-1

I created a webapp in PHP (MySQL, jQuery) and now I want to take necessary security measures in order to keep it up and running and harmless for my VPS.

  1. App has several public forms ($_POST, $_GET, hidden fields). Which kind of validation should I do?
  2. App use session ($_SESSION)
  3. App uses shell_exec() with user input
  4. Data are stored in MySQL

Very basic user input is text type field expecting URL address (without HTTPS or even www)

Current measures:

  • Function for data received with $_POST or $_GET

    function secured($value) {
       $value = htmlspecialchars(stripslashes(trim($value)));
       return str_replace('&', '&', $value);
    }
    
  • I use prepared statements for MySQL

  • HTTPS

How to secure this app as much as possible?

closed as too broad by Steffen Ullrich, Xander, Neil Smithline, schroeder Nov 23 '15 at 16:05

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

2

Your homebrew validation/sanitization/whatever is flawed, screws up the data while providing no security, since when accepting the data you don't yet know where that data will be used (different places require different escaping - HTML for example requires htmlspecialchars, where as shell arguments require escapeshellarg).

You should accept user input as-is, and only sanitize it when it's actually necessary, like right before outputting it in an HTML page or as a shell argument (and different rules apply, there is no wildcard escaping function that works everywhere).

For validation, it again depends on what the app is expecting - if you need to use a user-submitted field in your code, check that it's populated and conforms to what you want (using filter_var, or regex if the former doesn't provide filters for the kind of data you expect) before using it otherwise you'll risk giving empty/incorrect values to functions which can cause exceptions or unexpected behavior.

Finally check out OWASP, review your code based on that, beware of copy-pasting snakeoil amateur "security functions" written by idiots and consider using a a popular framework which provides most of these basic functions (validation, password hashing, etc) out of the box, with the added benefit of using code that's reviewed by many people, as opposed to writing your own.

  • - Thanks for: escapeshellarg, only sanitize it when outputting it in an HTML page, OWASP and filter_var hints - consider using a a popular framework - I use one, but I want to do this app by my own. Popular frameworks come with a log of unnecessary code (performance issue). I don't want to use combine-harvester for cutting grass in my small backyard :) BTW, which "popular framework" do you suggest? – cristalix Nov 23 '15 at 15:42
  • If you're concerned about performance, consider using Phalcon - it's a C-extension framework that has very little performance impact. – André Borie Nov 23 '15 at 15:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.