FuzzyOpinions Blog: Tutorial: improving security with a PHP Captcha
82204
On the FuzzyOpinions blog, there's a basic tutorial that walks you through the creation of a CAPTCHA system to use how you'd like on your site. They target it towards the most common use - blocking unwanted comments to a site from spambots.   Although you might not know it by the name, a captcha is one of those little boxes you see, more and more lately, that ask you to type in a random code to verify that you are a human being and not a robot. There are many different varieties, but the basic idea is an image that is obscured slightly but readable by a human and used as a passcode for secure entry to a system or task.   The method is a simple combination of random text, a custom image, some of the PHP graphics functions, and a little addition to your HTML form (and PHP session) to get things up and running.
664907
A month of browser bugs &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
148612
Attackers can trick browsers into releasing password information.
634435
Andrei Zmievski has posted something new to his blog today about a feature of PHP6 that's finally been hammered down - HTTP input (request) decoding.   There have been no fewer than 4 different proposals floated before, but this one combines flexibility, performance, intuitiveness, and minimal architectural changes, and has only a couple of small drawbacks. Let's take a closer look.   He details the functionality - what it is, what's been decided on, and the advantages of the method. The basic approach is a "lazy" one where PHP will only store the request when it comes in, no filtering or anything, until you want to do something with it (i.e. get it via $_GET, $_POST, etc). When the request for data is made, PHP looks at the encoding settings and formats the data accordingly.   Advantages he mentions for this method include removing the guess-work on PHP's part for which encoding the request is and that it removes some of the overhead by not processing the data until it's actually needed.
35985
Virtualized rootkits - Part 1 &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
515933
Evolt.org has a new tutorial posted today concerning something that I still get a lot of questions about - creating a PHP Login System with Admin Features.
321247
Blog: Spammers appear to defeat Captcha and use fake Microsoft and Yahoo Web mail addresses to spread spam.
37251
If you weren't able to make it to this year's just passed php|works conference in Atlanta, you missed out on the keynote that Marco Tabini, founder of php|architect gave at the start of the conference. Fortunately, he's posted the video of it on his blog:   What they didn't tell me, however, is that they had arranged for a simple (but, as you will see, very effective) web-based system that allowed members of the audience to submit "captions" to the screen as I was speaking. The results were, of course, hilarious - mostly because they "forgot" to tell me about the idea until a few days after.   Be sure to check out the video of the video for some great one-liners.
626189
Dave Dash has posted a quick script to help with an integration of openID into your application - well, really just to read the response back easily.   I'm working on implementing openID for reviewsby.us and for use in symfony apps. One thing I was having trouble with was parsing key value pairs, which is one of the requirements to reading responses. It's a fairly easy task, but [PHP][] offers so many ways to do this.   He notes the spec for how the results are returned and shares his code (based around a regular expression) that goes through the response and separates things out into key/value pairs automatically.
415712
To set things right about a misquote on Slashdot, Zeev Suraksi has posted this long statement mentioning what he really said and a few more personal opinions.   I've just been misquoted on Slashdot, as if I said there are no security problems in PHP itself, and that I instead point my finger only at inexperienced developers. If you read the original article on Heise Security, you'll see that I have not said anything of the sort. [...] I believe this is the belief of most others on the security team, but I'm only speaking on behalf of myself and do not represent them.   He also covers five more points pertaining to the article and the situation:  Where the bugs/problems lie with problems in PHP Why there are security problems in web PHP applications Why the current security level can be partially blamed on the language itself An admission that yes, there are security problems in PHP And the track record the PHP developers have had in fixing these issues  There's much more than just these brief highlights here, so I encourage you to head on over and check out the full post for yourself.   There are some other opinions on the matter from a few others out there too:  cyberlot's blog Zend Developer Zone's post Tony Bibbs' blog
692375
PHPClasses.org is spotlighting another package from their site today - this time it's a CAPTCHA class that takes things a step further and introduces animation into the mix to make it even harder for bots to get through.   Laszlo Zsidi is a PHP Web developer that has written an harder to break CAPTCHA solution. It consists in generating animated GIF images that exhibit the validation text.   Since the text never appears all at once in each of the animated frames, this solution certainly raises the bar in terms of difficulty for the robots to guess the validation text, making it very hard to defeat, if possible at all.    You can check out the class here, including a sample animated gif file and a download of everything you'll need to get started.
149386
The MT-Soft blog has posted a (basic but full of great info) new guide on ensuring that your PHP installation is a very secure place for your application to live.   This article shows the basic steps in securing PHP, one of the most popular scripting languages used to create dynamic web pages. In order to avoid repeating information covered in the previous article, only the main differences related to the process of securing Apache will be described.   They've broken it up into a few different sections:   System they'll be using (operating system, functionality assumed, security assumptions) Preparing the software Installing PHP Chrooting the server Configuring PHP Protecting against CSS and SQL injection attacks   Check out the full tutorial to fill in the blanks of this outline.
533524
A great presentation by Ilia Alshanetsky from the International PHP Conference 2004. The only thing I would like to point out is that MMCache is still being actively developed, as evidenced by the CVS activity at sourceforge.  PS: You might need to use Mozilla to view this. IE sometimes doesn't work properly. I thought IE was a defacto standard :-)
390086
In another quick note from Chris Shiflett, there's a summary of php|works and some of the comments made about it:
125329
Continuing on in their series of working with stand alone PHP scripts, DevShed has posted this third and last part looking at the creation of a basic script you can use to monitor your server (an excerpt from Advances PHP Programming by George Schlossnagle).   Last week, we continued our discussion of PHP standalone scripts with child processes and more. This week, we conclude our discussion and bring together what you've learned.   They start with the creation of a very basic daemon, including permission restrictions. They then modify this heavily to support the monitoring of processes through various parameters like frequency, status_time, and a description of the service. They then create the full example script and show the usage by checking to see if a URL passed in can be opened.   They also include, as a bonus, another more useful script that will email someone when the specified service goes down (still a HTTP check, though).
541647
On Codewalkers.com today, there's a new tutorial posted concerning some of the looping features PHP has to offer.
366947
Lukas Smith is sending a wakeup call to the internet providers and web hosters out there - get involved in the PHP community!   We do not seem to have any ISP's active inside the PHP community. This is kind of odd, considering that PHP seems to be driving the business of hosters quite a bit. Why have none of them decided that PHP is important enough for their business that its worthwhile to ensure that their interests are taken into account?   He makes the suggestion of passing along the suggestion to bosses/co-workers/anyone who'll listen about getting involved. Suggested places to start would be as a part of the testers group or even contributing to the migration guide.