Before analysing specific attacks and how to protect against them, it is necessary to have a foundation on some basic principles of Web application security. These principles are not difficult to grasp, but they require a particular mindset about data;… (READ MORE)
Accessing Session Data HTTP is a stateless protocol; this means that the webserver does not know (or care) whether two requests comes from the same user; each request is instead handled without regard to the context in which it happens…. (READ MORE)
Cookies allow your applications to store a small amount of textual data (typically, 4-6kB) on a Web client. There are a number of possible uses for cookies, although their most common one ismaintaining session state (explained in the next section)…. (READ MORE)
As we discuses, the server responds to an HTTP request by first sending a set of response headers that contain various tidbits of information about the data that is to follow, as well as other details of the transaction. These… (READ MORE)
File uploads are an important feature for many Web applications; improperly handled, they are also extremely dangerous—imagine how much damage allowing an arbitrary file to be uploaded to a sensitive location on your server’s hard drive could be! A file… (READ MORE)
When sending the formwe introduced above with the method attribute set to post, the data is accessible using the $_POST superglobal array. Just like $_GET, $_POST contains one array element named after each input name. <?php if($_POST[‘login’]){ if($_POST[‘user’] == “admin”… (READ MORE)
When a form is submitted using the GET method, its values are encoded directly in the query string portion of the URL. For example, if you submit the form above by entering user in the List box and choosing to… (READ MORE)
Most people think of a Web page as nothing more than a collection of HTML code. This is fine if you happen to be aWeb designer—but, as a PHP developer, your knowledge must run much deeper if you want to… (READ MORE)
Perl Compatible Regular Expressions (normally abbreviated as “PCRE”) offer a very powerful string-matching and replacement mechanism that far surpasses anything we have examined so far. Regular expressions are often thought of as very complex—and they can be at times. However,… (READ MORE)