131 reputation
3
bio website phpdeveloper.org
location
age
visits member for 2 years
seen Oct 14 at 13:55

Oct
3
comment How secure are PHP sessions?
Here's a few things to think about with PHP sessions: 1. Session data, by default, is stored as "serialized" plain text. This means that all data can easily be read by anyone that either has access to the files or can pull them using some LFI exploit. Using a custom session handler with encryption is recommended. 2. Change the php.ini to make the session cookies HTTP Only. This is disabled by default. 3. Checking by IP will help 90% of the time, but consider the users - if they're coming from a firewall, they'll all be the same IP. 4. And yes, please use SSL :)
Jul
16
comment Is php DOMDocument::loadXML completely secure?
Relevant: websec.io/2012/08/27/Preventing-XXE-in-PHP.html
Jul
16
comment PHP Object Injection Prevention - OWASP
Relevant: websec.io/2014/06/13/… (see the section on "Poor unserialize handling")
May
27
comment Directory names using extensions a security risk?
I'm not sure I quite understand the question - it looks like you're asking about directory names, but then you mention naming a file with a ".php" extension. Directories named like "something.php" aren't bad, but don't allow users to define actual files with ".php" extensions on them...that's just asking for trouble. If you're going to allow users to define the name of the file for the template, I wouldn't use that directly as a file name. You could also potentially open yourself up to directory traversal or a RFI if you're not careful.