PHPHacks.com: Security in PHP
104373
One can never be too secure when it comes to online applications. PHP has its problems, making it a bit too easy sometimes to write back code that makes for insecure applications, but, thankfully, there are some simple steps to be taken to greatly reduce these risks. This article from PHPHacks.com shares some of the easiest.   Their recommendations are:  Never, Ever, Trust Your Users Using Golbal Variables Correctly Handling Error Reporting Preventing SQL Injection Avoiding File Manipulation Avoiding Using Defaults Not Leaving Installation Files Online Avoiding Predictability  Oh, and my personal favorite, which is funny at first glance but seriously true when you really think about it "Be Completely and Utterly Paranoid".
256732
This week's latest PHPBarnstormer has been released by PHP Magazine.
277894
Chris Hartjes has posted a tutorial about the creation of a simple user registration system in an application developed in the CakePHP framework. In response to the popularity of his other article on using CakePHP's Auth component, he's created a bit of code to answer some questions.   People have been having some questions about how the password is hashed and questions about a user registration system. Of course, the snarky response is "go and read the source for Security::Hash() and create some of your own code", but it is easier to just give people some code so they stop asking.   His example code extends the User object for the model, makes a controller with a register() method call and creates the username/password form for the user the enter in their information.
390086
In another quick note from Chris Shiflett, there's a summary of php|works and some of the comments made about it:
648643
This article discusses current trends in penetration testing for web application security, and in particular discusses a framework for selecting the best tool or tools to use for these increasingly common type of application.
642167
Newly posted over on PHP Magazine's website is this week's latest PHPBarnstormer - Issue #11
23541
This week's latest PHPBarnstormer has been posted.
385236
Scott Mattocks is back with the latest installment of the PHP-GTK news, issue number 22.   It's been a while, but I finally have some time to get back to summing up the world of PHP-GTK. Things have slowed down a little in the past few months on the development side but that doesn't mean that the world of PHP-GTK 2 has stood still.   In this edition, there's a call for help for anyone that would want to join the other (4!) developers in working on the PHP-GTK 2 project as well as some general information about the project and its involvement in the community - from talks at php/db|works, International PHP Conference, and the Zend/PHP Conference to the many PHP-GTK-related articles being printed to a new online resource for PHP-GTK tutorials.
197002
On the SitePoint PHP blog today, Troels Knak-Nielsen has written up an article that talks about dependencies in your applications - those little interconnections your code relies on to do more with less.   In lack of better words, I'll call this compositional programming style. It's a style which is usually more prevalent with experienced programmers. [...] There is, however, a dark side to composition - dependencies.   He starts with a definition to bring everyone up to a level field then moves on to how their used (through a "global symbol" or directly passed in) and how they can "leak" if you're not careful.    To help protect you and your code from any kind of damage down the line, Troels suggests making a container to keep objects where they need to be. He even includes an example with namespace support to make things even easier down the road.
676141
While attending Gunter Kniesel's "Aspect-Oriented Software Development" lecture yesterday it occured to me that it might be possible to (ab)use PHP 5's __autoload(), __call(), __get(), and __set() interceptors to facilitate Aspect-Oriented Programming with PHP.
460038
In this post to his blog, Chris Shiflett talks about some issues surrounding character encoding and the cross-site scripting issues it can open up in your application.    In the post [on Good and Bad PHP Code], he provides a few useful PHP interview questions, including some questions from Yahoo. He explains that good PHP code should be Structured, Consistent, Portable and Secure   In the comments, many additional improvements have been suggested, but there's one that has yet to be mentioned. When using htmlspecialchars() without specifying the character encoding, XSS attacks that use UTF-7 are possible.    Included in the post is an example to illustrate the point as well as a solution, a simple one involving the header() function, to help correct the problem and prevent bad things from happening.   Be sure to check out http://shiflett.org/blog/2007/may/character-encoding-and-xss#comments">the comments for more great tips.
291476
Matthew Turland, like many in the PHP community these days, has been pondering PHP6 and what it might mean to both the developers and to the language itself:   Be that as it may, as a user with about five years under his belt as of now who has seen all qualities of PHP code ranging from pristine to pedantic, a thought or two has crossed my mind on the subject of the latest upcoming incarnation of the language.   Specifically, he talks about some of the hot topics like namespaces, the mysqlnd driver, Unicode support, and named parameters. Overall, though, his comments are positive, looking toward a brighter future for PHP with this upcoming edition.
