Questions tagged [php]
Security aspects concerning code written in the programming language PHP which is often used for web applications.
1,607
questions
163
votes
2
answers
22k
views
I found unknown PHP code on my server. How do I de-obfuscate the code?
We've been getting a lot of noise regarding hacked PHP files here, and it's taking a lot of time to answer these questions. In many cases, they are off-topic. We've had a discussion about this on ...
- 22.5k
143
votes
9
answers
34k
views
Hosting company advised us to avoid PHP for security reasons. Are they right?
I'm doing a redesign for a client who's understandably concerned about security after having been hacked in the past. I had initially suggested using a simple PHP include for header and footer ...
- 1,373
121
votes
11
answers
53k
views
Hacker used picture upload to get PHP code into my site
I'm working on a website — right now it's in early stages of testing, not yet launched and just has test data - thank goodness.
First of all, a hacker figured out the password to log onto the ...
- 1,295
97
votes
7
answers
39k
views
How does hacking work?
I am specifically talking about web servers, running Unix. I have always been curious of how hackers get the entry point. I mean I don't see how a hacker can hack into the webpage when the only entry ...
user7360
72
votes
5
answers
27k
views
Found suspicious, obfuscated PHP file. Is this a hack attempt on my website? [duplicate]
I just noticed that the top line of my index.php file got changed to what's below.
<?php preg_replace("\xf4\x30\41\x1f\x16\351\x42\x45"^"\xd7\30\xf\64\77\312\53\40","\373\x49\145\xa9\372\xc0\x72\...
- 709
65
votes
6
answers
32k
views
How to Securely Implement a "Remember Me" Feature?
Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period (let'...
- 863
61
votes
6
answers
24k
views
Should I obscure database primary keys (IDs) in application front end?
I'm working on an application which allows a moderator to edit information of user.
So, at the moment, I have URL's like
http://www.example.com/user/1/edit
http://www.example.com/user/2/edit
I'm a ...
51
votes
9
answers
50k
views
Is it bad practice to use GET method as login username/password for administrators?
I work on web applications and as you know, having an administrator panel is a must in most cases. We can see that a lot of web applications have a specific login page for administrators in which ...
- 867
51
votes
3
answers
6k
views
Security Review - password_hash implementation for PHP
I'm currently working on a "helper function" for PHP's core to make password hashing more secure and easier for the majority of developers. Basically, the goal is to make it so easy, that it's harder ...
- 1,416
50
votes
4
answers
14k
views
How to approach replacing md5 for transporting Unity game data to a remote server
TL;DR
I am working on a gaming system that uses UnityScript and C# on the client and PHP on the server. A MD5 hash of the data plus a shared secret is used to check that the data has not been ...
- 1,067
50
votes
6
answers
7k
views
Should I be concerned if my website throws stack information?
I have a simple login form on my web page and the URL looks like this:
example.com/signup/signup.php?q=1
If I try something like this:
example.com/signup/signup.php?q=1&()
I'm redirected to a ...
- 501
47
votes
3
answers
6k
views
Security implications of stolen .git/objects/ files
As a security in-charge, I just noticed that one of our production web apps was attacked by some hackers. The attacker accessed the .git/objects/ files.
I already modified .htaccess to make .git and ...
47
votes
5
answers
11k
views
How to perform a security audit for a PHP application?
I have a PHP application that I would like to have audited for security. I'm familiar with most of the general security issues, but want to make sure I didn't miss anything.
What steps should I take ...
- 3,242
47
votes
5
answers
8k
views
Password security in databases - today still best practice? [duplicate]
Possible Duplicate:
Which password hashing method should I use?
There are a ton of great posts about password security in databases on stack overflow and on other sites and as I am completely new ...
- 481
46
votes
4
answers
69k
views
How do you know your server has been compromised?
I recently helped a client who had their server hacked. The hackers added some PHP code into the header of the homepage redirecting the user to a porn website — but only if they came from Google. This ...
- 585
45
votes
2
answers
36k
views
Risks of a PHP image upload form
My client wants a photography site where users can upload their photos in response to photography competitions. Though technically this isn't a problem, I want to know the risks associated with ...
- 553
42
votes
7
answers
15k
views
Exploiting MD5 vulnerability in this PHP form?
I've been practicing in security-related topics and I came upon this problem which I don't understand at all. You receive a form with one input named pass, and this is the code you need to bypass:
&...
