186 reputation
2
bio website
location
age
visits member for 2 years, 2 months
seen Mar 22 '13 at 13:29

Mar
22
comment Is it possible to execute a php script in an image file?
+1. This seems to me to be the most likely attack vector in this case. If you have another page that does an include() or require() where the filename can be manipulated by the caller, all he has to do is work out how to call that. If your site displays PHP error messages, they may have given him clues as to how to proceed with this.
Feb
18
answered What is better, an established framework or a homebrew solution?
Dec
18
comment Safari downloaded my php source once. Should I worry?
@BobbiBennett - yes, as long as PHP has read permissions to the file, it can be included. It doesn't have to be web accessible except for the initial PHP file that is opened by the web server. And and all includes can be stored separately. Most hosting providers will give you a default directory structure that makes it easy to do this.
Dec
14
answered Safari downloaded my php source once. Should I worry?
Nov
16
awarded  Supporter
Sep
14
awarded  Teacher
Aug
24
comment Where and How is data stored in a session?
If your PHP installation includes the Suhosin security patch (which is strongly recommended), then the session data will be encrypted.
Aug
22
answered Is it safe to store password in PHP session?
Aug
22
comment Do you need to encrypt session data?
Any hosting company worth dealing with will have the Hardened PHP patch installed which encrypts the session content anyway transparently to the user, which renders a lot of your points somewhat moot.