Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

6
votes
2answers
2k views

Secure PHP upload form & storage

I am building a PHP application that allows uploads of files (.doc/pdf etc) for review by a staff member. Some of these files will be somewhat confidential so I need to protect them. Now the best ...
0
votes
2answers
331 views

CMS security issues

I have a desire to make my own CMS , to improve my programming skills. I would use PHP as a server side programming language. So my question is, on what security issues I must pay attention when ...
0
votes
3answers
185 views

Maintain sensitive key between requests

EDIT: Reworked question. Previous version too poorly asked. On my website users write sensitive messages that must be kept secret. The entire user area is over SSL, so the communication between user ...
6
votes
5answers
22k views

Playing with Referrer Header

There are 2 sites: http://www.site1.com http://www.site2.com http://www.site1.com contains link to http://www.site2.com as <a href="http://www.site2.com/">link<a/> When user clicks ...
3
votes
2answers
372 views

In this example why do they hash a randomly generated piece of salt before hashing it with the password?

From here, in the code return substr(sha1(mt_rand()),0,22); what is the point of taking the sha1 value? It is appended to the password and together they are hashed using Blowfish. Why not just append ...
2
votes
3answers
484 views

Client is not storing Credit Cards Securily (near plain text). How do I convince client to be more secure?

I am writing in regards to PCI-DSS compliance for taking credit cards. A client of mine is not willing / does not want to bump up security beyond what is currently done for their credit card data. All ...
1
vote
6answers
8k views

Use PHP to check uploaded image file for malware?

I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k. Is there any way for me to check uploaded ...
4
votes
2answers
1k views

What exploit types do I need to protect against in PHP?

I recently learned that apparently, it is common for people to attempt SQL injections using the HTTP referrer in PHP. What other inputs do I need to protect against? I am currently "cleaning up" ...
0
votes
2answers
196 views

Is this code vulnerable?

I have developed a php code given below. I would like to know what are the security vulnerabilities present within this php code? <?php if(isset($_SESSION['id'])){ // get data ...
5
votes
2answers
3k views

Strongest cryptographic algorithm available in PHP 5.3

Which options are available in the default installation and which ones by third-parties like extensions or frameworks? P.S. By Cryptography I mean algorithms which could be decrypted, not one-way ...
1
vote
1answer
158 views

Client vs Server security for business critical application (crossplatform)

We have the option to develop a software either based on Java (but then it is only available for desktop clients using Java SE and can run maybe also as tomcat app can be multithreaded, stable, ...
4
votes
2answers
4k views

Should I use urandom() or openssl_random_pseudo_bytes()?

I am developing a site in PHP 5.4. Which function is better to use to generate a random salt for password security? $salt = sha1(openssl_random_pseudo_bytes(23)); or $seed = ''; $a = ...
2
votes
1answer
241 views

unix malicious scripts/ksh execution

I'm wondering whether my architecture poses a security risk. Details: The whole website is not ROOT owned but still, the APACHE user used instead has some pretty advanced permissions. I have a ...
4
votes
2answers
1k views

Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password

I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects. I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I ...
0
votes
2answers
348 views

How to restrict web access to certain countries

What are the better ways of filtering access to the web application based on Geographical location. Is it possible with a network layer firewall or we need an application layer?
-1
votes
1answer
1k views

Changing user account passwords from PHP script - vulnerabilities? [closed]

I started a thread a while back asking for suggestions on a good (good=fairly secure) way to allow users to change their account passwords via a PHP script. (WHY? because on this particular server, I ...
7
votes
2answers
1k views

Sending data form registration forms

I understand that sending data from the user to the server, unencrypted, is a bad practice. That is logical. So how do I encrypt 'userside' and send the data to the server in encrypted form? Can ...
2
votes
1answer
225 views

Lamp server sandbox for testing malicious php script

Fortunately despite recently becoming a full time web developer, security is something I take very seriously. There's a developer that I work with who's system was recently compromised with obfuscated ...
5
votes
1answer
414 views

Using sudo to secure git deployment via web script

I'm setting up a server to do automatic deployment from a Bitbucket git repository, using Bitbucket's postback facility. Briefly, how it works it: I commit to Bitbucket Bitbucket POSTs to a ...
3
votes
4answers
458 views

Safari downloaded my php source once. Should I worry?

