Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

29
votes
3answers
1k views

Why do WordPress installations retrieve the crypto secrets remotely on installation?

It seems that WordPress retrieves all the crypto constants remotely (via HTTPS): // setup-config.php $secret_keys = wp_remote_get( 'https://api.wordpress.org/secret-key/1.1/salt/' ); Are there ...
0
votes
3answers
58 views

How secure is my method?

I want to select data from a MySql database on an iphone device. The method I seem is the easiest one is to connect to a php file with GET arguments and then return it as a string. Now I'm just ...
8
votes
3answers
1k views

Allowing users to input a safe subset of HTML

I recently posted this question on Code Review and it was recommended that I ask you guys about it. Basically, this will be used to allow users to generate formatted content. It gets put inside of ...
1
vote
1answer
85 views

System that manages real money

I am working on a project that incorporates real money into peoples accounts. Their accounts are stored in a MySQL database and inside it there is a column called "BALANCE". When the users send money ...
-1
votes
2answers
139 views

If md5 is only insecure because of its speed, why doesn't this workaround make it reasonably secure?

I'm going to preface this by saying I have absolutely no clue when it comes to cryptography, but I'm posting this question because I'm very interested and I have no doubt there are some smart people ...
1
vote
5answers
1k views

Encrypt-function inside PHP code that you have to publish

If you write a PHP application, where you have to deliver the compiled code to the customer, how could you include a functionality to send encrypted data from that application to others, and include ...
1
vote
2answers
639 views

Implementing SRP Challenge login system *with SSL* (Using PHP)

My question: Anyone knows how to implement SRP / Diffie-Hellman authentication in PHP (or if this has already been done)? (Some details) I'm using CodeIgniter with TankAuth (both latest version) ...
-1
votes
2answers
61 views

LAMP Stack Tiers - why?

What are the vulnerabilities mitigated by a tiered LAMP stack? As I understand it, any breach would allow access to the database even if it was tiered. What's the benefit? Are we better to ...
1
vote
0answers
129 views

'Ghost' access to a php file on a web server

I'm developing a personal project and one part of the project is a php website, hosted at hostinger as a free plan, that allow clients to ping to it and stores the WAN IP and the NAT IP of them. ...
0
votes
0answers
113 views

Starting database security for web app that logs in with Facebook/Google JS SDKs

I have been making a web app that uses Facebook and Google JavaScript APIs to login (no email login) on the client side and currently it accesses a MySQL database directly using PHP and MySQLi, but I ...
1
vote
1answer
109 views

Path Truncation not working in PHP while exploiting LFI

From what I understand in PHP '/etc/passwd/' or '/etc/passwd/./././' should be treated just the same as '/etc/passwd' I am using PHP 5.4 and this does not seem to be true: php -r ...
6
votes
2answers
501 views

Modern, security-conscious, PHP book?

I posted this on StackOverflow and they redirected me here. Sorry if this isn't the correct area! After creating a simple login system and trying to protect it against things like SQL injection, ...
0
votes
0answers
30 views

Directory names using extensions a security risk?

In our app (PHP, MySQL) we allow users to create templates which are stored in their own subdirectory (which is named by the template name). Someone suggested to use standard file name sanitization ...
1
vote
4answers
175 views

How to detect credit cards harvested from memory?

Had a chat recently with PCI compliance specialist and got to realize there is a way to steal raw data from Apache / Nginx memory e.g. credit cards. It's called "harvesting" and becomes pretty common. ...
0
votes
2answers
93 views

How secure would this method be considered for password storage

Ok I am currently storing the passwords in most secure way I could think of. With use of Encryption and Hash. The passwords are first generated by user as plain-text with minimum length of 6 ...
3
votes
3answers
215 views

PHP IP check as security?

Would just like some input on a PHP script I'm writing. It's just a simple script that only myself should be able to access. I don't have a dynamic IP address, so this isn't an issue for me, but I'm ...
-1
votes
1answer
56 views

BigDump v0.35b vulnerability [closed]

I dont understand what the problem with BigDump v0.35b. This site says that it have problem. But i dont understand it. Problem here? if (!$error && isset($_REQUEST["uploadbutton"])) { if ...
2
votes
2answers
239 views

How could attackers exploit $_SERVER['HTTP_REFERER']

I've been warned that PHP's $_SERVER['HTTP_REFERER'] is a common attack vector for websites. What are ways that attackers exploit this function? How can I guard against them?
2
votes
1answer
102 views

Configuration settings for sessions in php

I recently found the following configuration settings: use-strict-mode hash-bits-per-character hash-function and I have some questions about them: Use-strict-mode says the following: ...
12
votes
5answers
1k views

Is there a way to check the filetype of a file uploaded using PHP?

I don't want it to just check the extension of the file as these can easily be forged even MIME types can be forged using tools like TamperData. So is there a better way to check file types in PHP ? ...
7
votes
3answers
713 views

What would the potential abuses be for an HTTP API that accepted raw SQL?

I was wondering what some of the potential abuses could be for an HTTP API that accepted SQL queries and output results sets. The fact that this is the canonical definition of SQL injection is not ...
1
vote
3answers
106 views

Is this a secure function for checking if a user has not stolen a session cookie?

As an exercise for class, I'm creating a class that manages user sessions. The session details are stored in a database and also there is a $_SESSION[user_id] variable to carry in between pages. The ...
0
votes
0answers
29 views

trackback spotted in multple http errors

[Sun May 11 12:24:46 2014] [error] [client private ip] [X_FORWARDED_FOR 27.159.207.165] Path not found: /contact_us_public.php/trackback/, referer: http://www.mydomain.net/contact_us_public.php Does ...
0
votes
2answers
138 views

Are PHAR archives secure?

I want to send the new releases of my application in encrypted, signed archives to the server. Are PHAR archives a good solution to do that? Is PHAR secure enough?
1
vote
1answer
93 views

Is it possible to add backdoor to a file with the same size and crc32 checksum (4bytes)?

Is it possible to add backdoor to a file with the same size and crc32 checksum (4bytes)? (The file does not contain byte code, it contains program code as text. The language is PHP.)
7
votes
2answers
190 views

Are my session settings secure enough?

I'm developing a file hosting and sharing web application. Are the following PHP session settings secure enough? ini_set('session.cookie_httponly', 1); ini_set('session.cookie_lifetime', 0); ...
9
votes
6answers
4k views

Why is php not used for banking sites or for a banking transaction?

Other programming languages popular on the web, such as Java and .NET, are used for banking sites. However, I've rarely (if ever) seen a PHP application designed to be deployed for a banking site. ...
0
votes
1answer
207 views

Php Session ID, http VS https [duplicate]

So I was doing some tests with the php session ID cookie. I know that data is stored on the server however, a cookie with a unique ID is stored so that the server can recognize the client while ...
10
votes
3answers
434 views

How to deobfuscate this PHP malware?

Two days ago a file called "images.php" appeared on a friend's server, which he noticed because it caused errors. The file contained the following. This code is of unknown origin and presumed to be ...
0
votes
1answer
82 views

Email Spoofing Modified Headers

I have be reading more and more about email spoofing and was curious how some things are done. I know in PHP you can simply do mail() and then include "From: spoofsender@provider.com" for example, ...
6
votes
1answer
144 views

How important is a mysql password for localhost?

We can assume that if an attacker gained access to a web server running mysql that they would be capable of reading the scripts to determine the mysql password. If mysql only responds on localhost, ...
19
votes
4answers
6k views

How did Anonymous use UTF-16 ASCII to fool PHP escaping?

A few months ago, Anonymous took down a child pornography site using SQL-injection. I read in this article that Anonymous claimed that "the server was using hardened PHP with escaping," but they were ...
5
votes
3answers
999 views

How to access directories disallowed in robots.txt?

While scanning my website with uniscan it found my robots.txt file which disallows access to /cgi-bin/ and other directories, but they are not accessible in browser. Is there a way to access the ...
0
votes
1answer
74 views

Dangers of PHP uploading word docs into a quarantine

I plan to write a PHP script which will allow web users to upload MS Word formatted docs. Here are the precautions I am taking: Filenames will be created by me (something like YYYY-MM-DD.doc) Files ...
2
votes
1answer
1k views

Authenticating Users from Android with PHP Webservice

I'm creating a simple Android application which requires reading and writing values to the cloud. I intent to use PHP for the webservice. But I'm a little confused over the authentication scheme. I ...
0
votes
3answers
2k views

How to filter POST requests before they reach PHP on Apache?

I have done URL filtering with .htaccess (using learning and generator), however I am still concerned that any POST request can be submitted to the PHP even there is only one POST form on the website, ...
34
votes
6answers
4k views

PHP files browsable: is this a vulnerability?

I have a friend who has a website developed in PHP on which we can browse all his files one after one (of course, we can not read the content of the PHP files). Do you think this is a security hole ? ...
3
votes
3answers
192 views

Is web app safe in not public folder?

I'am wondering if it's really safe to use this structure of my web application. WEBAPP Application Controllers Models Views ... Framework ... ...
5
votes
3answers
3k views

Does mysql_escape_string have any security vulnerabilities if all tables using Latin1 encoding?

I have heard that the PHP function mysql_escape_string has security vulnerabilities related to mult-byte characters. Are there any vulnerabilities if all tables are using Latin1 encoding?
30
votes
6answers
3k views

Should I obscure database primary keys (IDs) in application front end?

I'm working on an application which allows a moderator to edit information of user. So, at the moment, I have URL's like http://www.example.com/user/1/edit http://www.example.com/user/2/edit I'm a ...
4
votes
2answers
612 views

Does bcrypt compare the hashes in “length-constant” time?

I saw this function slowEquals() while reading Salted Password Hashing - Doing it Right, which uses a byte-level xor comparison to avoid timing attacks. I was wondering whether this is what Bcrypt ...
1
vote
2answers
242 views

Sql injection is not working on my site?

I have set up a page and database so I can practice SQL injection. Ive tried some examples and it doesn't seem to work. It seems to add the username and password to that database, even though I input ...
3
votes
2answers
96 views

How can you detect an insecure, non-random token?

I know that some of PHP's random functions are insecure due to them not being completely random and are considered a bad practice. My question is how an attacker go about finding that the developer ...
7
votes
1answer
1k views

Does Heartbleed affect servers if OpenSSL was only used to generate the certificate?

I built an application that generates certificate signing requests (CSRs) using the PHP OpenSSL module. Is there a way that the HeartBleed bug can affect these (in use) private keys and CSRs that ...
3
votes
2answers
792 views

How do crackers upload php scripts to Wordpress' wp-content directory?

I've seen a site that has been attacked by uploading php scripts (presumably some sort of shell, or code that loads a shell) to Wordpress' wp-content/uploads directory. Usually this directory is used ...
2
votes
4answers
2k views

SQL Injection with pass MD5

I want to know, if in my login form there is any SQL injection possible. If there is, what could the exploit's web form entry look like? I send username and password by html form (POST). The login ...
8
votes
3answers
11k views

Is there any SQL injection for this PHP login example?

I want to write a login form, and I got one example from the web. I want to know, if there is any SQL injection for this code? If there is, what could the exploit's web form entry look like? This is ...
1
vote
1answer
91 views

PHP and max_input_vars configuration

I am looking into php's max_input_vars setting How many input variables may be accepted (limit is applied to $_GET, $_POST and $_COOKIE superglobal separately). Use of this directive mitigates ...
3
votes
1answer
267 views

Do PHP frameworks such as Zend, symfony and CakePHP provide default protection against cross site scripting?

ASP.NET MVC provides default protection against cross site scripting. Just wondering, if PHP frameworks do the same?
0
votes
2answers
120 views

Protecting the remote database against tampering in a mobile app

This is the first time I face a mobile app deployment at big scale. This app needs to connect to a remote server where to store and retrieve data. I discarded connecting directly to the MySQL ...