OSSCube's picture
From OSSCube rss RSS  subscribe Subscribe

PHP Security By Mugdha And Anish 



Mugdha and Amish from OSSCube present on Php security at OSSCamp, organized by OSSCube - A Global open Source enterprise for Open Source Solutions

To know how we can help your business grow, leveraging Open Source, contact us:

India: +91 995 809 0987
USA: +1 919 791 5427
WEB: www.osscube.com
Mail: sales@osscube.co

 

 
 
Views:  767
Downloads:  3
Published:  May 22, 2009
 
0
download

Share plick with friends Share
save to favorite
Report Abuse Report Abuse
 
Related Plicks
Hire Professional PHP Framework Programmers

Hire Professional PHP Framework Programmers

From: bellamartin
Views: 299 Comments: 0
Php Web Application Development have a professional team of PHP Framework Developers and they developed most common Php frameworks. Know more about PHP Frameworks at http://www.phpwebapplicationdevelopment.com/php-framework-development.html
 
PHP Application Development

PHP Application Development

From: Spencerwebb
Views: 29 Comments: 0
PHP Application Development Company in India offers Custom PHP Website Development Services like PHP Development, PHP Programming India, PHP Web Development, Affordable PHP Development, PHP Web Application Development for affordable price.
 
PHP, PHP Developer, Hire PHP Developer, Hire PHP Programmer, PHP Web Programmer, Hire PHP Web Progra

PHP, PHP Developer, Hire PHP Developer, Hire PHP Programmer, PHP Web Programmer, Hire PHP Web Progra

From: bchrisopher
Views: 627 Comments: 0
Get Web Development feature listing for PHP Development, PHP Web Development. Hire PHP Web Application Development, Hire PHP Website Developer. Hire PHP Web Developer, Hire PHP Developer, Hire PHP Programmer, PHP Web Development, Hire PHP Programmer (more)

 
Versatile PHP Framework for Dynamic Web Development

Versatile PHP Framework for Dynamic Web Development

From: SoftwebSolutions
Views: 22 Comments: 0
PHP is a robust framework that enables to build attractive and stable web applications and websites for social networking, eCommerce and other purposes. It is a highly scalable, error-free, and secure platform for web development.
 
Anish Dave

Anish Dave

From: alastair1
Views: 19 Comments: 0
Anish Dave in Aurora has over 10 years of professional experience in leading finance management firms.
From 2006 to 2007, he served ABN Amro as a Business Analyst. Prior to this, from 2005 to 2006, he worked as a Consultant (more)

 
Hire PHP Develope1

Hire PHP Develope1

From: AliciaRodricks
Views: 109 Comments: 0
Hire PHP Developer - We offer Hire PHP Developer or Hire PHP Programmer for PHP Programming and PHP Development on full time and hourly basis.
 
See all 
 
More from this user
Secrets Of MySQL Optimization & Performance Tuning At OSSPAC 2009

Secrets Of MySQL Optimization & Performance Tuning At OSSPAC 2009

From: OSSCube
Views: 1086
Comments: 0

Securing Your Webserver By Pradeep Sharma

Securing Your Webserver By Pradeep Sharma

From: OSSCube
Views: 755
Comments: 0

OSSCube - A Global Open Source Enterprise for Open Source Solutions

OSSCube - A Global Open Source Enterprise for Open Source Solutions

From: OSSCube
Views: 610
Comments: 0

Symfony by (OSSCube) - A Global Open Source Enterprise for Open Source Solutions

Symfony by (OSSCube) - A Global Open Source Enterprise for Open Source Solutions

From: OSSCube
Views: 856
Comments: 0

Zend Framework By Sanjay Aggarwal

Zend Framework By Sanjay Aggarwal

From: OSSCube
Views: 975
Comments: 0

MySQL Services by OSSCube - A Global Open Source Enterprise For Open Source Solutions

MySQL Services by OSSCube - A Global Open Source Enterprise For Open Source Solutions

From: OSSCube
Views: 671
Comments: 0

See all 
 
 
 URL:          AddThis Social Bookmark Button
Embed Thin Player: (fits in most blogs)
Embed Full Player :
 
 

Name

Email (will NOT be shown to other users)

 

 
 
Comments: (watch)
 
 
Notes:
 