I uploaded via ftp, then typed in the URL of the script to Safari; Safari downloaded the source!! This hosting site has never done that before - .php scripts have always executed. I can't duplicate ...
8
votes
2answers
519 views

Key management scheme in PHP that is compliant with NIST SP 800-57

We're working on achieving SAQ-D PCI compliance and along the way we're discovering new things each day. Today: Key Management I wonder if there're any open-source or commercial PHP solutions ...
2
votes
5answers
522 views

Does shuffling a hashed password increase its security?

I am making a web app and I'm now stuck on making the login secure. I'm thinking of adding a salt to a user-inputted password and then hash it. (md5 or sha for example) and then I will reshuffle the ...
13
votes
3answers
1k views

How secure is aSSL (javascript)? Does it effectively mimic SSL?

Some of you may be familiar with the aSSL project, which uses AJAX/PHP to mimic the SSL protocol. It uses RSA 512 or 1024 for the keys, and AES for the actual data. It looks impressive to me in ...
6
votes
3answers
4k views

Starting a secure php session

I have been looking into creating secure php sessions for use in a login script for a week or so now. So far I have not found a concrete resource to base my work off, reading StackOverflow all I have ...
3
votes
2answers
3k views

Is it possible to spoof the last proxy of an X-Forwarded-For Header?

I'm using a firefox plugin https://addons.mozilla.org/en-US/firefox/addon/x-forwarded-for-header/ to spoof the X-Forwarded-For Header to 8.8.8.8. For the following php page: echo ...
7
votes
3answers
888 views

How dangerous is it to use CSS styles from an untrusted source?

I'm a moderator at a forum. We want to have a new style for the forum. We're thinking about announcing a competition to the users to come up with the best CSS design; we would adopt the best ...
0
votes
1answer
170 views

Comparison between Data Encryption Tools and Data Sanitization Tools [closed]

What are the famous Data Sanitization Tools for languages such as ASP/PHP/Html Web Sites? Which Data Sanitization tools have the best results? Difference between Data encryption and Data ...
2
votes
1answer
3k views

Stopping Session Hijacking

If you noticed, I put "stopping" instead "preventing" in the title because I want my PHP application to be as secure as possible. I am wondering if anyone has any better ways to prevent session ...
1
vote
1answer
347 views

Protect database resources from fake data inputs via web forms

Scenario: I'm working on a project that needs to accept large amounts of data (customer data) from its users. So it can be normal to have a user trying to add 10,000 or 100,000 records at a time. In ...
15
votes
3answers
17k views

Creating Secure PHP Sessions

I have already created and refined both registration and login systems, However I am lead to believe the tricky part comes when you are creating a session. As far as I know this is due to both ...
0
votes
1answer
220 views

Malicious PHP code can run in cache. Solution?

I have a module that I cache some details (w/c is from the input of the user) to lessen the load of my database The way how I cache is by creating html page with the details of the user using ...
1
vote
1answer
91 views

sigsegv in php5.3.10

I found an overflow situation in php5.3.10. Probably it's not 'something new', but if I can understand this, it will help me to find this kind of bug faster in the future. What can I do to check ...
3
votes
1answer
839 views

Preventing spoofing of remote server with PHP & cURL

I'm writing a PHP script that is requesting confidential data from a remote server. I'm using cURL to get the remote server's certificate information (for its output, please see below). Which array ...
6
votes
2answers
129 views

Security concerns with pre-pay system

I am looking at setting up a pre-pay system for the food retail industry. Retailers will be able to generate random 10 digit codes and supply these to customers to enter into an app to gain the value ...
4
votes
1answer
961 views

