Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

6
votes
2answers
3k views

php.ini security setting after attack

My website have been attacked and I need a best practice for a php.ini I have done some reading but I am still not sure if I covered most of the options. here is my settings: file_uploads = Off ...
1
vote
1answer
282 views

Information on the phpMyAdmin probe?

Various IP addresses call various domains looking for various paths that might lead to PHP My Admin/scripts/setup.php One of those IP addresses is 74.63.212.48 which I just now found out I could ...
4
votes
2answers
2k views

How to find and protect against the exploited vulnerability in a PHP application based on the logged URL?

I have been attacked on a shared host server and they said I should configure my own php.ini file properly. I have a little PHP/MySQL program with a registering function, a little admin site. ...
11
votes
5answers
8k views

How safe is it to install XAMPP on my home computer to test PHP code?

I want to test some PHP code and I figure the best way is to install XAMPP - but I'm nervous about installing server software on my home computer. Is it generally safe to install XAMPP (given that I ...
4
votes
2answers
2k views

Are PHP Sessions based on cookies or a cookie-IP pair?

I have a PHP website and my question is: If someone manages to steal my users' cookies via an XSS attack, is it enough for him to be identified as the user? Or does his IP also have to be the same as ...
3
votes
2answers
1k views

Is this algorithm for a random string cryptographically secure?

I've pieced together this algorithm (if it can be called that) from various bits of code I've seen online, and I'm wondering how cryptographically secure it is. It's used to generate passwords: ...
4
votes
1answer
840 views

Which encryption algo should be best for an Android application [duplicate]

Possible Duplicate: Which type of encryption algorithms android supports, and which would be better? I am confused about to use of DES. Triple DES, RSA and AES algorithms, I think I ...
4
votes
2answers
5k views

Can DES-based hashed password be recovered if salt is known?

Can a hashed password be recovered if the hashing is done with DES based crypt function in PHP and both the hash and salt are known by the attacker? Consider the following example: $salt = 'mysalt'; ...
1
vote
2answers
199 views

TCrypto - Comments about design decisions I made?

I have pushed some code to GitHub to demonstrate the usage of symmetric key encryption in PHP. It is a small key-value storage library and it (optionally) offers ability to encrypt the stored ...
4
votes
3answers
489 views

How do I protect myself against the attacks in this php script?

Due to a vulnerability in how PHP was installed (Shared VPS with PHP installed as an Apache module instead of CGI) and hence how OSCommerce was configured (with security of 777 on certain ...
3
votes
2answers
944 views

list of web session attacks and counter measures

I'm writing a new website with php and I will be using cookies to track user session data. Before I finalise the design I want to make sure that the site is not vulnerable to attacks. I have written a ...
9
votes
2answers
1k views

Securing my web-server / website [closed]

Does anyone know of a comprehensive security guide about important basics / fundamentals which should be done to secure a web-server / website? A web link would do.
10
votes
1answer
432 views

Public XSLT & XML playground (with PHP DOMDocument, etc.) Security Risks?

Let's say I want to set up a sandbox or playground in PHP that users can use to create (or paste in) XML and XSLT, then transform the XML via the XSLT (by means of PHP 5's DOMDocument and related ...
4
votes
2answers
481 views

Attack vectors in POSTing variables from one php script to the next?

I have an application which is structured in the following way for its signup page. After this signup, the user is directly granted access into the system - there is no email verification (as ...
5
votes
6answers
1k views

How to defend vs. Image Remote File Inclusion, e.g. RFI using a .gif file (Apache/PHP)?

To defend versus Remote File Inclusion where attackers try to abuse image files, I usually recommend to never use include to include image files into PHP code. Sometimes though, the avoidance of ...
1
vote
2answers
1k views

Thoughts on Tiny Encryption Algorithm (TEA, anyone)?

I'm planning to implement Tiny Encryption Algorithm and exchange data between two PHP sites. Specifically, using the code presented at PHP-einfach.de Does anyone have any experiences / thoughts / ...
12
votes
4answers
589 views

what to do after suspected intrusion on hobby webserver

I maintain a server to host my files and a number of websites for hobbies and friends. I just noticed that the site summary being returned in google for one of my domains were all porn related ...
5
votes
3answers
7k views

Testing PHP form injection

I'm writing a very small PHP app that takes input via a form. As could be expected for a first revision, the code does no escaping or sanitisation of input: if( $_POST["var"] != "" ) { print ...
13
votes
2answers
3k views

How to do Ajax securely?

This question is inspired by this security question http://security.stackexchange.com/questions/1707 What are the threats in using Ajax? (Please note I am talking about security threats, not ...
1
vote
1answer
345 views

Is this enough to tackle script / malicious code insertion in GET, POST requests?

I've got legacy PHP code which attempts to prevent script / SQL injection with the following: if (!empty($_POST)) { reset($_POST); while (list($k,$v)=each($_POST)) { ...
18
votes
4answers
13k views

How to hijack a session?

