Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

8
votes
4answers
787 views

How dangerous is it to store password in plain text on sites like GitHub?

I have a few private repositories set up on GitHub for some of the projects I am working on for my company. These applications connect to databases and I have database authentication credentials ...
3
votes
3answers
974 views

SQL injection using letters and numbers?

I was wondering if it is at all possible for a hacker to perform an SQL injection attack using just letters and numbers. For example, let's take a look at this PHP code which uses regular expressions ...
1
vote
0answers
440 views

How to set up a smart card for web login? [closed]

I'm a web developer with a login system (in PHP) that I would like to extend to allow those with a smart card to sign into the system. But I have no idea where to begin and I don't have a massive ...
2
votes
1answer
278 views

Are GET, POST and windows.location vulnerable to XSS in a Wordpress theme?

I created a Wordpress theme for my client. He told me that he scanned my theme with a vulnerability scanner, and that it has security issues with the GET and windows.location methods. Is this really ...
-3
votes
1answer
508 views

Cross-site request forgery attack. How can we stopped this? [closed]

On one of our websites, we are seeing this code is adding itself. I tried to figured out but no success. One thing I have noticed when I removed the html, head and body starting tags, it's gone. Our ...
3
votes
0answers
554 views

Where to store sensitive client details (MYSQL DB credentials) [duplicate]

I have a security related question about storing some client information - specifically their database login credentials. My app works based on the client and so the database details need to be set ...
1
vote
2answers
666 views

Generating session CSRF token based on SSL session ID

Following situation: Application is only accessible via HTTPS/SPDY nginx is sending the SSL session ID to the upstream server Upon session start I'd like to use the first 128 characters of that ...
0
votes
2answers
1k views

Stopping js malware injection on our Wordpress site

This had been added to our wordpress site, specifically in the footer.php. hxxp://pkktjuchlrv.peguards.cc/02b31ac5iq/get.js It is malware as defined by google, i belive it is tracking code. We have ...
0
votes
1answer
331 views

Site Hacked - Where to go from here? [closed]

Our magento based e-commerce site was hacked over the weekend, the hackers managed to gain access to the magento files and embed some scrambled code into the get.php file in the root directory. I ...
1
vote
1answer
2k views

WordPress Hacked - Found a suspicious “class-wp-style-table.php” [closed]

I recently had all of my WordPress accounts on my server hacked. The only suspicious files I found are listed below. These were the only files edited in the last 5 days (June 3, to be specific). ...
2
votes
1answer
330 views

Bot detection ideas [php]

I am looking for bot detection ideas. I don't mind bots crawling my site, that's cool, the problem is when they start posting stuff. I recently had to erase 400 accounts because of a bad boy like ...
6
votes
1answer
446 views

Is enabling PHP script execution on HTML document file extensions a security concern?

I am working on a very old and messy site, which doesn't have a CMS, or a database. However, it has a lot of .htm and .php files. I need to add some PHP code to some of the .htm files, but want to ...
-1
votes
2answers
170 views

my websites got infected with a malware i cannot get any info on [closed]

we have a server, on which we host about 30 sites. these are test sites for our customers. most of them are not even indexed by google. some run on php, some on nodejs, some on ruby. all of them that ...
4
votes
1answer
167 views

Is it possible for users to insert forbidden characters into sites with htmlentities or mysqlescapestring?

So, in my brief research in PHP security, I have been guided toward two important functions to remove forbidden characters from forms. One being "htmlentities" and the other being ...
4
votes
1answer
516 views

Malicious script analysis

Could somebody tell me what can this malicious code do? I see that in the beginning it turns off the error reporting and logging. Then something with get post method and files stuff. But I am not ...
9
votes
1answer
1k views

“Official statement” on php.net : CRYPT_BLOWFISH is strongest hash algorithm. Why?