357182
In a new post to his blog, Chris Hartjes, spurred on by an article in the latest edition of php|architect magazine (covering protecting your code), has shared a few opinions starting with a certain paragraph near the end.   To start, I will focus on the paragraph above. What I get out of that is that if only your source was closed and hidden from prying eyes, it would not have bugs in it. Which is, of course, total nonsense. Code has bugs because it's open and they feel safer? There are two kinds of bugs: application bugs (which is the code I would write) and system bugs (in this case, bugs that that appear from PHP itself). I'm sorry, but there is nothing I can do if there is a bug in PHP that causes my application to crash except to point this bug out to the people who have the ability to fix it.   He goes on to talk more about how protection like this (the article talks about using the IonCube Encoder) will not stop someone if they're really determine to get at the code underneath the encryption. His only suggestion is to make an application good enough that people wouldn't want to try to steal it as much and would rather pay for their version.   Encode your stuff if you want, but be aware that the minute you choose to do that you are telling your customers "I don't trust you" and I have a hard time understanding a business model that assumes people are going to want to steal the stuff you sell.
467808
Devshed has posted a new article covering one of the hottest topics in the PHP community right now - security.   Security in a scripting language such as PHP is more developer-dependent than language-dependent. In other words, although the language offers you the tools to create secure code, it cannot prevent insecure code. Thus, the degree to which code is secure almost entirely depends on how security conscious a developer is.   The article looks at three security-related topics:  Register globals error reporting code exposure  and for each provides explanation and code where needed to help the reader understand the issues and possible problems with them.
206312
(InfoWorld) - Software developers like to make installation of their programs simple and quick. So do hackers. Analysts at RSA Security early last month spotted a single piece of PHP code that installs a phishing site on a compromised server in about two seconds, the vendor noted in its monthly online fraud report for June, released on Tuesday. The code contains all of the HTML (Hypertext Markup Language) and graphics needed for the fraudulent Web site, which spoofed a financial institution that RSA did not name in the report. The ".exe" file automatically installs the code and graphics in the right directories, RSA said. It means the hacker did not have to repeatedly access the compromised server to upload graphics or other code for the site, potentially reducing the chance of the computer's security software or network software detecting something awry, RSA said. "By using such kits, fraudsters will be able to further automate the process of hijacking servers and creating new phishing sites," the report said. It doesn't bode well forÂ combatting the problem of phishing, where hackers try to elicit passwords or financial information via look-alike Web sites. Despite efforts to quickly shut sites down, phishing sites averaged a 3.8-day life span in May, according to the Anti-Phishing Working Group, which released its latest statistics on Sunday. Data from market analyst Gartner released last month showed that phishing attacks have doubled over the last two years. Gartner said 3.5 million adults remembered revealing sensitive personal or financial information to a phisher, while 2.3 million said that they had lost money because of phishing. The average loss is $1,250 per victim, Gartner said. Â
230013
In this new article from DevShed.com, they provide a high-level introduction to PHP - what it is, where it came from, some of the sample features (of both PHP 4 and PHP 5), as well as some of the drawbacks for the language.
149334
On the heels of a rant posted by Matt Mullenweg (of Wordpress), Ed Finkler has posted some of his own thoughts and rebuttals to the points Matt made.   Among these points are comments about PHP5 features that "could be helping Wordpress users right now" including:   Parameterized SQL input to eliminate SQL injection attacks Filter extension to combat XSS, CSRF, etc. attacks Prepared statement/transaction support in PDO and MySQLi Improved OOP features and support (code quality, extensibility)   Ed pushes that it's not about the slow adoption of PHP5 in other places. Its about the slow adoption of it in Wordpress so far as it relates to Matt:   The thing is, support of PHP5-only features in WP would give it better speed and security right now. And especially in the case of security, Matt's reliance on what users say they want is a critical error: users don't ask about security until well after it becomes a serious issue. Wordpress has one of the worst security records of any PHP application, so I'll go out on a limb and say that it's a problem now. Even if WP users aren't talking about it, WP's core dev team should have addressed this already.