Slide 1: OSScamp, Impetus Noida, Sept,’07 Anish & Mugdha Value One InfoTech
Slide 2: Topics of Discussion   Importance of PHP Security Concerns of       PHP Security Input Validation Cross-Site Scripting SQL Injection Code Injection Session Security Shared Hosting
Slide 3: Importance of PHP Security   PHP is widely used language for web applications PHP is making headway into enterprise as well as corporate markets. Most effective & often overlooked measure to prevent malicious users PHP applications often end up working with sensitive data.  
Slide 5: Input Validation   All user inputs are unreliable and can’t be trusted. Need for validating any user input before use :  Unexpected Modification by the user  Intentional attempt to gain unauthorized access to the application  Attempt to crash the application by the malicious users
Slide 6: Register Globals   Most common source of vulnerabilities in PHP applications. Any input parameters are translated to variables :?foo=bar >> $foo = “bar”; No way to determine the input source.  Prioritized sources like cookies can overwrite GET values. When register global is set ON, un-initialized variables can be “injected” via user inputs.  
Slide 7: Solutions To Register Globals   Disable register_globals in PHP.ini (Disabled by-default as of Alternative to Register Global : SUPER GLOBALS  $_GET – data from get requests.  $_POST – post request data.  $_COOKIE – cookie information.  $_FILES – uploaded file data.  $_SERVER – server data  $_ENV – environment variables  $_REQUEST – mix of GET, POST, COOKIE PHP 4.2.0)
Slide 8: Contd…  Type sensitive validation conditions.  Because input is always a string, type sensitive compare to a Boolean or an integer will always fail.  Example if ($authorized === TRUE) { // LOGIN SUCCESS }
Slide 9: Contd…  Code with error_reporting set to E_ALL.  Allows you to see warnings about the use of un-initialized variables. Use of constants  Created via define() function  Once set, remains defined until end of request  Can be made case-insensitive to avoid accidental access to a different datum caused by case variance. 
Slide 10: Cons of $ REQUEST  Suffers from the loss of data problem, caused when the same parameter is provided by multiple input sources. PHP.ini: variables_order = GPCS (Last data source has highest priority) Example echo $_GET['id']; // 1 echo $_COOKIE['id']; // 2 echo $_REQUEST['id']; // 2 Use the input method-specific superglobals intead of $_REQUEST   
Slide 11: Numeric Data Validation  All data passed to PHP (GET/POST/COOKIE) ends up being a string. Using strings where integers are needed is not only inefficient but also dangerous. Casting is a simple and very efficient way to ensure that variables contain numeric values. Example of floating point number validation   if (!empty($_GET['price'])) { $price = (float) $_GET['price']; } else $price = 0;
Slide 12: String Validation  PHP comes with a ctype, extension that offers a very quick mechanism for validating string content. if (!ctype_alnum($_GET['login'])) { echo "Only A-Za-z0-9 are allowed."; } if (!ctype_alpha($_GET['captcha'])) { echo "Only A-Za-z are allowed."; } if (!ctype_xdigit($_GET['color'])) { echo "Only hexadecimal values are allowed"; }
Slide 13: Using Magic Quotes  What are Magic Quotes ??  Problems associated with it !!  How to deal with it ??
Slide 15: Cross Site Scripting (XSS)  Cross Site Scripting (XSS) is a situation where by attacker injects HTML code, which is then displayed on the page without further validation.     Can lead to embarrassment Session take-over Password theft User tracking by 3rd parties
Slide 16: Preventing XSS  Prevention of XSS is as simple as filtering input data via one of the following:  htmlspecialchars() Encodes ‘, “, <, >, &  htmlentities() Convert anything that there is HTML entity for.  strip_tags() Strips anything that resembles HTML tag.  Tag allowances in strip_tags() are dangerous, because attributes of those tags are not being validated in any way.
Slide 17: Preventing XSS  $str = strip_tags($_POST['message']);  // encode any foreign & special chars $str = htmlentities($str);  // strip tags can be told to "keep" certain tags $str = strip_tags($_POST['message'], '<b><p><i><u>');  // tag allowance problems <u onmouseover="alert('JavaScript is allowed');"> <b style="font-size: 500px">Lot's of text</b> </u>
Slide 19: SQL Injection  SQL injection is similar to XSS, in the fact that not validated data is being used. But in this case this data is passed to the database.  Arbitrary query execution  Removal of data.  Modification of existing values.  Denial of service.  Arbitrary data injection.  // consider this query, it will delete all records from users $name = “mugdha’; DELETE FROM users;”; mysql_query(“SELECT * FROM users WHERE name =’{$name}’”);
Slide 20: SQL Escaping  If your database extension offers a specific escaping function then always use it; instead of other methods  MySQL  mysql_escape_string()  mysql_real_escape_string()  PostgreSQL  pg_escape_string()  pg_escape_bytea()  SQLite  sqlite_escape_string()
