Questions tagged [php]
Security aspects concerning code written in the programming language PHP which is often used for web applications.
207
questions
165
votes
2
answers
23k
views
I found unknown PHP code on my server. How do I de-obfuscate the code?
We've been getting a lot of noise regarding hacked PHP files here, and it's taking a lot of time to answer these questions. In many cases, they are off-topic. We've had a discussion about this on ...
17
votes
6
answers
7k
views
Server compromised for 2nd time, cannot locate source of attack
I need some help tracing a vulnerability on my server. For the second time, my server has been compromised with files being replaced with virus-ridden downloads.
According to the filesystem dates, ...
63
votes
6
answers
25k
views
Should I obscure database primary keys (IDs) in application front end?
I'm working on an application which allows a moderator to edit information of user.
So, at the moment, I have URL's like
http://www.example.com/user/1/edit
http://www.example.com/user/2/edit
I'm a ...
26
votes
3
answers
9k
views
What steps should be taken to validate user uploaded images within an application?
Recently I have worked on a number of applications that need to process user uploaded images steps have been taken to validate the extension and the mime type.
But what else can be done to ensure ...
66
votes
6
answers
35k
views
How to Securely Implement a "Remember Me" Feature?
Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period (let'...
7
votes
4
answers
28k
views
What does this malicious PHP script do? [closed]
Somebody hacked my site and uploaded this script (template46.php) to my webroot and its content is:
<?php
$vIIJ30Y = Array('1'=>'F', '0'=>'j', '3'=>'s', '2'=>'l', '5'=>'M', '4'=>'...
72
votes
5
answers
27k
views
Found suspicious, obfuscated PHP file. Is this a hack attempt on my website? [duplicate]
I just noticed that the top line of my index.php file got changed to what's below.
<?php preg_replace("\xf4\x30\41\x1f\x16\351\x42\x45"^"\xd7\30\xf\64\77\312\53\40","\373\x49\145\xa9\372\xc0\x72\...
45
votes
2
answers
37k
views
Risks of a PHP image upload form
My client wants a photography site where users can upload their photos in response to photography competitions. Though technically this isn't a problem, I want to know the risks associated with ...
22
votes
2
answers
23k
views
Multibyte character exploits - PHP/MySQL
Could someone please point me to a link with some information on multibyte character exploits for MySQL? A friend brought them to my attention, but I've not been able to find much information on the ...
12
votes
4
answers
15k
views
PHP functions for preventing XSS
Is there a proven library with functions for preventing XSS attacks? Many people don't realise that htmlspecialchars is not enough to prevent XSS attacks. There are various contexts that need their ...
11
votes
6
answers
12k
views
Security review: "HTTP header user-agent has been set to (something)"
We got a security review done of our PHP code and they team advised this in their report (amongst other things):
/appdir/
Details
The HTTP header user-agent has been set to \" .
Request
GET /...
38
votes
3
answers
10k
views
How to encrypt in PHP, properly?
How do I encrypt data in PHP, properly, using symmetric-key encryption? I have a message M and a secret S. I'm looking for a solution that uses cryptography properly without making any of the usual ...
26
votes
3
answers
46k
views
How secure are sha256 + salt hashes for password storage [duplicate]
I started reading about password hashing recently on multiple sites like this page on crackstation and others, and for what I have understood, I should avoid using hashing algorithms like md5 and sha1 ...
26
votes
2
answers
12k
views
What are the best practices for hardening a php.ini file?
In order to secure a PHP installation, what are the best settings for a php.ini file? What is absolutely vital in terms of security? What is recommended for most use cases?
26
votes
1
answer
17k
views
Is this a backdoor?
I found the code below on my customers site. It looks like a typical backdoor hidden with hexadecimal, but I'm not 100% sure.
<?php if (!isset($GLOBALS["\x61\156\x75\156\x61"]))
{
$ua ...
22
votes
4
answers
14k
views
How did Anonymous use UTF-16 ASCII to fool PHP escaping?
A few months ago, Anonymous took down a child pornography site using SQL-injection. I read in this article that Anonymous claimed that "the server was using hardened PHP with escaping," but they were ...
13
votes
2
answers
7k
views
Does bcrypt compare the hashes in "length-constant" time?
I saw this function slowEquals() while reading Salted Password Hashing - Doing it Right, which uses a byte-level xor comparison to avoid timing attacks. I was wondering whether this is what Bcrypt ...
45
votes
4
answers
70k
views
How do you know your server has been compromised?
I recently helped a client who had their server hacked. The hackers added some PHP code into the header of the homepage redirecting the user to a porn website — but only if they came from Google. This ...
39
votes
4
answers
36k
views
Is it safe to store the database password in a PHP file?
My connection.php file stores the credentials to connect to the database:
<?php
$objConnect = mysql_connect("localhost","username","password");
mysql_select_db("selectDB", $objConnect);
?...
18
votes
3
answers
60k
views
Is it possible to execute a php script in an image file? [duplicate]
I have an image upload php website. Users can upload images to my website. A user claims he can hack my website using an uploaded image.
I opened all the images that he uploaded to my server with ...
18
votes
5
answers
4k
views
Why do browsers warn about mixed content for images?
I'm dealing with a phpBB forum user who wants to set up SSL on their entire site to secure user credentials and "private" parts of the website.
However, they want to preserve the traditional forum ...
15
votes
4
answers
994
views
what to do after suspected intrusion on hobby webserver
I maintain a server to host my files and a number of websites for hobbies and friends. I just noticed that the site summary being returned in google for one of my domains were all porn related (...
11
votes
2
answers
8k
views
Is PHP unserialize() exploitable without any magic methods?
Say that there was a publicly accessible web page with the following PHP code:
<?php
class NotInteresting
{
public function noExploits() {
echo "Whatever.";
}
}
$unsafe = ...
3
votes
2
answers
3k
views
Is my code using mysqli_real_escape_string and quotes100% safe against SQL Injection?
My code is:
SELECT * FROM tlb_members WHERE username="{mysqli_real_escape_string($_GET['test'])}"
I'm searching and some people said using quotes in SQL statements is safe. Is this true?
2
votes
2
answers
4k
views
XSS via REQUEST_URI
Is there any situation where an XSS attack can be performed via the PHP $_SERVER['REQUEST_URI'] variable? For those unfamiliar with it: It contains the complete URL used to access that website, ...
1
vote
1
answer
6k
views
Secure Image Upload, or Bypassing PHP mime-type Check
When securing image uploads there are basically three approaches I know of (of course, ideally, all three are used):
check file extension
store uploaded files in non-executable directory outside the ...
97
votes
7
answers
39k
views
How does hacking work?
I am specifically talking about web servers, running Unix. I have always been curious of how hackers get the entry point. I mean I don't see how a hacker can hack into the webpage when the only entry ...
47
votes
5
answers
11k
views
How to perform a security audit for a PHP application?
I have a PHP application that I would like to have audited for security. I'm familiar with most of the general security issues, but want to make sure I didn't miss anything.
What steps should I take ...
42
votes
6
answers
18k
views
PHP files browsable: is this a vulnerability?
I have a friend who has a website developed in PHP on which we can browse all his files one after one (of course, we can not read the content of the PHP files).
Do you think this is a security hole?
...
21
votes
5
answers
2k
views
Hashed password storage with random salt
Ever since I've been making sites that require a user to log in with a username and password I've always kept the passwords somewhat secure by storing them in my database hashed with a salt phrase. ...
18
votes
6
answers
45k
views
How safe is it to install XAMPP on my home computer to test PHP code?
I want to test some PHP code and I figure the best way is to install XAMPP - but I'm nervous about installing server software on my home computer.
Is it generally safe to install XAMPP (given that I ...
15
votes
3
answers
3k
views
How secure is aSSL (javascript)? Does it effectively mimic SSL?
Some of you may be familiar with the aSSL project, which uses AJAX/PHP to mimic the SSL protocol. It uses RSA 512 or 1024 for the keys, and AES for the actual data. It looks impressive to me in ...
15
votes
3
answers
14k
views
SQL injection can bypass login but not drop table
I've setup a test environment for running some SQL Injection against my code and learning how to defend against it. I can bypass the login form using the following in the password field:
' OR ...
13
votes
4
answers
29k
views
Generating an unguessable token for confirmation e-mails
I'm generating a token to be used when clicking on the link in a verification e-mail. I plan on using uniqid() but the output will be predictable allowing an attacker to bypass the confirmation e-...
13
votes
3
answers
3k
views
How to deobfuscate this PHP malware? [duplicate]
Two days ago a file called "images.php" appeared on a friend's server, which he noticed because it caused errors. The file contained the following. This code is of unknown origin and presumed to be ...
10
votes
4
answers
4k
views
Reasonable way to store encrypted passwords in a webapp's database, Linux
This question is generally similar to past questions asked here, but I haven't seen one the relates to Linux.
Case at hand: a PHP web app has a MySQL backend. As part of its functionality it accesses ...
9
votes
1
answer
2k
views
Proper way to protect against XSS, when output is directly into JS not HTML?
I'm seeing plenty of examples when the output is going into HTML directly, but I'm seeing more conflicting information when the output is going straight into JS.
For example if the code was:
var ...
8
votes
4
answers
1k
views
Security attacks on PHP web applications
I know about following security attacks on php applications (html,php,js).
XSS
SQL Injection
CSFR
Session Hijacking /Fixation
Code Injection
Remote file injection
Should i know about any other ...
7
votes
3
answers
4k
views
is it safe to allow external images to be attached to Blog or any Web content?
I am filtering all images that attached to any content of my blog:
Check for file extension.
Check content type using $finfo = finfo_open(FILEINFO_MIME_TYPE);
I also save the image temporary on my ...
7
votes
6
answers
3k
views
How to defend vs. Image Remote File Inclusion, e.g. RFI using a .gif file (Apache/PHP)?
To defend versus Remote File Inclusion where attackers try to abuse image files, I usually recommend to never use include to include image files into PHP code.
Sometimes though, the avoidance of ...
6
votes
3
answers
9k
views
PHP crypt() or phpass for storing passwords?
When storing passwords, should I use PHP's built in crypt or phpass?
If using crypt, should I use CRYPT_SHA512 or CRYPT_BLOWFISH?
6
votes
6
answers
3k
views
What are some good, free tools to run automated security audits for PHP code?
I've been looking for some time now and have come up short. The most promising I found was Spike PHP, which seems to no longer work. I'm looking to scan my code for potential risks of SQL Injection, ...
3
votes
6
answers
28k
views
Use PHP to check uploaded image file for malware?
I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k.
Is there any way for me to check uploaded ...
2
votes
1
answer
15k
views
' OR 1=1/* SQL Injection Login Bypass Question
Recently I came across a SQL Injection Cheat Sheet which contains this particular cheat sheet which I am confused by ' or 1=1/*
Assuming I am testing it on this server-side code below.
SELECT * FROM ...
2
votes
1
answer
3k
views
Arbitrary file upload, serve JPG as PHP
I'm trying out random older WordPress exploits on my local server, I'm currently in the process trying to get this one to work:
https://www.exploit-db.com/exploits/20083/
It doesn't read any headers,...
51
votes
3
answers
6k
views
Security Review - password_hash implementation for PHP
I'm currently working on a "helper function" for PHP's core to make password hashing more secure and easier for the majority of developers. Basically, the goal is to make it so easy, that it's harder ...
51
votes
9
answers
51k
views
Is it bad practice to use GET method as login username/password for administrators?
I work on web applications and as you know, having an administrator panel is a must in most cases. We can see that a lot of web applications have a specific login page for administrators in which ...
50
votes
6
answers
8k
views
Should I be concerned if my website throws stack information?
I have a simple login form on my web page and the URL looks like this:
example.com/signup/signup.php?q=1
If I try something like this:
example.com/signup/signup.php?q=1&()
I'm redirected to a ...
50
votes
4
answers
14k
views
How to approach replacing md5 for transporting Unity game data to a remote server
TL;DR
I am working on a gaming system that uses UnityScript and C# on the client and PHP on the server. A MD5 hash of the data plus a shared secret is used to check that the data has not been ...
32
votes
4
answers
82k
views
Which is the best way to sanitize user input in PHP?
These are things I do when users submit data:
substr if extra characters found.
htmlspecialchars() + ENT_QUOTES + UTF-8
str_replace '<' '>' in user input
What more things need to be done?