Image for post: Writing secure PHP code

Writing secure PHP code

17 September 2017 Estimated reading time: 4 minutes PHP 

Here we are to discuss the big security problem on the internet. Am I right if I say it's impossible to be "totally secure"? It depends on your contest, your position or your program or application your are developing. But what I want to try to resume in this post are the most focus point in this matter, the most discussed topic on web security:

Never trust the users!

Our applications must filters all inputs and escape all outputs.

Here are some topics and risks PHP applications can offer and we must prevent:

  • XSS attacks (cross site scripting)
  • Sql injections
  • Cross-site request forgery
  • DIRECTORY TRAVERSAL attacks
  • Prolbems related to PHP server configurations

Here are a few tips for writing secure PHP code:

  • Use prepared statements and parameterized queries: Prepared statements and parameterized queries can help prevent SQL injection attacks by separating the code that generates a database query from the data being passed to the query. This makes it more difficult for attackers to inject malicious code into your database.
  • Validate and sanitize user input: It is important to validate and sanitize any user input that is received by your PHP code. This can help prevent attackers from injecting malicious code or data into your application.
  • Use encryption: Use encryption to protect sensitive data, such as passwords and financial information. This can help prevent attackers from accessing this data if they are able to compromise your system.
  • Use secure authentication and authorization practices: Use secure authentication practices, such as using strong passwords and two-factor authentication, to protect against unauthorized access to your application. Use authorization controls to ensure that users only have access to the resources and functionality that they are authorized to use.
  • Keep your PHP version and libraries up to date: Make sure to keep your PHP version and any libraries or frameworks that you are using up to date. This will help ensure that you have access to the latest security updates and features.

By following these best practices, you can help ensure that your PHP code is secure and resistant to common attacks.

 

PASSWORD STRENGTH

You must have some interesting scripts to test your password strength. The criteria is always the same. To have more secure password you can use:

  • Letters and numbers
  • Capital letters
  • Some special character like - @ , . etc.

And sure, try to change the password as often as you can! BOOK: Essential PHP security

FORMS

Ensure you send a token with your form to prevent double post, undersired posts and data manipulation.

  • Semantic URL Attacks
  • File Upload Attacks
  • Cross-Site Scripting
  • Cross-Site Request Forgeries
  • Spoofed Form Submissions
  • Spoofed HTTP Requests

Covers form processing and attacks such as cross-site scripting and cross-site request forgeries.

  • Forms and Data
  • Semantic URL Attacks
  • File Upload Attacks
  • Cross-Site Scripting
  • Cross-Site Request Forgeries
  • Spoofed Form Submissions
  • Spoofed HTTP Requests

Read this chapter for free: ch02.pdf

SESSIONS

php.ini configurations

Be sure the following ini configurations are disabled with:

ini_set("register_globals", "off");ini_set("magic_quotes_gpc", "off");ini_set("allow_url_fopen", "off");

Email injection, http://en.wikipedia.org/wiki/Email_injection

Databases and SQL

Focuses on using databases and attacks such as SQL injection.

  • Exposed Access Credentials
  • SQL Injection
  • Exposed Data

Sessions and Cookies

Explains PHP's session support and shows you how to protect your applications from attacks such as session fixation and session hijacking.

  • Cookie Theft
  • Exposed Session Data
  • Session Fixation
  • Session Hijacking

Read this chapter for free: ch04.pdf

Includes

Covers the risks associated with the use of includes, such as backdoor URLs and code injection.

  • Exposed Source Code
  • Backdoor URLs
  • Filename Manipulation
  • Code Injection

Files and Commands

Discusses attacks such as filesystem traversal and command injection.

  • Traversing the Filesystem
  • Remote File Risks
  • Command Injection

Authentication and Authorization

Helps you create secure authentication and authorization mechanisms and protect your applications from things like brute force attacks and replay attacks.

  • Brute Force Attacks
  • Password Sniffing
  • Replay Attacks
  • Persistent Logins

Shared Hosting

Explains the inherent risks associated with a shared hosting environment. You are shown how to avoid the exposure of your source code and session data, as well as how to protect your applications from attacks such as session injection.

  • Exposed Source Code
  • Exposed Session Data
  • Session Injection
  • Filesystem Browsing
  • Safe Mode

Appendix A, Configuration Directives

  • Provides a short and focused list of configuration directives that deserve particular attention.

Appendix B, Functions

  • Offers a brief list of functions with which you should be concerned.

Appendix C, Cryptography

  • Focuses on symmetric cryptography and shows you how to safely store passwords and encrypt data in a database or session data store.

Resources

Books

  • Essential PHP security

Tags

Security