Questions tagged [php]

Security aspects concerning code written in the programming language PHP which is often used for web applications.

Filter by
Sorted by
Tagged with
165 votes
2 answers
23k views

I found unknown PHP code on my server. How do I de-obfuscate the code?

We've been getting a lot of noise regarding hacked PHP files here, and it's taking a lot of time to answer these questions. In many cases, they are off-topic. We've had a discussion about this on ...
Mark Buffalo's user avatar
  • 22.6k
17 votes
6 answers
7k views

Server compromised for 2nd time, cannot locate source of attack

I need some help tracing a vulnerability on my server. For the second time, my server has been compromised with files being replaced with virus-ridden downloads. According to the filesystem dates, ...
Mahmoud Al-Qudsi's user avatar
63 votes
6 answers
25k views

Should I obscure database primary keys (IDs) in application front end?

I'm working on an application which allows a moderator to edit information of user. So, at the moment, I have URL's like http://www.example.com/user/1/edit http://www.example.com/user/2/edit I'm a ...
Pruthvi Raj Nadimpalli's user avatar
26 votes
3 answers
9k views

What steps should be taken to validate user uploaded images within an application?

Recently I have worked on a number of applications that need to process user uploaded images steps have been taken to validate the extension and the mime type. But what else can be done to ensure ...
Mark Davidson's user avatar
66 votes
6 answers
35k views

How to Securely Implement a "Remember Me" Feature?

Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period (let'...
colithium's user avatar
  • 873
7 votes
4 answers
28k views

What does this malicious PHP script do? [closed]

Somebody hacked my site and uploaded this script (template46.php) to my webroot and its content is: <?php $vIIJ30Y = Array('1'=>'F', '0'=>'j', '3'=>'s', '2'=>'l', '5'=>'M', '4'=>'...
kenorb's user avatar
  • 819
72 votes
5 answers
27k views

Found suspicious, obfuscated PHP file. Is this a hack attempt on my website? [duplicate]

I just noticed that the top line of my index.php file got changed to what's below. <?php preg_replace("\xf4\x30\41\x1f\x16\351\x42\x45"^"\xd7\30\xf\64\77\312\53\40","\373\x49\145\xa9\372\xc0\x72\...
Scott's user avatar
  • 709
45 votes
2 answers
37k views

Risks of a PHP image upload form

My client wants a photography site where users can upload their photos in response to photography competitions. Though technically this isn't a problem, I want to know the risks associated with ...
Starkers's user avatar
  • 553
22 votes
2 answers
23k views

Multibyte character exploits - PHP/MySQL

Could someone please point me to a link with some information on multibyte character exploits for MySQL? A friend brought them to my attention, but I've not been able to find much information on the ...
user avatar
12 votes
4 answers
15k views

PHP functions for preventing XSS

Is there a proven library with functions for preventing XSS attacks? Many people don't realise that htmlspecialchars is not enough to prevent XSS attacks. There are various contexts that need their ...
Casebash's user avatar
  • 601
11 votes
6 answers
12k views

Security review: "HTTP header user-agent has been set to (something)"

We got a security review done of our PHP code and they team advised this in their report (amongst other things): /appdir/ Details The HTTP header user-agent has been set to \" . Request GET /...
siliconpi's user avatar
  • 1,087
38 votes
3 answers
10k views

How to encrypt in PHP, properly?

How do I encrypt data in PHP, properly, using symmetric-key encryption? I have a message M and a secret S. I'm looking for a solution that uses cryptography properly without making any of the usual ...
D.W.'s user avatar
  • 99.5k
26 votes
3 answers
46k views

How secure are sha256 + salt hashes for password storage [duplicate]

I started reading about password hashing recently on multiple sites like this page on crackstation and others, and for what I have understood, I should avoid using hashing algorithms like md5 and sha1 ...
Yuran Pereira's user avatar
26 votes
2 answers
12k views

What are the best practices for hardening a php.ini file?

In order to secure a PHP installation, what are the best settings for a php.ini file? What is absolutely vital in terms of security? What is recommended for most use cases?
VirtuosiMedia's user avatar
26 votes
1 answer
17k views

Is this a backdoor?

I found the code below on my customers site. It looks like a typical backdoor hidden with hexadecimal, but I'm not 100% sure. <?php if (!isset($GLOBALS["\x61\156\x75\156\x61"])) { $ua ...
Ivar's user avatar
  • 363
22 votes
4 answers
14k views

How did Anonymous use UTF-16 ASCII to fool PHP escaping?

A few months ago, Anonymous took down a child pornography site using SQL-injection. I read in this article that Anonymous claimed that "the server was using hardened PHP with escaping," but they were ...
Nate Glenn's user avatar
13 votes
2 answers
7k views

Does bcrypt compare the hashes in "length-constant" time?

I saw this function slowEquals() while reading Salted Password Hashing - Doing it Right, which uses a byte-level xor comparison to avoid timing attacks. I was wondering whether this is what Bcrypt ...
DevD's user avatar
  • 267
45 votes
4 answers
70k views

How do you know your server has been compromised?

I recently helped a client who had their server hacked. The hackers added some PHP code into the header of the homepage redirecting the user to a porn website — but only if they came from Google. This ...
Boz's user avatar
  • 575
39 votes
4 answers
36k views

Is it safe to store the database password in a PHP file?

My connection.php file stores the credentials to connect to the database: <?php $objConnect = mysql_connect("localhost","username","password"); mysql_select_db("selectDB", $objConnect); ?...
OammieR's user avatar
  • 493
18 votes
3 answers
60k views

Is it possible to execute a php script in an image file? [duplicate]

I have an image upload php website. Users can upload images to my website. A user claims he can hack my website using an uploaded image. I opened all the images that he uploaded to my server with ...
open source guy's user avatar
18 votes
5 answers
4k views

Why do browsers warn about mixed content for images?

I'm dealing with a phpBB forum user who wants to set up SSL on their entire site to secure user credentials and "private" parts of the website. However, they want to preserve the traditional forum ...
jldugger's user avatar
  • 283
15 votes
4 answers
994 views

what to do after suspected intrusion on hobby webserver

I maintain a server to host my files and a number of websites for hobbies and friends. I just noticed that the site summary being returned in google for one of my domains were all porn related (...
Sam Swift's user avatar
  • 253
11 votes
2 answers
8k views

Is PHP unserialize() exploitable without any magic methods?

Say that there was a publicly accessible web page with the following PHP code: <?php class NotInteresting { public function noExploits() { echo "Whatever."; } } $unsafe = ...
Tryth's user avatar
  • 215
3 votes
2 answers
3k views

Is my code using mysqli_real_escape_string and quotes100% safe against SQL Injection?

My code is: SELECT * FROM tlb_members WHERE username="{mysqli_real_escape_string($_GET['test'])}" I'm searching and some people said using quotes in SQL statements is safe. Is this true?
Anh's user avatar
  • 61
2 votes
2 answers
4k views

XSS via REQUEST_URI

Is there any situation where an XSS attack can be performed via the PHP $_SERVER['REQUEST_URI'] variable? For those unfamiliar with it: It contains the complete URL used to access that website, ...
tim's user avatar
  • 29.6k
1 vote
1 answer
6k views

Secure Image Upload, or Bypassing PHP mime-type Check

When securing image uploads there are basically three approaches I know of (of course, ideally, all three are used): check file extension store uploaded files in non-executable directory outside the ...
tim's user avatar
  • 29.6k
97 votes
7 answers
39k views

How does hacking work?

I am specifically talking about web servers, running Unix. I have always been curious of how hackers get the entry point. I mean I don't see how a hacker can hack into the webpage when the only entry ...
user avatar
47 votes
5 answers
11k views

How to perform a security audit for a PHP application?

I have a PHP application that I would like to have audited for security. I'm familiar with most of the general security issues, but want to make sure I didn't miss anything. What steps should I take ...
VirtuosiMedia's user avatar
42 votes
6 answers
18k views

PHP files browsable: is this a vulnerability?

I have a friend who has a website developed in PHP on which we can browse all his files one after one (of course, we can not read the content of the PHP files). Do you think this is a security hole? ...
user avatar
21 votes
5 answers
2k views

Hashed password storage with random salt

Ever since I've been making sites that require a user to log in with a username and password I've always kept the passwords somewhat secure by storing them in my database hashed with a salt phrase. ...
Ryan's user avatar
  • 401
18 votes
6 answers
45k views

How safe is it to install XAMPP on my home computer to test PHP code?

I want to test some PHP code and I figure the best way is to install XAMPP - but I'm nervous about installing server software on my home computer. Is it generally safe to install XAMPP (given that I ...
Frost's user avatar
  • 181
15 votes
3 answers
3k views

How secure is aSSL (javascript)? Does it effectively mimic SSL?

Some of you may be familiar with the aSSL project, which uses AJAX/PHP to mimic the SSL protocol. It uses RSA 512 or 1024 for the keys, and AES for the actual data. It looks impressive to me in ...
Jeremy P's user avatar
  • 151
15 votes
3 answers
14k views

SQL injection can bypass login but not drop table

I've setup a test environment for running some SQL Injection against my code and learning how to defend against it. I can bypass the login form using the following in the password field: ' OR ...
Scott Helme's user avatar
  • 3,228
13 votes
4 answers
29k views

Generating an unguessable token for confirmation e-mails

I'm generating a token to be used when clicking on the link in a verification e-mail. I plan on using uniqid() but the output will be predictable allowing an attacker to bypass the confirmation e-...
Celeritas's user avatar
  • 10.2k
13 votes
3 answers
3k views

How to deobfuscate this PHP malware? [duplicate]

Two days ago a file called "images.php" appeared on a friend's server, which he noticed because it caused errors. The file contained the following. This code is of unknown origin and presumed to be ...
Robert's user avatar
  • 607
10 votes
4 answers
4k views

Reasonable way to store encrypted passwords in a webapp's database, Linux

This question is generally similar to past questions asked here, but I haven't seen one the relates to Linux. Case at hand: a PHP web app has a MySQL backend. As part of its functionality it accesses ...
Shlomi Noach's user avatar
9 votes
1 answer
2k views

Proper way to protect against XSS, when output is directly into JS not HTML?

I'm seeing plenty of examples when the output is going into HTML directly, but I'm seeing more conflicting information when the output is going straight into JS. For example if the code was: var ...
Jason's user avatar
  • 93
8 votes
4 answers
1k views

Security attacks on PHP web applications

I know about following security attacks on php applications (html,php,js). XSS SQL Injection CSFR Session Hijacking /Fixation Code Injection Remote file injection Should i know about any other ...
aWebDeveloper's user avatar
7 votes
3 answers
4k views

is it safe to allow external images to be attached to Blog or any Web content?

I am filtering all images that attached to any content of my blog: Check for file extension. Check content type using $finfo = finfo_open(FILEINFO_MIME_TYPE); I also save the image temporary on my ...
Akam's user avatar
  • 1,357
7 votes
6 answers
3k views

How to defend vs. Image Remote File Inclusion, e.g. RFI using a .gif file (Apache/PHP)?

To defend versus Remote File Inclusion where attackers try to abuse image files, I usually recommend to never use include to include image files into PHP code. Sometimes though, the avoidance of ...
Jürgen Thelen's user avatar
6 votes
3 answers
9k views

PHP crypt() or phpass for storing passwords?

When storing passwords, should I use PHP's built in crypt or phpass? If using crypt, should I use CRYPT_SHA512 or CRYPT_BLOWFISH?
willwill's user avatar
  • 505
6 votes
6 answers
3k views

What are some good, free tools to run automated security audits for PHP code?

I've been looking for some time now and have come up short. The most promising I found was Spike PHP, which seems to no longer work. I'm looking to scan my code for potential risks of SQL Injection, ...
James Simpson's user avatar
3 votes
6 answers
28k views

Use PHP to check uploaded image file for malware?

I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k. Is there any way for me to check uploaded ...
Frank E's user avatar
  • 113
2 votes
1 answer
15k views

' OR 1=1/* SQL Injection Login Bypass Question

Recently I came across a SQL Injection Cheat Sheet which contains this particular cheat sheet which I am confused by ' or 1=1/* Assuming I am testing it on this server-side code below. SELECT * FROM ...
Cash-'s user avatar
  • 57
2 votes
1 answer
3k views

Arbitrary file upload, serve JPG as PHP

I'm trying out random older WordPress exploits on my local server, I'm currently in the process trying to get this one to work: https://www.exploit-db.com/exploits/20083/ It doesn't read any headers,...
Stella's user avatar
  • 123
51 votes
3 answers
6k views

Security Review - password_hash implementation for PHP

I'm currently working on a "helper function" for PHP's core to make password hashing more secure and easier for the majority of developers. Basically, the goal is to make it so easy, that it's harder ...
ircmaxell's user avatar
  • 1,416
51 votes
9 answers
51k views

Is it bad practice to use GET method as login username/password for administrators?

I work on web applications and as you know, having an administrator panel is a must in most cases. We can see that a lot of web applications have a specific login page for administrators in which ...
Amirreza Nasiri's user avatar
50 votes
6 answers
8k views

Should I be concerned if my website throws stack information?

I have a simple login form on my web page and the URL looks like this: example.com/signup/signup.php?q=1 If I try something like this: example.com/signup/signup.php?q=1&() I'm redirected to a ...
Kevin's user avatar
  • 501
50 votes
4 answers
14k views

How to approach replacing md5 for transporting Unity game data to a remote server

TL;DR I am working on a gaming system that uses UnityScript and C# on the client and PHP on the server. A MD5 hash of the data plus a shared secret is used to check that the data has not been ...
Martin's user avatar
  • 1,087
32 votes
4 answers
82k views

Which is the best way to sanitize user input in PHP?

These are things I do when users submit data: substr if extra characters found. htmlspecialchars() + ENT_QUOTES + UTF-8 str_replace '<' '>' in user input What more things need to be done?
user2615947's user avatar

1
2 3 4 5