First: I asked this question on stackoverflow and was kindly asked to post this here again. See the original question here. According to the [early] doc pages of the new PHP 5.5 password ...
5
votes
5answers
2k views

How to make a site vulnerable to SQLi?

I've recently taken an interest in SQL injections - it (for some reason, correct me if I'm wrong) seemed like a good place to start (I am pretty much a beginner). Anyways, I want to make a site that I ...
3
votes
2answers
2k views

Secure way to establish PHP database connections

I've read the advice (example: store them in php file in a location inaccessible as a URL) but can't help thinking there must be a better way of storing/accessing database credentials. Ideally it ...
0
votes
1answer
82 views

Security comparisons between two approaches: how to distinguish FUD from Substance? [closed]

Background: WorkerB and Tymac were discussing the pros-and-cons of using two different alternatives for extending a web content management system that is used in their company. Alternative one ...
5
votes
4answers
3k views

A customers site had a big mysql injection attack on it, just want to learn from it

I created an online store for a friend of mine. I created a system that shoots me an email any time there is a database error, that way if it is a bug in my code I can identify it and fix it. The ...
6
votes
2answers
2k views

Is this Data Encryption/Storage Method Secure?

Let me first say that I know it is a bad idea to store sensitive information in a mysql database, so please don't respond by saying "DON'T DO IT" or something to that effect. I am building a website ...
15
votes
6answers
16k views

Is it possible for a hacker to download a php file without executing it first?

I have a php website where everything is in the public_html\ folder, including inclides folder with config and classes. I told my developer to move it away from public folder but he said there is no ...
6
votes
3answers
638 views

How dangerous is it to use CSS styles from an untrusted source?

I'm a moderator at a forum. We want to have a new style for the forum. We're thinking about announcing a competition to the users to come up with the best CSS design; we would adopt the best ...
1
vote
2answers
285 views

Remote File Injection in ARGS blocking form updating database

I am getting a page forbidden because mod_security blocks it with Remote File Injection in ARGS rule. How do I stop this apart from not including URLs in the form fields or removing the http:// ...
2
votes
2answers
208 views

Are these two ways safe?

I have two scenarios and want to know if each is secure or which risk there are. Number One: If the User has the edit Link (edit/[md5hash]) he can edit a post. The editkey (the hash) is in an form ...
3
votes
1answer
140 views

PHP - Serializing user inputs

My entropy gathering system works by serializing user inputs: $entropy=sha1(microtime().$pepper.$_SERVER['REMOTE_ADDR'].$_SERVER['REMOTE_PORT']. ...
7
votes
1answer
438 views

Does HTTPS Encrypt PHP Arguments?

I am working on a web app that will need to have a secret key(s) passed from one server to another - I'll need to do this over PHP. Consider the following URL: ...
5
votes
3answers
584 views

How do I make SQL injection harder but not impossible?

I'm doing a CTF application for my final year project. I wanted to craft a SQL injection flag but I don't wish that they can simply found out the SQLi vulnerability by injecting ' . Hence, is there ...
1
vote
6answers
5k views

Use PHP to check uploaded image file for malware?

I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k. Is there any way for me to check uploaded ...
3
votes
2answers
107 views

User privileges for unsanatized code

We all know there are still vulnerable code out there even though they may or may not get exploited and found for hacking attempts. I've seen people do it countless times and have a possibly plausible ...
4
votes
1answer
325 views

Exploited by newbie3viLc063s

My debian server got exploited by some scriptiekiddie who used Newbie3viLc063 http://pastebin.com/jma8JRG1 . Scriptkiddie uploaded logo_php.png to my server (My permissions sucked :s) and he did run ...
1
vote
2answers
142 views

secure certain data on my webserver

I've developed a website where people add their sensitive data. Not credit cards, but lets say they share things about themselves which are private and it wouldn't be good if other people see that ...
4
votes
3answers
663 views

Secure login system - using sessions?