Slide 21: SQL Escaping in Practice  // undo magic_quotes_gpc to avoid double escaping if (get_magic_quotes_gpc()) { $_GET['name'] = stripslashes($_GET['name']; $_POST['binary'] = stripslashes($_GET['binary']); } $name = pg_escape_string($_GET['name']); $binary = pg_escape_bytea($_POST['binary']); pg_query($db, "INSERT INTO tbl (name,image) VALUES('{$name}', '{$image}')");
Slide 22: Escaping Shortfall  When un-quoted integers are passed to SQL queries, escaping functions won’t save you, since there are no special chars to escape.  http://example.com/db.php?id=0;DELETE%20FROM%20users  <?php $id = sqlite_escape_string($_GET['id']); // $id is still 0;DELETE FROM users sqlite_query($db,"SELECT * FROM users WHERE id={$id}"); // Bye Bye user data... ?>
Slide 23: Prepared Statements  Prepared statements are a mechanism to secure and optimize execution of repeated queries.  Works by making SQL “compile” the query and then substitute in the changing values for each execution.  Increased performance, one compile vs one per query.  Better security, data is “type set” will never be evaluated as separate query.  Supported by most database systems.  MySQL users will need to use version 4.1 or higher.  SQLite extension does not support this either.
Slide 24: Prepared Statements  <?php $data = "Here is some text to index"; pg_query($db, "PREPARE my_stmt (text) AS INSERT INTO search_idx (word) VALUES($1)"); foreach (explode(" ", $data) as $word) {// no is escaping needed pg_query($db, "EXECUTE my_stmt({$word})"); } // de-allocte the prepared statement pg_query($db, "DEALLOCATE my_stmt"); ?> Unless explicitly removed, prepared statements “stay alive” between persistent connections.
Slide 26: Code Injection  Code Injection is the execution of arbitrary local or remote code.  The two of the most common sources of code injection are:  Dynamic paths/files used in require/include statements  eval(): A major source of code injection is the improper validation of eval().
Slide 27: Code Injection Prevention  Avoid using dynamic or relative paths/files in your code. Although somewhat less convenient; always use full paths, defined by constants, which will prevent attacks like these:  <?php //dynamic path $_GET['path'] = ‘http://bad_site.org’; include "{$_GET['path']}/header.inc"; //dynamic file $_GET[‘interface’] = ‘../../../../../etc/passwd’; require‘home/mbr/profile/templates_c/interfaces/’.$_GET[‘interface’]; ?>  There are some other ways to secure include or require calls...
Slide 28: Code Injection Prevention  work with a white-list of acceptable values. //create an array of acceptable file names $tmpl = array(); foreach(glob("templates/*.tmpl") as $v) { $tmpl[md5($v)] = $v; } if (isset($tmpl[$_GET['path']])) { $fp = fopen($tmpl[$_GET['path']], "r"); }
Slide 30: Session Security    Sessions are a common tool for user tracking across a web site. For the duration of a visit, the session is effectively the user’s identity. If an active session can be obtained by 3rd party, it can assume the identity of the user who’s session was compromised.
Slide 31: Securing Session ID  To prevent session id theft, the id can be altered on every request, invalidating old values. <?php session_start(); if (!empty($_SESSION)) { // not a new session session_regenerate_id(TRUE); // make new session id } ?>  Because the session changes on every request, the “back” button in a browser will no longer work, as it will make a request with the old session id.
Slide 32: Session Validation  Another session security technique is to compare the browser signature headers. session_start(); $chk = @md5( $_SERVER['HTTP_ACCEPT_CHARSET'] . $_SERVER['HTTP_ACCEPT_ENCODING'] . $_SERVER['HTTP_ACCEPT_LANGUAGE'] . $_SERVER['HTTP_USER_AGENT']); if (empty($_SESSION)) $_SESSION['key'] = $chk; else if ($_SESSION['key'] != $chk) session_destroy();
Slide 33: Safer Session Storage  By default PHP sessions are stored as files inside the common / tmp directory.  This often means any user on the system could see active sessions and “acquire” them or even modify their content.  Solutions?  Separate session storage directory via session.save_path  Database storage mechanism, mysql, pgsql, oci, sqlite.  Custom session handler allowing data storage anywhere.
Slide 35: Shared Hosting  Most PHP applications run in shared environments where all users “share” the same web server instances. This means that all files that are involved in serving content must be accessible to the web server (world readable). Consequently it means that any user could read the content of files of all other users.  
Slide 36: The PHP Solution  PHP’s solution to this problem are 2 php.ini directives.  open_basedir – limits file access to one or more specified directories.  Relatively Efficient.  Uncomplicated.  safe_mode – limits file access based on uid/gid of running script and file to be accessed.  Slow and complex approach.  Can be bypassed with little effort.
Slide 37: References  php|architect’s Guide to PHP Security  By Ilia Alshanetsky  Essential PHP Security  By Chris Shiflett
Slide 38: Thank you! For more information, contact us: OSSCube India: +91 995 809 0987 USA: +1 919 791 5427 Web: www.osscube.com Mail: info@osscube.com

   
Time on Slide Time on Plick
Slides per Visit Slide Views Views by Location