Securing PHP Applications
Short summary:
PHP & Security PHP keeps on growing as a language, making headway into enterprise and corporate markets. Consequently PHP applications often end up working with sensitive data ...
Long summary:
Securing PHP Applications Securing PHP Applications By: Ilia Alshanetsky 2 What is Security? Security is a measurement, not a characteristic. Its is also an growing problem that requires an continually evolving solution. A good measure of secure application is its ability to predict and prevent future security problems, before someone devises an exploit. As far as application design goes, security must be considered at all times; initial spec, implementation, testing and even maintenance. 3 PHP & Security PHP keeps on growing as a language, making headway into enterprise and corporate markets. Consequently PHP applications often end up working with sensitive data. Unauthorized access to this data is unacceptable. To prevent problems a secure design is needed. 4 Accessing Input Data As of PHP 4.1, there are a series of superglobals that offer very simple access to the input data. $_GET data from get requests. $_POST post request data. $_COOKIE cookie information. $_FILES uploaded file data. $_SERVER server data $_ENV environment variables $_REQUEST combination of GET/POST/COOKIE 5 Register Globals Arguably the most common source of vulnerabilities in PHP applications. Any input parameters are translated to variables. ?foo=bar >> $foo = bar; No way to determine the input source. Prioritized sources like cookies can overwrite GET values. Un-initialized variables can be injected via user inputs. Already done by default as of PHP 4.2.0 Code with error_reporting set to E_ALL . Allows you to see warnings about the use of uninitialized variables. Type sensitive validation conditions. Because input is always a string, type sensitive compare to a Boolean or an integer will always fail ...
Source: ilia.ws
Search Terms:
Related
Mastering Regular Expressions in PHP, Regular Expressions in PHP Using regex
(regular expressions) is really easy in
PHP, and there are several functions that
exist to do regex finding and replacing
...,
more
PHP Architect's Guide to PHP Security, While the regular expression (or regex)
shown above works well, it does not
include valid ... just as it does in the
standard PHP regex. ...,
more
Securing PHP Applications, PHP & Security PHP keeps on growing as a
language, making headway into enterprise
and corporate markets. Consequently PHP
applications often end up working with
sensitive data ...,
more
