Tutorial: An Introduction to PHPIDS
561089
After several weeks of work Mario Heiderich, Lars Strojny and of course myself released the first stable versions of the PHPIDS - currently at version 0.2.2.    You will find the project site on http://php-ids.org/   In this article I would like to present our framework and explain how it can be used, hoping that developers consider it useful to make their application more secure.   The PHPIDS is a system that is meant to be an additional layer of security for any PHP based  website or web application. In fact, this layer does not filter input - that would be a task for different layers - but it makes sure that no potential attack against the application goes unnoticed.    Based on a collection of heavily tested regular expressions the PHPIDS is able to efficiently recognize, classify and ultimately react on many different kinds of attacks - including, besides others, XSS, SQL injection, directory traversal, String.fromCharcode attacks, halfwidth/fullwidth encoding attacks and remote code execution. Due to its flexible and easy configuration the PHPIDS reaction will happen in exactly the way the developer intends.   The integration is as simple as can be. Besides PHP 5.2 the only necessary extension is SimpleXML and the following code:  [php] getFilterFromXML('../../lib/default_filter.xml');          /*     * Instanciate the IDS and start the detection     *      * here we are using $_GET but you can pass any      * array you want like $_SERVER, $_SESSION etc.     */     $get = new IDS_Monitor($_GET, $storage);     $report = $get->run();      if (!$report->isEmpty()) {                  // Get the overall impact         echo "Impact: {$report->getImpact()}n";                  // Get array of every tag used         echo 'Tags: ' . join(', ', $report->getTags()) . "n";                  // Iterate through the report and get every event (IDS_Event)         foreach ($report as $event) {             echo "Variable: {$event->getName()} | Value: {$event->getValue()}n";             echo "Impact: {$event->getImpact()} | Tags: " . join(", ", $event->getTags()) . "n";                          // Iterator throught every filter              foreach ($event as $filter) {                 echo "Description: {$filter->getDescription()}n";                 echo "Tags: " . join(", ", $filter->getTags()) . "n";             }         }     }          /*     * Additionally you have the option to store the detected     * data using IDS_Log_Composite and for example IDS_Log_File     */     require_once '../../lib/IDS/Log/File.php';     require_once '../../lib/IDS/Log/Composite.php';         $compositeLog = new IDS_Log_Composite();     $compositeLog->addLogger(        IDS_Log_File::getInstance('log.txt')     );          if (!$report->isEmpty()) {         $compositeLog->execute($report);     }  } catch (Exception $e) {     printf(         'An error occured: %s',         $e->getMessage()     ); } ?> [/php]  Ideally the PHPIDS should be included in a central position of the application or even better via auto_prepend_file. If an attack takes place the IDS result object will be returned filled with data and the programmer can decide the appropriate reaction. For the most part decisions about the reaction are dependent on the detected attacks' cumulative impact.    The impact variable acts as an indicator for an attack's severity and can be used to grade the application's reaction on that attack. For example, if the impact was 3, an appropriate response might be to log the issue in a file, whereas if the impact was around 12, a warning mail to the site owner might be more applicable whilst an impact of 24 or above might print out a message to the attacker stating that his intrusion attempt has been detected and request aborted.   The PHPIDS is heavily tested via phpUnit and profiles via xdebug meaning that you can expect a minimal performance hit to your applications. We are currently using the PHPIDS with great success on several high traffic sites; ormigo.com and neu.de being the two foremost examples of this. Documentation and support is available on the project site or via our forum. Future development for the PHPIDS will possibly rank around detection of fragmented XSS and enhanced detection of heavily encoded attack vectors.   For users of .NET there's the .NETIDS written by Martin Hinks which is a port of the PHPIDS and uses the same filter rules. You will find any related resources on the .NETIDS project page (http://code.google.com/p/dotnetids/). Support for the .NETIDS is also available in the PHPIDS forum.   Regards, Christian Matthies & Mario Heiderich
493955
Tony Bibbs takes a look at an increasingly popular bit of functionality in PHP5, the SOAP extension, and notes that it still has a "ways to go".   In my latest round of web services work in PHP5 I was creating a PHP5 client that interacts with our Java-based ERP. The client needs to be a combination of a couple of WSDL's into one, nice, compact and powerful client. It should be noted this client will be distributed via the State of Iowa PEAR channel so it will undoubted by used by other project in our organization and throughout state government so the result needs to have a lot more fit-and-finish than would be typical.   He mentions his expectations for PHP's usage of the protocol, including the automatic generation of variables/methods/etc to help the developer use the remote application easier.
