PHP security from the inside
54585
Stefan Esser gets set for the month of PHP bugs Stefan Esser is the founder of both the Hardened-PHP Project and the PHP Security Response Team (which he recently left). Federico Biancuzzi discussed with him how the PHP Security Response Team works, why he resigned from it, what features he plans to add to his own hardening patch, the interaction between Apache and PHP, the upcoming "Month of PHP bugs" initiative, and common mistakes in the design of well-known applications such as WordPress.â¦
467808
Devshed has posted a new article covering one of the hottest topics in the PHP community right now - security.   Security in a scripting language such as PHP is more developer-dependent than language-dependent. In other words, although the language offers you the tools to create secure code, it cannot prevent insecure code. Thus, the degree to which code is secure almost entirely depends on how security conscious a developer is.   The article looks at three security-related topics:  Register globals error reporting code exposure  and for each provides explanation and code where needed to help the reader understand the issues and possible problems with them.
635724
In a new post on his blog, Christian Wenz mentions the latest results of the SANS Institute's Top 20 Internet Security Attack Targets list which both includes a new entry ("Users") and several mentions of PHP and PHP-related applications.   Of course you can debate how such a Top list came together and what the real value behind that is, but there are two specific points in this year's list that I found quite interesting.   There's two targets for the PHP community to worry about - sysadmin/hosting and things developers need to keep in mind. Items on these lists include:  Always test and deploy patches and new versions of PHP as they are released Use Intrusion Prevention/Detection Systems to block/alert on malicious HTTP requests. Consider using Apache's mod_security to block known PHP attacks If you use PHP, migrate your application to PHP 5.2 as a matter of urgency. Encode all output using htmlentities() or a similar mechanism to avoid XSS attacks  You can check out the full information over on the SANS Institute website.
703645
In a new post to the PHP Security Blog, Stefan Esser points out a recent commit to the PHP core as a fix to the session handling in PHP:   I just came back home and saw a very recent commit to PHP's session management. It is another attempt to fix the session cookie attribute injection that the PHP developers already tried to fix in PHP 5.2.3 without giving any credits. [...] their new fix that consists of blacklisting a bunch of legal characters from the session id, will most probably result in hundreds or thousands of broken sites.   Stefan points out that the fix blocks several valid characters that sites could potentially use in their session IDs, and that with this new code in place, it could drastically effect those site's functionality.   As of the time of this post, however, it seems that the issue has been recognized and corrected so as not to cause the above mentioned issue in future updates.
193310
Here's what was popular in the PHP community one year ago today:onPHP5.com: Clickable, Obfuscated Email AddressesJacob Santos' Blog: PHP BlackjackThe Bakery: RESTful Web Services With CakePHPDeveloper.com: Developing a Ajax-driven Shopping Cart with PHP and PrototypeGreg Beaver's Blog: Mac OS X ships with security hole-laden PEAR - how to upgrade immediatelyNexen.net: English Articles and a Single Distribution ResourceJob Posting: Red Ventures Seeks Several LAMP Developers (Charlotte, NC)The Bakery: Checking for duplicate records (unique record)DevShed: The Basics of Abstract Factory Classes in PHP 5NewsForge.com: A DIY calendar control in PHPDevGuide.net: Dynamic Bitmap Graphics with PHP and GDRichard Heyes' Blog: Browser DetectionInternational PHP Magazine: Poll Question: Which is the Most Important Feature of PHP 5?Builder.au: Dynamic XML document construction with the PHP DOMCommunity News: PEAR Version 1.5.0 Released
154380
Paul Reinheimer, one of two behind the funcaday website (providing details on one PHP function each day and special content on the weekends) has posted a supplement to this weekend's posting covering escaping.   The disadvantage with the escape for now, not for later approach is simple. If you save a user's post to the database, then that user's post is displayed 2,000 times there will be some serious differences. [...] You will need to balance your security concerns with performance needs.   The comments on his post back up his suggestions (and include other tips like a recommendation to cache on an even higher level - page blocks).
271650
Continuing in their security theme for the month of March, the Zend Developer Zone has posted two more Security Tips for PHP developers out there:  The first tip (#6 on their list) talks about the benefits of casting all of the values going in to your SQL queries. This helps keep you and your data away from things like nasty SQL injection issues that could result in exposure of valuable data. The second tip (#7) focuses on regeneration of session IDs to help prevent fixation.  They give an example of how, without it, you could inadvertently allow in unauthorized users. Thankfully, one quick function call can remedy the situation - session_regenerate_id.    Check out their full list for more great tips.
