167 views

How to exploit this include_once vulnerability in PHP?

I'm performing static analisys on a PHP code and came across with this situation: include_once SYSTEM_PATH . 'languages/content-' . $_COOKIE ['lang'] . '.php'; If I try to hack with this HTTP ...
1
vote
1answer
64 views

Can the following function be somehow exploited/used for malicious behaviour?

I am using a main Site Engine class which is constructing most of my pages. I'm using this language function to change language website for all of my pages in the start of the Site Engine class: ...