172.16.33.197, 127.0.0.1 IP addresses in visitor logs

I have a website running Apache and PHP. I see that there are visitors with IP addresses 172.16.33.197 and 127.0.0.1. These addresses do not belong to our network. I get the visitor IP addresses with ...
0
votes
2answers
1k views

Running Apache as system service on Windows 2003 R2 64-bit

Trying to make my point, that running Apache with PHP5 module as Windows service is not secure. All I got to prove it - FTP access to some internal website. So what I did - I uploaded file test.php ...
0
votes
3answers
882 views

Viewing the configuration.php

My understanding is that you should never host your configuration.php file within the public_html directory (I am specifically referring to Joomla, but I imagine this is a cross-platform scenario). ...
3
votes
3answers
2k views

User data encryption/decryption in a database (PHP)

I was wondering which is the best way to encrypt and decrypt user data in a database, to make it much more secure as it is possible? I was reading about AES but I would like to know if is really the ...
1
vote
2answers
895 views

Implementing SRP Challenge login system *with SSL* (Using PHP)

My question: Anyone knows how to implement SRP / Diffie-Hellman authentication in PHP (or if this has already been done)? (Some details) I'm using CodeIgniter with TankAuth (both latest version) ...
7
votes
1answer
2k views

PHP crypt() trims the salt as it would be too long

I am using Blowfish with PHP crypt() for password hashing but I noticed something weird. Quoting PHP documentation: CRYPT_BLOWFISH - Blowfish hashing with a salt as follows: "$2a$", "$2x$" or ...
2
votes
1answer
346 views

Is it safe to invoke PHP GD functions if you don't know whether file is a valid image?

There is image upload function in web application. After image is uploaded, it's resized using functions from PHP GD like imagecopyresampled and others. Before invocation of PHP GD's functions there ...
1
vote
1answer
230 views

Is it possibel to inject php code to roundcube errors log file via LFI vulnerability? [closed]

i tried to inject php code to roundcube errors log file, with no success. i think there is something filtering injected php code.
6
votes
4answers
1k views

Protecting against CSRF when a form is being submitted via an AJAX call

I'm using anti-CSRF tokens on all my forms to prevent CSRF attacks. Also, the tokens are being saved in the $_COOKIE variable to validate against the value I get from the form. I'm resetting the token ...
8
votes
2answers
4k views

when to use nonce?

I have trouble understanding nonce. I read a very good answer related to nonce by @Thomas Pornin, but it is too complicated for me as I am new to cryptography. From what I know, nonce is used to ...
4
votes
3answers
2k views

optimal way to salt password?

A good way to salt password? I have read a few answers related to salting password. But I started to get confused. I came across few functions people used to generate salt like: mcrypt_create_iv() ...
2
votes
1answer
203 views

Safe User Login Questions

I need help determining how safe the login is. First of all, I have been reading this: The Definitive Guide To Forms based Website Authentication It's really well written, great information most of ...
9
votes
6answers
6k views

Why is php not used for banking sites or for a banking transaction?

Other programming languages popular on the web, such as Java and .NET, are used for banking sites. However, I've rarely (if ever) seen a PHP application designed to be deployed for a banking site. ...
5
votes
4answers
623 views

Is not checking the src url a vulnerability?

By using a system of special tags you can allow users to add custom images, for example, tags like [img]user_url[/img]. Then you replace the tags by their real HTML tags like <img src="user_url" ...
3
votes
1answer
188 views

Malicious php scripts in word press theme folder?

I am running a server on Ubuntu 10.04 running a word press website, and recently a virus scan revealed that I have several malicious scripts sitting in the word press folder. In particular they are in ...
2
votes
2answers
888 views

How to make a simple file integrity checker

I've seen many PHP file checker on the net. Basically they computes the sha hash of a requested file. Your PC queries periodically the script and alerts you if the returned hash changes. The problem ...