Any vulnerabilities in user input to web Server running Apache and PHP?

Question

There is understandably a lot of emphasis on sanitizing user input handed off to PHP on a web server and numerous opinions on doing it.

Can someone please confirm there is no security problems with the following PHP code which may compromise the server through an exploit:

if($_SERVER['QUERY_STRING'] == "kjg68KGH$88@kjhik8768"){
   $_SERVER['QUERY_STRING']=NULL;
   do stuff
} else {
   $_SERVER['QUERY_STRING']=NULL;
   do other stuff
}

or

if($_POST['the-var'] == "kjg68KGH$88@kjhik8768"){
   $_POST=[];
   do stuff
} else {
   $_POST=[];
   do other stuff
}

If there is (I do not see how there could be), then why?

Answer 1

Using weak comparison in PHP is almost always a bad idea as it can lead to bugs and vulnerabilities. See here for an interesting example.

In your case, it should be mostly ok, although there are some corner-cases, eg "0x000000" == "000", "1e1" == "10", or "0xBEEF" == "48879".

Apart from that, there is no way to compromise the server with just the given code.

Answer 2

The code self is not secure, as most webservers are rfc2616 compliant. Rfc2616 is obsoleted by rfc7230. So a query with multiple query parameters with the same name are accepted. Wich one is presented to your code? If all, which one do you choose, based on what? Rfc7230 states such a request MUST be considered as an invalid request.

Answer 3

Example with a get request. Suppose you want to vote for Clinton https://..../vote.php?vote=Clinton

I send you a mail with a request to vote for Clinton with a link https://..../vote.php?vote=sanders&vote=clinton&vote=sanders

A non rfc7230 compliant webserver will accept this request. But what will be handed to php? The first vote=sanders or the last or all three as an array? You will you vote for? Most likely Sanders....

Of course you would not do this in a get, but use post. Also in a post you can add multiple parameters with the same name. A non rfc7320 compliant server will accept this.