Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

3
votes
2answers
832 views

Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password

I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects. I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I ...
3
votes
1answer
692 views

Preventing spoofing of remote server with PHP & cURL

I'm writing a PHP script that is requesting confidential data from a remote server. I'm using cURL to get the remote server's certificate information (for its output, please see below). Which array ...
3
votes
2answers
2k views

sanitizing input/output in php/codeigniter

I've been making some progress learning about web application security. Right now I'm trying to finalize my strategy for sanitizing input and output. Background: Users can submit reviews to the site, ...
3
votes
2answers
891 views

list of web session attacks and counter measures

I'm writing a new website with php and I will be using cookies to track user session data. Before I finalise the design I want to make sure that the site is not vulnerable to attacks. I have written a ...
3
votes
4answers
87 views

Lock a website login to a certain computer

I've got a web based system where a specific site only shall be available on a certain computer. On that computer I have a desktop application. The desktop application and the website communicate ...
3
votes
1answer
233 views

Is this a backdoor?

I found the code below on my customers site. It looks like a typical backdoor hidden with hexadecimal, but I'm not 100% sure. <?php if(!isset($GLOBALS["\x61\156\x75\156\x61"])) { ...
3
votes
3answers
258 views

Is web app safe in not public folder?

I'am wondering if it's really safe to use this structure of my web application. WEBAPP Application Controllers Models Views ... Framework ... ...
3
votes
2answers
477 views

PHP null byte include failing explation seeked

I am watching a tutorial on YouTube about how to include remote files or local through a standard include command. Here is the code: <?php if(isset($_GET["language"])) { $language = ...
3
votes
2answers
2k views

Secure way to establish PHP database connections

I've read the advice (example: store them in php file in a location inaccessible as a URL) but can't help thinking there must be a better way of storing/accessing database credentials. Ideally it ...
3
votes
1answer
142 views

PHP - Serializing user inputs

My entropy gathering system works by serializing user inputs: $entropy=sha1(microtime().$pepper.$_SERVER['REMOTE_ADDR'].$_SERVER['REMOTE_PORT']. ...
3
votes
3answers
169 views

SQLi-protection ORDER BY

What would be a good check to remove all possibility of SQL-injection on an ORDER BY col where col is an unsafe variable? I'm currently removing [^A-Za-z0-9_] from the string in php. Is this too ...
3
votes
2answers
103 views

How can you detect an insecure, non-random token?

I know that some of PHP's random functions are insecure due to them not being completely random and are considered a bad practice. My question is how an attacker go about finding that the developer ...
3
votes
3answers
362 views

Understanding JVM zero day in relationship with other runtimes

I am a .net and php developer and since java has been in the news recently thanks to the string of zero days, I decided to brush up on security. In regards to the java zero days, this question has ...
3
votes
2answers
108 views

User privileges for unsanatized code

We all know there are still vulnerable code out there even though they may or may not get exploited and found for hacking attempts. I've seen people do it countless times and have a possibly plausible ...
3
votes
1answer
551 views

When checking a session variable to see if a user is logged in, is it enough to check to see if the variable is set?

When displaying a page with content only logged in users should see, I simply check if(isset($_SESSION['hasLoggedIn'])) { //show content } else { echo 'you must log in'; } In this article it ...
3
votes
1answer
251 views

php security courses

I got asked today by my boss if I wanted to do some php security courses, however I am not even sure other than the zend securing php applications course if any exist could any one provide any links ...
3
votes
1answer
100 views

Does FCGId use environment variables? (Or is it a possible attack vector for CVE-2014-6271/7169?)

According to Red Hat httpd (attack vector): CGI scripts are likely affected by this issue: when a CGI script is run by the web server, it uses environment variables to pass data to the ...
3
votes
2answers
168 views

How do web email clients store my passwords from other providers?