698334
Popular posts from PHPDeveloper.org for the past week:The Bakery: Six New Articles/Tutorials PostedEvert Pot's Blog: PHP: Arrays vs. ObjectsDevArticles: Learning AJAXInternet Super Hero: PHP: mysqli_fetch_all()David Coallier's Blog: PHP Namespaces (Part 1: Basic usage & gotchas)I/O Reader: 15 Cool Things & 12 Things to Dislike About PHPProPHP Podcast: Newscast - August 16, 2007PHPBuilder.com: Dynamic XML with PHPSite News: Popular Posts for the Week of 08.17.2007PRADO Watch Blog: PRADO Watch: Interview With Timani Tunduwani - Why I Moved From CakePHP to PRADO
515933
Evolt.org has a new tutorial posted today concerning something that I still get a lot of questions about - creating a PHP Login System with Admin Features.
719619
Krystian Hoffman has posted to his blog today a few reasons (10 to be exact) that he likes and uses PHP. Fortunately, most of them are some of the best reasons for anyone to use the language.   ended up with ten points on why I use PHP and I guess this would be a good post here on my blog, as it seems people like lists in general and maybe I could get some people out there that aren't really sure about whether PHP is good or bad, to get some insight at least.  Here's some of his list:   The PHP Community The (language's) Performance Its Portability It has strong Object-oriented support   Other things got a mention as well - the low learning curve, low cost, included libraries - but the above few seemed the strongest.
723192
Here's what was popular in the PHP community one year ago today:Yet Another Web Development Blog: A PHP Developer Spends a Week with PythonZend Developer Zone: AJAX Chat Tutorial Pt 5: Javascript, Sending Chat Messages, Screen Name ChangesWebDevLogs: ClickHeat - PHP+JS heatmapTemplora.com: Basic PHP Script SecurityVinu Thomas' Blog: Modifying your MySQL databases to be UTF-8 compliantJeff Moore's Blog: PDO versus MDB2AnyExample.com: PHP password generationJason Palmer's Blog: Zip Code To LocationThe Bakery Blog: A gift for all to enjoySara Golemon's Blog: PHP-2006: A look backMatthew O'Phinney's Blog: Overloading arrays in PHP 5.2.0Davey Shafik's Blog: A Year in Review (2006)Jacques Marneweck's Blog: Smarty tip for including multiple javascript filesphp|architect: Final days of our iPod Training Promo!Alexander Netkachev's Blog: About Eclipse PHP IDE php.ini location
626189
Dave Dash has posted a quick script to help with an integration of openID into your application - well, really just to read the response back easily.   I'm working on implementing openID for reviewsby.us and for use in symfony apps. One thing I was having trouble with was parsing key value pairs, which is one of the requirements to reading responses. It's a fairly easy task, but [PHP][] offers so many ways to do this.   He notes the spec for how the results are returned and shares his code (based around a regular expression) that goes through the response and separates things out into key/value pairs automatically.
634435
Andrei Zmievski has posted something new to his blog today about a feature of PHP6 that's finally been hammered down - HTTP input (request) decoding.   There have been no fewer than 4 different proposals floated before, but this one combines flexibility, performance, intuitiveness, and minimal architectural changes, and has only a couple of small drawbacks. Let's take a closer look.   He details the functionality - what it is, what's been decided on, and the advantages of the method. The basic approach is a "lazy" one where PHP will only store the request when it comes in, no filtering or anything, until you want to do something with it (i.e. get it via $_GET, $_POST, etc). When the request for data is made, PHP looks at the encoding settings and formats the data accordingly.   Advantages he mentions for this method include removing the guess-work on PHP's part for which encoding the request is and that it removes some of the overhead by not processing the data until it's actually needed.
248750
This is a followup on Marco Tablini's discussion of the PHP programmer availablity and my earlier attempt at defining enterprise PHP.
