I'm learning PHP and at the same time I write the examples that I get from the book to .php pages to test them and eventually publish them. My concern is about a bunch of forms that are there to test the codes; these are very basic forms that have no validation code and I would like to know if someone could do bad things into my files/hosting by injecting codes on them. Actually these forms do not point to any important data, they are only there to write on the webpage itself but without saving any information, but I have this concern since I have no knowledge of these web languages.
closed as too broad by Adi, TildalWave, Ayrx, rook, Steve Jan 23 '14 at 18:33
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
I believe you're asking about a form that will submit data to the server, and the data will be injected in a
.php file (or executed on the fly) and then the output viewed back as a way to preview PHP commands in a PHP learning environment. Looking at your comment, it's clear that this is indeed what you're trying to do.
Do not do that. You're basically providing an open
eval access to your server. You'll have to spend countless hours filtering malicious PHP statements and function calls, and you won't catch all of them; you'll miss something. There are other smart people who have spent a long time to develop such services in a secure fashion.
Create and read all the tutorials you need, but when you want to let others test it, then when you want to test or let other test, use services that are designed for that. Another possibility is to use something like EasyPHP or XAMPP to have your own development environment on your own computer.
Your main concern, if you can use these scripts to "write back" to the page, is Cross-Site Scripting (XSS). You should also be aware that just because you don't link to a file, doesn't mean someone won't find it on your site. There are tools (e.g. dirbuster) that can brute-force file and directory names on web servers to find interesting things like admin scripts.
Bottom line: don't put test data on your production server, or, if you absolutely must, at least put the scripts in a directory protected by a password (e.g. htpasswd for Apache).
EDIT: Adnan points out that you want to execute arbitrary PHP code on your server, submitted by users. That's the definition of a horrible security hole. The way that other sites get around it is via heavily sandboxing the PHP installation and blacklisting risky commands, but even then it's not perfect. My suggestion? Don't try to do this if you don't have a lot of experience in PHP, Linux administration, and security.
The answer to your question is "yes". Depending on how and what you are doing in those isolated tests, and this in conjunction to the fact that you are a newbie in this languages it is quite probable that you end up having a backdoor than allow a malicious user to control the http-user of your server and he will be able to write files, list, modify them...
Tests should be done in controlled test environments. I.E. your own pc =)