The situation comes down to this: When I enter in hotmail, it retrieves my messages connecting to other providers: they could only do so by using my email and password. Since I had signed in a ...
3
votes
1answer
393 views

Do PHP frameworks such as Zend, symfony and CakePHP provide default protection against cross site scripting?

ASP.NET MVC provides default protection against cross site scripting. Just wondering, if PHP frameworks do the same?
3
votes
1answer
176 views

How can I store information securely when I can't use crypt or a hash?

I'm creating an application for Google Glass (technically it's Glassware, but whatever). The user will do the following steps when going through setup for the Glassware: Go to my website, redirected ...
3
votes
3answers
527 views

Tokenless REST API security concerns

I'm designing an API in PHP/MySQL that, by its design, will not store a user's password in the database and thus does not generate authorization tokens for the client to hold. The reason for this is ...
3
votes
1answer
4k views

Where and How is data stored in a session?

Where is the information in the fields of a session stored? If I, for instance, store in a session something like $_SESSION['foo'] = 'bar'. Where is "bar" stored? If I store an object of a class, in ...
3
votes
1answer
2k views

Header opening a PDF file, can someone hack a website from there?

Can someone hack a website that uses this kind of header to open a pdf? <?php header("Content-type:application/pdf"); // It will be called downloaded.pdf ...
3
votes
1answer
136 views

php_register_variable_ex vulnerability question

Vulnerability I am referring to is: http://www.securityfocus.com/bid/51830 And here in more detail: http://auntitled.blogspot.com/2012/02/mini-poc-for-php-rce-cve-2012-0830.html So basically what ...
3
votes
2answers
479 views

How can a cracker get past through this regexp?

I recently had a chat with a cracker and he told me that he can get past uri regexp checking. I'm checking if the path_info matches my regexp and after that I match that to my routing table. If there ...
3
votes
0answers
38 views

Opening mail from IMAP with no risk for the user

I'm building a website for an association. Its aim is to, out of other thing, provide an easy mail manager to communicate with the member, stored in a database. This database is always up to date as ...
3
votes
0answers
577 views

Where to store sensitive client details (MYSQL DB credentials) [duplicate]

I have a security related question about storing some client information - specifically their database login credentials. My app works based on the client and so the database details need to be set ...
2
votes
4answers
2k views

SQL Injection with pass MD5

I want to know, if in my login form there is any SQL injection possible. If there is, what could the exploit's web form entry look like? I send username and password by html form (POST). The login ...
2
votes
2answers
350 views

Is it a weakness to be able to see server side scripting?

Are languages such as Cold Fusion and PHP less secure because they are embedded in HTML which is sent to a client? Someone told me they are less secure because they lack abstraction. CLARIFICATION: ...
2
votes
5answers
463 views

Does shuffling a hashed password increase its security?

I am making a web app and I'm now stuck on making the login secure. I'm thinking of adding a salt to a user-inputted password and then hash it. (md5 or sha for example) and then I will reshuffle the ...
2
votes
3answers
286 views

Securing dropdown boxes

I have been creating selection boxes for years, yet I never knew you could modified it with firebug and submit them with nonpermitted values, of course this wouldn't happened if the code was secured. ...
2
votes
3answers
3k views

How to fix specific XSS issues in URL via php?

I am using Netsparker community edition for checking my app for any general security holes. I'm getting a lot of following XSS probable issue areas: my_php_file.php?nsextt=" ...
2
votes
2answers
1k views

Is phpseclib a secure and reliable alternative to OpenSSL?

I know that OpenSSL needs to be installed and activated via apache and the config files, which can be cumbersome or even impossible, and that phpseclib is more flexible and easier to handle than ...
2
votes
2answers
312 views

Can the `system` function pose severe security threats on a shared hosting server?

I recently bought an account from a shared hosting company and I needed the php system function to be enabled for one of my projects. So I created a ticket and asked them to enable it. This is what ...
2
votes
5answers
248 views

Can extra loading times on login attempts be a security threat?

