131 reputation
3
bio website phpdeveloper.org
location
age
visits member for 2 years, 1 month
seen Nov 19 at 14:26

Oct
3
comment How secure are PHP sessions?
Here's a few things to think about with PHP sessions: 1. Session data, by default, is stored as "serialized" plain text. This means that all data can easily be read by anyone that either has access to the files or can pull them using some LFI exploit. Using a custom session handler with encryption is recommended. 2. Change the php.ini to make the session cookies HTTP Only. This is disabled by default. 3. Checking by IP will help 90% of the time, but consider the users - if they're coming from a firewall, they'll all be the same IP. 4. And yes, please use SSL :)
Aug
1
answered Security risk stemming from data passed in $_GET superglobal
Jul
16
comment Is php DOMDocument::loadXML completely secure?
Relevant: websec.io/2012/08/27/Preventing-XXE-in-PHP.html
Jul
16
comment PHP Object Injection Prevention - OWASP
Relevant: websec.io/2014/06/13/… (see the section on "Poor unserialize handling")
May
27
awarded  Editor
May
27
revised Modern, security-conscious, PHP book?
added 150 characters in body
May
27
comment Directory names using extensions a security risk?
I'm not sure I quite understand the question - it looks like you're asking about directory names, but then you mention naming a file with a ".php" extension. Directories named like "something.php" aren't bad, but don't allow users to define actual files with ".php" extensions on them...that's just asking for trouble. If you're going to allow users to define the name of the file for the template, I wouldn't use that directly as a file name. You could also potentially open yourself up to directory traversal or a RFI if you're not careful.
Jan
31
awarded  Supporter
Dec
23
answered PHP Handlers and Caching
Jul
18
answered Modern, security-conscious, PHP book?
Feb
6
awarded  Teacher
Feb
6
answered What unique risks does MVC model binding bring to a website? What additional vigilance is needed?