201795
In a pointer from PHPKitchen.com today, there's a new tutorial discussing the use of PEAR's LiveUser library to help you authenticate and add/remove/update permissions for users of your site.
765627
Your Space, My Space, Everybody's Space &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
125329
Continuing on in their series of working with stand alone PHP scripts, DevShed has posted this third and last part looking at the creation of a basic script you can use to monitor your server (an excerpt from Advances PHP Programming by George Schlossnagle).   Last week, we continued our discussion of PHP standalone scripts with child processes and more. This week, we conclude our discussion and bring together what you've learned.   They start with the creation of a very basic daemon, including permission restrictions. They then modify this heavily to support the monitoring of processes through various parameters like frequency, status_time, and a description of the service. They then create the full example script and show the usage by checking to see if a URL passed in can be opened.   They also include, as a bonus, another more useful script that will email someone when the specified service goes down (still a HTTP check, though).
211610
In one of his recent blog entries, Brian Moon takes a look at what he considers the "proper use" of the PHP superglobal $_REQUEST (as brought on by a thread on the PHP internals mailing list.   I have seen more than one person make the following logic mistake: I may get data via GET, I may get data via POST - Ah, I should use $_REQUEST as it will catch both.   Brian points out the error - cookies aren't in $_REQUEST so improper handling of those values could lead to cookie data overwriting GET/POST data from $_REQUEST. Several of the comments on the post also warn against improper handling of the values, noting that doing so could lead to holes open for attacks (like session fixation).
473226
Damien Seguy has continued his series looking at PHP configurations around the web and is sharing the results in the form of two new reports over on Nexen.net.   I just published the second part of the serie about PHP configurations. This part focuses on three aspects of PHP: PHP extensions, PHP streams, and disabled functions.   You can find the statistics themselves here and the latest configuration statistics here. It's interesting to see the drop-off when it comes to the various modules that are installed ("php, ftp and http are the most common. Besides them, tough luck.") and to see the somewhat more gradual curve of which functions are disabled - with system() topping out the list (with good reason).
122012
In a new posting on Chris Shiflett's weblog today, he shares with the world a little bit of what he's written for php|architect - a free version of one of his columns: Security Corner: Session Fixation.
415712
To set things right about a misquote on Slashdot, Zeev Suraksi has posted this long statement mentioning what he really said and a few more personal opinions.   I've just been misquoted on Slashdot, as if I said there are no security problems in PHP itself, and that I instead point my finger only at inexperienced developers. If you read the original article on Heise Security, you'll see that I have not said anything of the sort. [...] I believe this is the belief of most others on the security team, but I'm only speaking on behalf of myself and do not represent them.   He also covers five more points pertaining to the article and the situation:  Where the bugs/problems lie with problems in PHP Why there are security problems in web PHP applications Why the current security level can be partially blamed on the language itself An admission that yes, there are security problems in PHP And the track record the PHP developers have had in fixing these issues  There's much more than just these brief highlights here, so I encourage you to head on over and check out the full post for yourself.   There are some other opinions on the matter from a few others out there too:  cyberlot's blog Zend Developer Zone's post Tony Bibbs' blog
197002
On the SitePoint PHP blog today, Troels Knak-Nielsen has written up an article that talks about dependencies in your applications - those little interconnections your code relies on to do more with less.   In lack of better words, I'll call this compositional programming style. It's a style which is usually more prevalent with experienced programmers. [...] There is, however, a dark side to composition - dependencies.   He starts with a definition to bring everyone up to a level field then moves on to how their used (through a "global symbol" or directly passed in) and how they can "leak" if you're not careful.    To help protect you and your code from any kind of damage down the line, Troels suggests making a container to keep objects where they need to be. He even includes an example with namespace support to make things even easier down the road.
757749
On the PHPKitchen site today, Demian Turner looks at a handy utility to ensure that the coding standards in your documents are all passable - PHP_CodeSniffer.    There was a fantastic CS helper package released at PEAR this week, PHP_CodeSniffer. The package, which requires PHP5 and is nicely coded, puts a phpcs script in your path so you can pass files or directories to it to get your CS validated.   The results are detailed and processing is surprisingly fast considering how many tokens are being parsed.    Demian gives an example of what the validation process looks like and why he finds the entire package particularly useful.
345464
php|architect has a new note about a few PHP vulnerabilities: