Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

3
votes
1answer
166 views

How can I store information securely when I can't use crypt or a hash?

I'm creating an application for Google Glass (technically it's Glassware, but whatever). The user will do the following steps when going through setup for the Glassware: Go to my website, redirected ...
3
votes
3answers
486 views

Tokenless REST API security concerns

I'm designing an API in PHP/MySQL that, by its design, will not store a user's password in the database and thus does not generate authorization tokens for the client to hold. The reason for this is ...
3
votes
1answer
4k views

Where and How is data stored in a session?

Where is the information in the fields of a session stored? If I, for instance, store in a session something like $_SESSION['foo'] = 'bar'. Where is "bar" stored? If I store an object of a class, in ...
3
votes
1answer
2k views

Header opening a PDF file, can someone hack a website from there?

Can someone hack a website that uses this kind of header to open a pdf? <?php header("Content-type:application/pdf"); // It will be called downloaded.pdf ...
3
votes
1answer
130 views

php_register_variable_ex vulnerability question

Vulnerability I am referring to is: http://www.securityfocus.com/bid/51830 And here in more detail: http://auntitled.blogspot.com/2012/02/mini-poc-for-php-rce-cve-2012-0830.html So basically what ...
3
votes
2answers
442 views

How can a cracker get past through this regexp?

I recently had a chat with a cracker and he told me that he can get past uri regexp checking. I'm checking if the path_info matches my regexp and after that I match that to my routing table. If there ...
3
votes
0answers
506 views

Where to store sensitive client details (MYSQL DB credentials) [duplicate]

I have a security related question about storing some client information - specifically their database login credentials. My app works based on the client and so the database details need to be set ...
2
votes
4answers
2k views

SQL Injection with pass MD5

I want to know, if in my login form there is any SQL injection possible. If there is, what could the exploit's web form entry look like? I send username and password by html form (POST). The login ...
2
votes
2answers
341 views

Is it a weakness to be able to see server side scripting?

Are languages such as Cold Fusion and PHP less secure because they are embedded in HTML which is sent to a client? Someone told me they are less secure because they lack abstraction. CLARIFICATION: ...
2
votes
3answers
270 views

Securing dropdown boxes

I have been creating selection boxes for years, yet I never knew you could modified it with firebug and submit them with nonpermitted values, of course this wouldn't happened if the code was secured. ...
2
votes
3answers
3k views

How to fix specific XSS issues in URL via php?

I am using Netsparker community edition for checking my app for any general security holes. I'm getting a lot of following XSS probable issue areas: my_php_file.php?nsextt=" ...
2
votes
2answers
914 views

Is phpseclib a secure and reliable alternative to OpenSSL?

I know that OpenSSL needs to be installed and activated via apache and the config files, which can be cumbersome or even impossible, and that phpseclib is more flexible and easier to handle than ...
2
votes
2answers
288 views

Can the `system` function pose severe security threats on a shared hosting server?

I recently bought an account from a shared hosting company and I needed the php system function to be enabled for one of my projects. So I created a ticket and asked them to enable it. This is what ...
2
votes
3answers
363 views

Client is not storing Credit Cards Securily (near plain text). How do I convince client to be more secure?

I am writing in regards to PCI-DSS compliance for taking credit cards. A client of mine is not willing / does not want to bump up security beyond what is currently done for their credit card data. All ...
2
votes
2answers
620 views

How to add safety to login page

I am making a website where users need to log in to use all the functions. The login form is placed on the landing page, but the actual login goes through a second page, login.php. If a user types ...
2
votes
3answers
1k views

Do I have a virus on my hosted site?

A few weeks ago I hired an outsourcer from India to build for me a very simple PHP site. I bought PHP hosting and a domain name, and I gave him all the credentials together with the specification of ...
2
votes
4answers
1k views

Without using SSL, what's the most secure way to make an AJAX request to a PHP page?

It was suggested over at stackoverflow that I try my question here. This is it verbatim: So, it's impossible to do AJAX requests securely without using SSL. I get it. You can either view-source the ...
2
votes
2answers
1k views

Is $_REQUEST['id'] vulnerable to sql injection

I have the code below in my newsview.php.I want to know why the code below vulnerable to sql injection.I already test the sql injection in the code below. $id = intval($_REQUEST['id']); $result = ...
2
votes
2answers
339 views

How high is the entropy of this salt-generating code? (No code-reading actually necessary)

What is the best method? Assumption: I have a function that generates a number of medium-high entropy bytes Step1: I generate 3 of these medium-high entropy bytes. Step2: I hash these bytes using a ...
2
votes
1answer
703 views

Can suPHP lead to security issues due to hijacking people's accounts?

Bear in mind that, although I am pretty good at coding clientside javascript, I am not so great at dealing with serverside PHP. It doesn't help that there is very little information/tutorials/APIs on ...
2
votes
1answer
90 views

Does PHP have a XSS API?

ASP.NET has a cross site scripting API by default, however does PHP have a cross site scripting prevention API?
2
votes
2answers
289 views

In this example why do they hash a randomly generated piece of salt before hashing it with the password?

From here, in the code return substr(sha1(mt_rand()),0,22); what is the point of taking the sha1 value? It is appended to the password and together they are hashed using Blowfish. Why not just append ...
2
votes
2answers
2k views

Strongest cryptographic algorithm available in PHP 5.3

Which options are available in the default installation and which ones by third-parties like extensions or frameworks? P.S. By Cryptography I mean algorithms which could be decrypted, not one-way ...
2
votes
3answers
1k views

User data encryption/decryption in a database (PHP)

I was wondering which is the best way to encrypt and decrypt user data in a database, to make it much more secure as it is possible? I was reading about AES but I would like to know if is really the ...
2
votes
2answers
535 views

Potential insecurity in not sanitizing variables before INSERT with prepared statement in PDO

I use PDO with prepared statement when connecting to my database, and I do this because it is considered a safe way to do so, but one thing I could not help but to wonder was, can submitted data from ...
2
votes
2answers
453 views

PHP on IIS 7.5 Hacked - How do I find and fix the XSS Injection?

I discovered that someone had gained access via FileZilla server software to my Windows 2012 Server. It seems like they had created extra accounts and were trying brute force attempts to get in nearly ...
2
votes
3answers
2k views

How secure is ionCube compiled code?

I use ionCube to keep the code I write concealed for my customers. If I would store a password inside the code and compile (not encrypt) it with ionCube encoder, would it be possible for a potential ...
2
votes
1answer
1k views

ALERT - ASCII-NUL chars not allowed within request variables

In a Drupal site, I get this error in my Debian's syslog: suhosin[9413]: ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'name' (attacker 'x.x.x.x', file ...
2
votes
4answers
372 views

When logging out of a website is anything else required then destroying the session?

In PHP, I'm not sure if I should start the session before destroying it when a user wants to log out. session_start(); session_destroy(); Is there anything else that needs to be done? EDIT: I ...
2
votes
3answers
278 views

If we cast a value is it still necessary to escape it with mysqli_real_escape_string()?

real_escape() is a function which needs memory for its functionality, so I was wondering that is there any necessity to do that if we've already cast it? $num = (int) $num; can we use real_escape() ...
2
votes
2answers
160 views

How could attackers exploit $_SERVER['HTTP_REFERER']

I've been warned that PHP's $_SERVER['HTTP_REFERER'] is a common attack vector for websites. What are ways that attackers exploit this function? How can I guard against them?
2
votes
4answers
326 views

Session id on page html source code

I want to know if it's dangerous in any way to store the current logged user session id on the page generated source code. Why I wanted to do that? I'm trying to share the user session between two ...
2
votes
1answer
298 views

Inputting user ID's in URL?

I am currently working on functionality that will allow users to reset their passwords. My question pertains to the security in putting user ID's (a.k.a the auto increment ID's from database) in the ...
2
votes
3answers
144 views

A scammer placed a remote file on a Wordpress website?

A previous developer I have used has got upset and start compromising the files of my website on daily bases (such as changing the index of the site with weird messages, deleting the .htaccess, ...
2
votes
2answers
420 views

Suspicious entries in MySQL database from user input forms - sql injection?

I built a website from scratch using PHP and MySQL for my residential community and our budget is a big fat '0'. Five days ago I discovered that there were 222 entries in a table in my database that ...
2
votes
1answer
110 views

Mark parts of strings as unsafe?

Is there a smooth way to mark unsafe parts of a string? i.e. for use in SQL. example in php: someFunction("safe text" . $unsafeVariable . "safe text" . $anotherUnsafeVariable); Is there a smooth way ...
2
votes
2answers
526 views

how to bypass “header” in php

While reading an article I encounter an interesting thing I did not know about: if(!isset($_SESSION['usr_id']) || !isset($_SESSION['usr_name'])) { header('Location: index.php'); } ...Which ...
2
votes
1answer
181 views

Lamp server sandbox for testing malicious php script

Fortunately despite recently becoming a full time web developer, security is something I take very seriously. There's a developer that I work with who's system was recently compromised with obfuscated ...
2
votes
1answer
2k views

Stopping Session Hijacking

If you noticed, I put "stopping" instead "preventing" in the title because I want my PHP application to be as secure as possible. I am wondering if anyone has any better ways to prevent session ...
2
votes
2answers
734 views

How to make a simple file integrity checker

I've seen many PHP file checker on the net. Basically they computes the sha hash of a requested file. Your PC queries periodically the script and alerts you if the returned hash changes. The problem ...
2
votes
1answer
144 views

Is there a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads?

As mentioned in the title I'm looking for a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? Maybe there is ...
2
votes
2answers
56 views

Security risk stemming from data passed in $_GET superglobal

This is a short but general question. I am relatively new to programming in general. My site, which is predominately written in PHP, will be launched soon and is undergoing some security tightening. ...
2
votes
2answers
72 views

PHP shellcode inside /tmp. Is the server compromised?

I have a Debian 7 VPS that runs Nginx, PHP5-FPM and MariaDB. This server runs a couple of WordPress installations, phpMyAdmin and Roundcube Webmail. One is my personal blog running WP 3.9.1 and ...
2
votes
1answer
121 views

php crypt - trailing dollar sign - extract only the salt part from hash - padding the salt

I am reading up on PHP's crypt() function. I have a few questions on it - What is the significance of the trailing '$' sign at the end of the salt string that I see in most examples. The manual ...
2
votes
1answer
513 views

New to security, is php password_hash() good enough?

This is the first time I've had to handle personnel information and I want to make sure I have a good amount of security. I will be storing users' emails and passwords for their accounts on a MySQL ...
2
votes
2answers
205 views

Are these two ways safe?

I have two scenarios and want to know if each is secure or which risk there are. Number One: If the User has the edit Link (edit/[md5hash]) he can edit a post. The editkey (the hash) is in an form ...
2
votes
3answers
444 views

MySQL database access prevention

I am doing a PHP website for a client who deals with third party financial information, and he is concerned about the developmers (me) having access to all the information, which is obviously a valid ...
2
votes
1answer
181 views

Safe User Login Questions

I need help determining how safe the login is. First of all, I have been reading this: The Definitive Guide To Forms based Website Authentication It's really well written, great information most of ...
2
votes
2answers
138 views

Any solution to passing a penetration test for an outdated php web application without upgrading the application?

A vulnerability list for my project's PHP version. The client would rather not upgrade the PHP version to the last version. Also, it's quite probable that some code will break after the switch from ...
2
votes
1answer
600 views

Advice if safe from mail header injection PHP [duplicate]

Possible Duplicate: PHP mail() Header Injection Prevention Since I only started learning about header injection in the PHP mail() function, am uncertain if the form/code below is vulnerable ...