PHP Security & vulnerabilities

[simonc]

What are the issues you always consider for security practices and what do they relate to?

[Monkuar]

escape everything! check for negative intervals, use mysql/sessions instead of cookies/etc/etc/etc lists goes on forever

[Christian F.]

I always keep Rule 0 in my mind:

Do not underestimate the power of the dark side.

Which means always validate input, escape output, handle all errors, don't show anything internal to the user, and make sure you take all the steps you can to protect your code and files.

 

The quote is taken from Sverre H. Huseby's Innocent Code, a book I recommend everyone who's involved with web development to read.

There's also a quick summary of the rules on the page, though they've started the index at 1 instead of 0 as in the book.

[xyph]

The only time you should feel safe is with a very strong understanding of the technology and the underlying protocols.

 

Even with proper guidance, it's very easy to implement incorrectly

[Psycho]

Here are some things off the top of my head:

 

1. Never trust ANY input from the user: POST, GET, COOKIE, files, etc. Just because you have a select list doesn't mean the user will always be submitting a value from that select list. So, always analyze what should be a valid input and escape/validate accordingly. "How" you do that will be dependent upon how the data will be used and the type of data. See #2

 

2. Always escape/sanitize the data based upon context. You need to escape data differently based upon how it is used. It would be different for a DB query vs. displaying in the web page vs in an XML file. Some things to prevent: SQL Injection and XSS scripting.

 

3. Secure your files. You will likely have many files that are not meant for direct access (i.e. they are used as includes). You can put those in a directory that is not in the web root, use HTTACCESS files or put a check at the top of the file to prevent direct access.

 

4. Always verify access. If you have content that should only be shown to certain users you would want to check that security to determine if the links should be shown AND you should do the same before displaying the content. Never rely upon COOKIE data for storing credentials.

[xyph]

I'm not sure how helpful this thread can be. Unless to manage to cover nearly every potential attack vector (database,filesystem,output,client trust,etc) we could potentially just be handing out a false sense of security. That can be a very dangerous thing

[simonc]

All totally awesome suggestions guys, muchos love http://forums.phpfreaks.com/Smileys/nrg_alpha/happy-01.gif