RSS FeedBefore analysing specific attacks and how to protect against them, it is necessary to have a foundation on some basic principles of Web application security. These principles are not difficult to grasp, but they require a particular mindset about data; simply put, a security-conscious mindset assumes that all data...
Subscribe
PHP – Web Security Concepts
PHP – Tutorial
Basic Introduction, Data types, Variables, Operators, Control Structures, Functions, Arrays, Strings And Patterns, Regular Expression
PHP – Web Programming
Anatomy of a Web Page, Forms and URLs, GET and POST, Managing File Uploads, HTTP Headers, Redirection, Compression, Caching, Cookies, Sessions
PHP – Security Concepts
Input Tainted, Whitelist vs. Blacklist Filtering, Filter Input, Escape Output, Website Security, Cross-Site Scripting, Database Security, Session Security, Filesystem Security, Remote Code Injection, Command Injection, Shared Hosting
Website Security with PHP
Website security refers to the security of the elements of a website through whichan attacker can interface with your application. These vulnerable points of entry include forms and URLs, which are the most likely and easiest candidates for a potential attack. Thus, it is important to focus on these...
Database Security
When using a database and accepting input to create part of a database query, it is easy to fall victim to an SQL injection attack. SQL injection occurs when a malicious user experiments on a formto gain information about a database. After gaining sufficient knowledge—usually from database error messages—the...
Session Security with PHP
Two popular forms of session attacks are session fixation and session hijacking. Whereas most of the other attacks described in this chapter can be prevented by filtering input and escaping output, session attacks cannot. Instead, it is necessary to plan for them and identify potential problemareas of your application....
Filesystem Security with PHP
PHP has the ability to directly access the files system and even execute shell commands. While this affords developers great power, it can be very dangerous when tainted data ends up in a command line. Again, proper filtering and escaping can mitigate these risks. Remote Code Injection When including...
Shared Hosting
There are a variety of security issues that arise when using shared hosting solutions. In the past, PHP has tried to solve some of this issues with the safe_mode directive. However, as the PHP manual states, it “is architecturally incorrect to try to solve this problem at the PHP...