Despite the blatant title of the question, this is actually for a genuine purpose. My site uses PHP code like this: $select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'"; ...
3
votes
3answers
1k views

Altering a $_SESSION variable in PHP via XSS?

Not sure if what I'm saying makes sense... but is it possible for me to alter a $_SESSION variable from outside the target PHP script? One of our scripts uses a $_SESSION variable and I'm not sure if ...
7
votes
4answers
807 views

Security attacks on PHP web applications

I know about following security attacks on php applications (html,php,js). XSS SQL Injection CSFR Session Hijacking /Fixation Code Injection Remote file injection Should i know about any other or ...
5
votes
1answer
520 views

Good Security tool for PHP- Suhosin vs Spike vs PHPIDS

Do I have to check/test my code beforehand, or do these tools inform me when an attempt is being made in real time? Secondly, which one should I go for -- Suhosin or Spike or PHPIDS or a combo? What ...
6
votes
8answers
681 views

What is the vulnerability in my PHP code?

A website of mine was recently hacked. Although the actual website remain unchanged, they were somehow able to use the domain to create a link that re-directed to an ebay phishing scam. I've taken ...
4
votes
1answer
674 views

How to prevent CSRF if you want to include Flash plugins in your form like Uploadify in your form?

What is CSRF? I need a basic definition that is not just lifted from Wikipedia. I understand SQL injection, XSS, cookie poisoning, but I just cannot wrap my mind around this. I am using a ...
6
votes
1answer
317 views

how to configure edit-restricted mediawiki

I am planning to setup a public wiki using mediawiki, but I never used mediawiki for a public site before and I am not experienced with it, even as a user. I am planning to create a very restricted ...
10
votes
2answers
3k views

How to address XSS security issues in FCKeditor / CKeditor?

A security report we conducted through an outside company reported XSS vulnerabilities in FCKeditor which we're using in our PHP application. They pointed out that accessing URLs such as: ...
13
votes
6answers
7k views

Disable insecure/dangerous PHP functions

Typically my job description limits me to code-review of web applications. More recently I've been asked to assist with some server-side PHP optimization where, although I am familiar with it, I lack ...
6
votes
2answers
707 views

GET with additional parameters leads to “code injection” in html displayed

We got a security review done of our PHP code and the security company sent this in their report: Request GET ...
10
votes
6answers
3k views

Security review: “HTTP header user-agent has been set to (something)”

We got a security review done of our PHP code and they team advised this in their report (amongst other things): /appdir/ Details The HTTP header user-agent has been set to \" . Request GET ...
7
votes
3answers
1k views

PHP mail() Header Injection Prevention

This site nicely explains the problem. Essentially, nearly all php mail() examples that are given are vulnerable to header injection attacks. The referenced site gives a regex sanitation solution ...
8
votes
5answers
915 views

Scripting a search through php files for dangerous calls for manual review

I'm automating a script which searches through all php files on a big site for dangerous commands. The files which are found will be manually code reviewed. Does anyone have any recommendations for ...
7
votes
3answers
544 views

Finding security consultant for doing in-depth code review?

We have a PHP application that we know has poor coding practices (because the developers did not have a good understanding of PHP / programming fundamentals). This could lead to the scenario where we ...
15
votes
3answers
672 views

Getting a manual security code review done - What to watch out for?

We have a PHP application that we want to get code reviewed from an external security consultant, but I'm not clear on "how to" go about that process. We did specify what kind of tests he should be ...
12
votes
6answers
3k views

Why do people say that PHP is inherently insecure?

I've heard it said that PHP is inherently insecure. Is this true? Why?
20
votes
3answers
6k views

What are the best practices for hardening a php.ini file?

In order to secure a PHP installation, what are the best settings for a php.ini file? What is absolutely vital in terms of security? What is recommended for most use cases?
8
votes
4answers
561 views

What information should a error log record?

I want to populate my error log with useful information if and when errors occur. I'd like to use the log to be able to spot and fix bugs on my site, but also to potentially log hack attempts. For a ...
8
votes
3answers
495 views

What security features should be present in every web-based CMS?

What are the most important security features that a web-based CMS should offer? What's vital? What would be nice to have? What features should the CMS not attempt to do? Please note: I'm looking ...
18
votes
3answers
2k views

What steps should be taken to validate user uploaded images within an application?

Recently I have worked on a number of applications that need to process user uploaded images steps have been taken to validate the extension and the mime type. But what else can be done to ensure ...
35
votes
5answers
5k views

How to Securely Implement a “Remember Me” Feature?

Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period ...
20
votes
5answers
2k views

Should I use Suhosin for PHP?

Suhosin can be used to increase the security of your php application. I can really see the use of it when you are using shared hosts, with multiple (possibly evil) people running their PHP apps ...
31
votes
5answers
4k views

How to perform a security audit for a PHP application?

I have a PHP application that I would like to have audited for security. I'm familiar with most of the general security issues, but want to make sure I didn't miss anything. What steps should I take ...