- 890
41
votes
6
answers
17k
views
PHP files browsable: is this a vulnerability?
I have a friend who has a website developed in PHP on which we can browse all his files one after one (of course, we can not read the content of the PHP files).
Do you think this is a security hole?
...
user45139
39
votes
4
answers
9k
views
Convince the company not to store credit card numbers in our webapp
The company I work for needs a system to perform monthly credit card charges to customer accounts. Customers will be able to update their credit card information from an online interface written in ...
- 393
39
votes
4
answers
35k
views
Is it safe to store the database password in a PHP file?
My connection.php file stores the credentials to connect to the database:
<?php
$objConnect = mysql_connect("localhost","username","password");
mysql_select_db("selectDB", $objConnect);
?...
- 493
38
votes
1
answer
5k
views
default.php file found on the server, is this a security threat?
I found a file named "default.php" on the server with following code
eval(gzinflate(base64_decode(
"DZVFrsUIggTv0qsqeWEmjXphZrafYdMyM7NPP/8IGcrILK90+Kf+2qka0qP8J0v3ksD+V5T5XJT//IdPfvI3u+...
- 483
37
votes
6
answers
109k
views
Is it possible for a hacker to download a php file without executing it first?
I have a php website where everything is in the public_html\ folder, including an includes folder with config and classes. I told my developer to move it away from public folder but he said there is ...
- 471
37
votes
3
answers
10k
views
How to encrypt in PHP, properly?
How do I encrypt data in PHP, properly, using symmetric-key encryption? I have a message M and a secret S. I'm looking for a solution that uses cryptography properly without making any of the usual ...
- 99.1k
35
votes
3
answers
2k
views
Why do WordPress installations retrieve the crypto secrets remotely on installation?
It seems that WordPress retrieves all the crypto constants remotely (via HTTPS):
// setup-config.php
$secret_keys = wp_remote_get( 'https://api.wordpress.org/secret-key/1.1/salt/' );
Are there any ...
- 495
34
votes
11
answers
10k
views
How to limit the impact of and reduce the risk of SQL injection for existing website?
Our website is 100% API based (with an SPA client). Recently, a hacker managed to get our admin's password (hashed with SHA-256) through SQL injection (and cracking pwd) like this:
https://example....
- 1,051
34
votes
5
answers
10k
views
Does changing an uploaded executable's file extension to .png render it safe?
A colleague of mine has a personal website in which he allows users to upload anything within a certain size,
but before the actual upload he checks to see the file extension:
if ( $type == 'image/...
- 511
33
votes
1
answer
4k
views
Crashing the sha1() function in PHP?
I am working on the following war game from Defend The Web, which requires me to do a source code review to login as the user memtash. The code is on GitLab here.
Here is my methodology:
Reset the ...
- 715
33
votes
5
answers
6k
views
Should passwords be revealed in error message?
I am having pet-peeve with PHP's PDO class. As you can see on the Warning note: it reveals database password by default if an exception was not caught (when display errors is on which is a probable ...
- 2,938
32
votes
4
answers
80k
views
Which is the best way to sanitize user input in PHP?
These are things I do when users submit data:
substr if extra characters found.
htmlspecialchars() + ENT_QUOTES + UTF-8
str_replace '<' '>' in user input
What more things need to be done?
- 421
32
votes
3
answers
80k
views
How can I use this path bypass/exploit Local File Inclusion?
I have tried to run a vulnerability scanning script (Uniscan 6.0) on some websites and then I found a site which is exploitable with this following path. (included a word "invalid" , params/website ...
- 549
31
votes
4
answers
15k
views
Is $_SERVER[ ] a safe source of data in PHP?
Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]?
- 419
30
votes
2
answers
9k
views
Important data can be modified from the developer console. What should I do?
Scenario: I have a to-do list that is generated with JavaScript using JSON that was encoded on the server side. I put the todo item id in the HTML id attribute. So the process goes like this:
Server ...
- 427
29
votes
2
answers
3k
views
Is the undesirable conversion of a scientific number a vulnerability?
I noticed in several penetration tests that PHP is converting values like 1e9 to 1000000000 while the max accepted string length of this number is 3 (in the database storage and as maxlength property ...
- 6,337
28
votes
7
answers
5k
views
How to replace SSL/TLS?