I have a web application built with PHP with a login page where the visitor is supposed to enter his / her account's email address and matching password. Since I'm using the PHP native (slow) hashing ...
2
votes
1answer
111 views

Does PHP have a XSS API?

ASP.NET has a cross site scripting API by default, however does PHP have a cross site scripting prevention API?
2
votes
2answers
1k views

Is $_REQUEST['id'] vulnerable to sql injection

I have the code below in my newsview.php.I want to know why the code below vulnerable to sql injection.I already test the sql injection in the code below. $id = intval($_REQUEST['id']); $result = ...
2
votes
3answers
406 views

Client is not storing Credit Cards Securily (near plain text). How do I convince client to be more secure?

I am writing in regards to PCI-DSS compliance for taking credit cards. A client of mine is not willing / does not want to bump up security beyond what is currently done for their credit card data. All ...
2
votes
3answers
1k views

Do I have a virus on my hosted site?

A few weeks ago I hired an outsourcer from India to build for me a very simple PHP site. I bought PHP hosting and a domain name, and I gave him all the credentials together with the specification of ...
2
votes
4answers
1k views

Without using SSL, what's the most secure way to make an AJAX request to a PHP page?

It was suggested over at stackoverflow that I try my question here. This is it verbatim: So, it's impossible to do AJAX requests securely without using SSL. I get it. You can either view-source the ...
2
votes
2answers
393 views

How high is the entropy of this salt-generating code? (No code-reading actually necessary)

What is the best method? Assumption: I have a function that generates a number of medium-high entropy bytes Step1: I generate 3 of these medium-high entropy bytes. Step2: I hash these bytes using a ...
2
votes
1answer
736 views

Can suPHP lead to security issues due to hijacking people's accounts?

Bear in mind that, although I am pretty good at coding clientside javascript, I am not so great at dealing with serverside PHP. It doesn't help that there is very little information/tutorials/APIs on ...
2
votes
2answers
585 views

Potential insecurity in not sanitizing variables before INSERT with prepared statement in PDO

I use PDO with prepared statement when connecting to my database, and I do this because it is considered a safe way to do so, but one thing I could not help but to wonder was, can submitted data from ...
2
votes
1answer
93 views

Bypass Text Plain Rule

I want to know if I can allow uploading all types of scripts and add these rules to a virtual host configuration; so please advise and tell me if there will be some exploits that can be used to ...
2
votes
2answers
593 views

PHP on IIS 7.5 Hacked - How do I find and fix the XSS Injection?

I discovered that someone had gained access via FileZilla server software to my Windows 2012 Server. It seems like they had created extra accounts and were trying brute force attempts to get in nearly ...
2
votes
3answers
3k views

How secure is ionCube compiled code?

I use ionCube to keep the code I write concealed for my customers. If I would store a password inside the code and compile (not encrypt) it with ionCube encoder, would it be possible for a potential ...
2
votes
1answer
1k views

ALERT - ASCII-NUL chars not allowed within request variables

In a Drupal site, I get this error in my Debian's syslog: suhosin[9413]: ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'name' (attacker 'x.x.x.x', file ...
2
votes
4answers
398 views

When logging out of a website is anything else required then destroying the session?

In PHP, I'm not sure if I should start the session before destroying it when a user wants to log out. session_start(); session_destroy(); Is there anything else that needs to be done? EDIT: I ...
2
votes
2answers
591 views

how to bypass “header” in php

While reading an article I encounter an interesting thing I did not know about: if(!isset($_SESSION['usr_id']) || !isset($_SESSION['usr_name'])) { header('Location: index.php'); } ...Which ...
2
votes
2answers
2k views

Is it possible to spoof the last proxy of an X-Forwarded-For Header?

I'm using a firefox plugin https://addons.mozilla.org/en-US/firefox/addon/x-forwarded-for-header/ to spoof the X-Forwarded-For Header to 8.8.8.8. For the following php page: echo ...