I'm looking for a secure way to let users login on my website. Currently, I've always used a session system, like this: <?php session_start(); if (validPass() || isset($_SESSION['userId'])) { ...
2
votes
1answer
108 views

Securely store two values per user in SQL

I have come across the need in my web app to store two values for each user. These values would need to be retrievable from a value stored in a URL. I would prefer to store neither of the values in ...
2
votes
1answer
112 views

Mark parts of strings as unsafe?

Is there a smooth way to mark unsafe parts of a string? i.e. for use in SQL. example in php: someFunction("safe text" . $unsafeVariable . "safe text" . $anotherUnsafeVariable); Is there a smooth way ...
2
votes
1answer
506 views

When checking a session variable to see if a user is logged in, is it enough to check to see if the variable is set?

When displaying a page with content only logged in users should see, I simply check if(isset($_SESSION['hasLoggedIn'])) { //show content } else { echo 'you must log in'; } In this article it ...
1
vote
1answer
295 views

XSS MySQL Database Accessible?

I'd like to know if there is any danger of someone being able to access the database via XSS vulnerabilities on this page. I have the following link. When you go to this link, the text I've enclosed ...
1
vote
2answers
319 views

How to stop a (malicious) endless loop

Few days ago someone tried to crack my site using a Remote File Inclusion attack. The attack was blocked by my Web Application Firewall, but I was curious about the file. So I downloaded it started to ...
2
votes
3answers
463 views

MySQL database access prevention

I am doing a PHP website for a client who deals with third party financial information, and he is concerned about the developmers (me) having access to all the information, which is obviously a valid ...
8
votes
3answers
7k views

Is it possible to execute a php script in an image file? [duplicate]

I have an image upload php website. Users can upload images to my website. A user claims he can hack my website using an uploaded image. I opened all the images that he uploaded to my server with ...
3
votes
3answers
533 views

Stop code injections into page code

I started a topic HERE on the stackoverflow site, but was refered here. I did get some info there, but think it need's more indepth input. So hopefuly people here can help. I have a few domains ...
18
votes
4answers
11k views

How to hijack a session?

Despite the blatant title of the question, this is actually for a genuine purpose. My site uses PHP code like this: $select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'"; ...
0
votes
2answers
169 views

how to find injected code in SQL

Recently one of my sites is hacked. The hacker used SQL injection to compromise the security. After getting SQL access he injected code in many places in database. I cleaned up many of them. But I am ...
5
votes
3answers
701 views

Setting a limit on password recovery attempts

in a setting where one has forgotten their password, I'd like to be able to limit the attempts of entering in email addresses to something like 10. My first thought was to use a cookie. $attempts = ...
13
votes
3answers
12k views

Creating Secure PHP Sessions

I have already created and refined both registration and login systems, However I am lead to believe the tricky part comes when you are creating a session. As far as I know this is due to both ...
12
votes
4answers
3k views

Is $_SERVER[ ] a safe source of data in PHP?

Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]? Thanks. OVERVIEW OF RESPONSES: So it seems there is a consensus that some ...
1
vote
1answer
2k views

ASP.net vs PHP security? [closed]

I have been told that generally speaking, asp.net web apps tend to be more secure than php, since asp.net has some automatic security measures, for example, by default it doesn't allow remote file ...
0
votes
1answer
404 views

Is it secure to use a custom written Php extension for handling + hashing (db) keys?

I'm designing the security of a new application and try to figure out what the best way is to store the keys of the mysql AES encryption in the file system. I've seen several options like store it ...
-2
votes
1answer
549 views

Admin area in my php website is vulnerable to sql injection without login [closed]

my website admin area is vulnerable to sql injection . I tried using havji and it hacked successfully to database. But how is this possible. without login it breaked into admin panel. ...
2
votes
4answers
384 views

When logging out of a website is anything else required then destroying the session?

In PHP, I'm not sure if I should start the session before destroying it when a user wants to log out. session_start(); session_destroy(); Is there anything else that needs to be done? EDIT: I ...