I have to make a website for a NGO (Non-Governmental Organization), and they have the minimal options from their provider, so they can't have SSL/TLS (barely only HTML/PHP/MySQL/JS)
The data that ...
- 391
27
votes
12
answers
10k
views
Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function
Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql_real_escape_string() function?
- 287
27
votes
8
answers
8k
views
What security risks are there in allowing someone to upload PHP scripts?
Let's say that a partner wants to upload a PHP script to my Apache server. What kind of mayhem could be caused by this?
Which PHP parameters pose threats? If those PHP parameters are fully disabled, ...
- 487
27
votes
4
answers
37k
views
How to hijack a session?
Despite the blatant title of the question, this is actually for a genuine purpose.
My site uses PHP code like this:
$select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'";
...
- 469
26
votes
5
answers
7k
views
How to deal with this fundamental problem with the advice: "Don't trust obscure PHP libraries that nobody uses!"?
Frequently, I'd say in virtually every case, there is only one PHP library for any particular problem. (I don't count obsolete, abandoned, trash ones.)
Therefore, it's never a "choice" by me to use ...
26
votes
1
answer
17k
views
Is this a backdoor?
I found the code below on my customers site. It looks like a typical backdoor hidden with hexadecimal, but I'm not 100% sure.
<?php if (!isset($GLOBALS["\x61\156\x75\156\x61"]))
{
$ua ...
- 363
26
votes
1
answer
9k
views
What's the security issue with base64 encoding/decoding?
http://phptester.net/ yields the warning
WARNING base64_decode() has been disabled for security reasons
Why?
Besides the obvious vulnerabilities that have nothing to do with base64_decode (...
- 391
26
votes
2
answers
12k
views
What are the best practices for hardening a php.ini file?
In order to secure a PHP installation, what are the best settings for a php.ini file? What is absolutely vital in terms of security? What is recommended for most use cases?
- 3,242
25
votes
4
answers
8k
views
Is it safe to allow www-data to execute privileged commands?
I have noticed several questions on Stack Overflow, like this one, about executing commands with root privileges using PHP. The answer proposed to add the line
www-data ALL=(ALL) NOPASSWD: ALL
to ...
- 353
25
votes
3
answers
9k
views
What steps should be taken to validate user uploaded images within an application?
Recently I have worked on a number of applications that need to process user uploaded images steps have been taken to validate the extension and the mime type.
But what else can be done to ensure ...
- 9,427
24
votes
6
answers
77k
views
Is there a way to download a PHP file without it being executed?
I recently got a phishing mail of unusually bad quality; "Please imediatly sign in under the following link, as we are your bank, you know"-ish. The link points to an unconvincing URL with .php at the ...
- 711
24
votes
3
answers
44k
views
How secure are sha256 + salt hashes for password storage [duplicate]
I started reading about password hashing recently on multiple sites like this page on crackstation and others, and for what I have understood, I should avoid using hashing algorithms like md5 and sha1 ...
- 351
24
votes
4
answers
6k
views
Should I use Suhosin for PHP?
Suhosin can be used to increase the security of your PHP application. I can really see the use of it when you are using shared hosts, with multiple (possibly evil) people running their PHP apps there.
...
- 2,759
22
votes
8
answers
15k
views
PHP malware/shell keeps resurrecting [duplicate]
So I've been fighting this problem for months now and decided that it's beyond my limited (if at all) server skills, and that I need help from the pros.
I have a VPS (with root access) which hosts ...
- 321
22
votes
7
answers
3k
views
How to exploit the "PHP_MAGIC_QUOTES ON" vulnerability in order to cause max damage?
I've found a whole lot of SQL injection exploits in some systems I maintain. I know how to prevent the injection, but I would like to demonstrate to my CEO and CTO how dangerous it is if we don't have ...
- 16.1k
22
votes
4
answers
13k
views
How did Anonymous use UTF-16 ASCII to fool PHP escaping?
A few months ago, Anonymous took down a child pornography site using SQL-injection. I read in this article that Anonymous claimed that "the server was using hardened PHP with escaping," but they were ...
- 333
21
votes
2
answers
4k
views
Could this kind of authentication be attacked?
I'm not a cybersecurity expert but just a webmaster and I wonder if this kind of authentication would be dangerous. I test the password like this on the server side using PHP:
if (isset($_POST['...
- 321