444294
DevShed launches a new tutorial series today with this new article, an introductory look at using the PDO objects in PHP5.   As you may have seen at first glance, the PDO extension looks really useful in certain situations. In this three-part series, I'm going to introduce its most important features, by accompanying the corresponding theoretical concepts with numerous hands-on examples, in this way facilitating the respective learning curve.   They start the series off with a look at using the extension and connecting to a resource (in their case, a MySQL database). Then, it's on to performing queries and grabbing the last inserted IDs for the rows your script just put in.
360849
On the Zend Developer Zone today, there's this new tutorial that looks at making the move from PHP4's object-oriented programming up to the "more complete obejct model of PHP5" - specifically with the Decorator design pattern.   While working on a project I realized one particular solution was a pretty good way to demonstrate the decorator design pattern together with some of PHP5's features, including abstract classes, interfaces, type hinting, the final keyword and the visibility of properties and methods. This article is intended for those of you who, like myself, are moving from object-oriented programming, including some use of design patterns, in PHP4, to the more complete object model of PHP5.   He sets up a scenario about the development of an online pizza ordering system to show how to "decorate" a pizza with each of the toppings on a list (instead of having to list out every pizza in every possible topping combination). Of course, all of the code is included and explained so you understand exactly what's happening. Finally, there's a demonstration of its usage - a simple call that grabs the stock level/name/cost of each of the items in stock (pizza combinations).
396172
Alexey Zakhlestin gave a talk for the PHPThinktank IRC channel recently on the topic of YAML, PHP, and some of the work that he's done combining the two.   It happened a bit of spontaneously, so noone was invited. It was my first try, to make introduction to yaml for php prgrammers, and if there is more interest I will give another talk which will cover more details, this time with proper scheduling :)   You can check out the log of the discussion for his entire talk (covering topics like what YAML is, where to get more information on it, some of its features, and a mention of the Syck library for parsing it).
769389
Latest PHPClasses.org Releases:Class TreeviewPHP User ClassDHTMLDumpSalatCSV Parse and ReadRSAsmb4phpClient infoTrue Singleton ClassRounded Border Table Generator
710066
DevShed continues their series covering SQLite in PHP5 today with the final tutorial - "Additional Methods for Using SQLite with PHP 5":   The list of additional features offered by SQLite is really impressive. Therefore, in this last article of the series, I'll be taking an in-depth look at them. This will complete our analysis of this excellent RDBMS integrated with PHP 5.   First up is a look at the usage of the seek and lastInsertRowid functions followed by the changes and queryExec methods. They show how to use the createFunction method and show one of the more advanced features of SQLite - creating a database that only exists in the server's memory.
125329
Continuing on in their series of working with stand alone PHP scripts, DevShed has posted this third and last part looking at the creation of a basic script you can use to monitor your server (an excerpt from Advances PHP Programming by George Schlossnagle).   Last week, we continued our discussion of PHP standalone scripts with child processes and more. This week, we conclude our discussion and bring together what you've learned.   They start with the creation of a very basic daemon, including permission restrictions. They then modify this heavily to support the monitoring of processes through various parameters like frequency, status_time, and a description of the service. They then create the full example script and show the usage by checking to see if a URL passed in can be opened.   They also include, as a bonus, another more useful script that will email someone when the specified service goes down (still a HTTP check, though).
642360
DevShed has started a new series looking at working with PHP and databases with this new tutorial posted today, an excerpt from the O'Reilly book "Programming PHP, Second Edition".   We focus on the PEAR DB system, which lets you use the same functions to access any database, rather than on the myriad database-specific extensions. In this chapter, you'll learn how to fetch data from the database, how to store data in the database, and how to handle errors. We finish with a sample application that shows how to put various database techniques into action.   In this first part of the series, they look at what kinds of things are possible with the database connection, some of the basics of using the PEAR DB class and working with data source names to help with the connection.
394439
Popular posts from PHPDeveloper.org for the past week:PHPBuilder.com: AJAX and PHP Part 2 - XML Communication/ProcessingCommunity News: Zend Framework 1.0.0 ReleasedMike Potter's Blog: Slides for today's e-seminar on Flex and PHPBlogSecurity.net: Interview with Stefan Esser on WordPressCommunity News: India's First PHP UnconferencePro::PHP Podcast: Newscast for 2007.06.28JSLabs Blog:  How to create Microsoft Office Documents with PHPPEAR Blog: Request for ideas: New developer FAQPHP-Coding-Practices.com: Composing Methods: Split Temporary VariableRob Allen's Blog: Spanish versions too!