Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

1
vote
4answers
179 views

MySQL user passwords in PHP

How do I prevent exposing MySQL usernames and passwords in PHP code when establishing a connection?
1
vote
3answers
97 views

CLI API that requires plaintext user details

I've been tasked with writing a module for my company to interface with an external api. This api has a syntax similar to ssh where I have to incorporate the user details as well as the host address ...
-5
votes
2answers
108 views

Is this something exploitable in this code?

Is there any possibility to pass this weak comparison? Can user input a file with an extension not contained in $allowed and get past the security check? $allowed = array('txt','docx'); if ...
2
votes
1answer
332 views

How much of a security problem is PHP's proc_open() on a shared host

My company is developing a PHP system that needs to interact with Git on the server, which can currently most conveniently be done by allowing external calls via proc_open(), system() and the likes. ...
1
vote
1answer
63 views

what is the best way to know if the entered decryption key is correct?

I was searching for a way to store the encryption key of AES_ENCRYPT and found a good answer here: where to store a key for encryption However, now I am trying to use "Type in the encryption key when ...
1
vote
1answer
32 views

PHP BLENC extension security concern

PHP BLENC is a extension that allows PHP developer encrypt their code, protect their ideas and avoid illegal copy. Although BLENC allow developer to define the main encryption key in source(in the ...
0
votes
1answer
49 views

Wordpress - 3.9 - uploading a php file through media gallery

I'm using Wordpress 3.9.2. As we all know, Wordpress media-upload has some restrictions - you can't upload a PHP file, cause it may be malware. There is an app called: iCon2PHP that can merge php ...
-1
votes
1answer
189 views

Is there a way to bypass the inbuilt php functions for sqlinjection

If there is a way to bypass the built-in functions of PHP to protect against SQL injection or I should rely on some other filters rather than depending on built-in functions?
-1
votes
1answer
1k views

PHP/Ajax Data transmission security

I'm learning about web security mechanisms. I have developed the following system in PHP and JavaScript: assuming that I have a page named: messages.php which is a real-time chat system. first when ...
-2
votes
1answer
75 views

How to protect data at rest in a php application?

I was wondering which is the best way to secure data at rest (encrypt / decrypt) in a php application ( eq: stored in a database ) using AES ? Where is the best way to store the keys ?
3
votes
0answers
92 views

DVWA - Command Injection (high level)

I am attempting to educate myself further on web securities using DVWA. I am stumped on Command Injection, on the high level The help states The developer has either made a slight typo with the ...
3
votes
0answers
147 views

Is this PHP TOTP (time based one time password) idea sound?

Disclaimer: I am not very familiar with safety techniques in general. The problem: Quickly create lots of small files in server from a bash script. I used to use scp (secure copy) in order to create ...
2
votes
0answers
86 views

Is MySQL CONCAT with PDO enough to protect LIKEs from SQL injection?

I'm developing a user-facing, public-accessible website where the user can input an arbitrary, hostile search term. After that, the app must do something conceptually like this against a MySQL db ...
2
votes
0answers
107 views

Obtaining large data sets for research: MySQL, PHP, Apache, etc

I have been looking around the web for large data sets (specifically web related log files - MySQL, PHP, Apache, and so on) that contains data of attempted intrusions/exploits. I am doing some ...
1
vote
0answers
49 views

Is there anything to worry about — worth putting security on a simple test site?

So I want to make a site, this site won't have users (so no one but me will be able to post to the site) or anything it will just echo out items from Mysql like title and text-body I was wondering if ...
1
vote
0answers
40 views

Folder Access restriction in Shared Hosting

In shared hosting (where I don't have access to httpd.conf files) I want PHP files in "MyTargetFolder" to not have ability to access anything in upper directories. It needs some configuration like ...
1
vote
0answers
100 views

IIS | Block execution of files in directory

I am dealing with user uploads via a PHP application. I want to secure the server so no exploits are available to the user, such as uploading a php shell and executing it. I have set it so all ...
1
vote
0answers
859 views

Codeigniter RESTful web api creation for mobile and web applications general guidelines

I'm having application with running good in codeigniter, mysql and jquery. Currently we are planning to evaluate our web application with mobile application. So we planned to develop web application, ...
1
vote
0answers
212 views

Secure Requests Between iOS App and PHP Server

I'm developing an iOS app that requires data to be sent to a server to process a transaction. The data is stored on Stripe (A credit card service) so I do not need to worry about encrypting / storing ...
1
vote
0answers
92 views

Where to save digital content and prevent sharing?

I've been inspired by the answer to the question here: Location to store an encryption key It gave me a lot to think about. My friend and I are building a website and we've encountered a problem in ...
1
vote
0answers
95 views

trackback spotted in multple http errors

[Sun May 11 12:24:46 2014] [error] [client private ip] [X_FORWARDED_FOR 27.159.207.165] Path not found: /contact_us_public.php/trackback/, referer: http://www.mydomain.net/contact_us_public.php Does ...
1
vote
0answers
2k views

Do I keep my PHP simple auth session secure enough?

I'm experimenting with security, cryptography and web applications. My aim is to create simple login system that is realy secure enough. I'd like to share my approach to keep authenticated session ...
1
vote
0answers
206 views

Implementation of different BCrypt versions

I'm fairly new to encryption, and I am investigating the different kind of encryptions. I want to encrypt passwords in a secure way. I discussed this with my colleague, and he said that BCrypt is the ...
1
vote
0answers
97 views

Is what flexi_auth does with its use of its $this->auth object good practice?

I am looking at the authentication library Flexi_auth for CodeIgniter. To use the library you have to create a object one time in the controller before the lib is used Like this: `$this->auth ...
0
votes
0answers
161 views

Secure REST API using Public/Private keys?

I was having a conversation with some programmer friends about securing an API without server modification. Only SFTP access to the filesystem is allowed and OpenSSL extension is installed, the admin ...
0
votes
0answers
56 views

best operation mode for Rijndael-256 in PHP

so my question is about the operation mode. In another thread I heard that ECB is bad which makes sense when I read about it, so I wanna change some things at my Crypto to make it better and wanted to ...
0
votes
0answers
93 views

Export detailed reports from Rips Vulnerability Scanner 0.55

I am using RIPS 0.55 to scan for static source code vulnerabilities. Currently when running it at the directory level it just gives the category and the list of files. Is there a way to extract ...
0
votes
0answers
114 views

Bypassing Change Name Uploader

I have read all of the questions available on SE about bypassing the change name uploader. Consider an uploader which changes the file name each time you try to upload a file. The only allowed formats ...
0
votes
0answers
39 views

How to help devs use HMAC safely with multiple data values?

I work on an open source web app framework whose users (developers) need to generate "security tokens" (MACs) for various purposes. Since they've traditionally been using vulnerable methods like ...
0
votes
0answers
883 views

session management and login php scripts

I want to to write login scripts for clients websites to make them more secure. I want to know what best practices I can implement into this. There are password protected control panels in abundance, ...
0
votes
0answers
354 views

Active Directory Injection attack

Is there a possible way of injecting code to pull data from Active directory? I have written a PHP page that executes Powershell and is able to change passwords to a controlled group of people. ...