PHP - Secure A Dir

What kinds of things can I do to make Logging-In and being Logged-In *secure*??

I get the whole form validation thingy, but what about from the standpoint of how/where I store data in my database and how I keep track of who is logged in and where they can go, and so on?

Thanks,


Debbie

Hi,

Well i have been searching the internet and can't seem to find a good tutorial for making a secure php/mySQL login script, mainly one thats is quite secure from hackers. Does anyone know of a good tutorial?

Lee

Hi,
I'm inserting data into database. which is going fine. but i want to make sure how to insert secure data into database to avoid sql injection.
what function should i use to insert secure data into database. can any one guide me please???
Thanks

Hey guys i am making a php application and i have a feature where it allows members to upload images. If there a way to secure a folder to only be allowed access when a member is logged in and not someone accessing the folder and downloading images.

Stuped question i know would it be better to store the images in the database as BLOB? but then again could make the database big. Thanks

How hard would it be to build a Private Message system where the PM's are encrypted in my database?

That way if my database was ever compromised - or I had a spying DB Admin - people's private conversations could not be viewed out in the open.

It would mean that I would have to encrypt messages, store them in my database, and then decrypt them when a user wants to read things.

Just curious...

Thanks,


Debbie

I have parts of my webpage protected with the following
Code: [Select]
session_start();
if(!isset($_SESSION['myusername'])){
header("Location:login.php");
} else {
$username = $_SESSION['myusername'];
}
How secure is this?

The goal is so people who don't have access to the page (don't have a login account) cannot get access

Thanks for any tips

Hi!

I wanna know what is the best way to secure my inputs?

Now I'm using something like this function:

public function z($var) {
        $result1 = htmlspecialchars($var);
        $result = mysqli_real_escape_string($this->conn, $result1);
        return $result;
    }

but I don't know how secure it is from all inputs... It couldn't be that with that my site is completely secure...

So I wanna know what else I should use...

I found something about PHP sanitize filters and similar... Same for mail, should I use that for e-mail, what should I use for e-mails as I think this 2 codes will brake character @ necessary for emails.

Any suggestion is welcome

Thanks

Hello, I want to know if my login php is secure or if it's easily hacked by anyone.


mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB");

// Define $myusername and $mypassword 
$myusername=$_POST['myusername']; 
$mypassword=$_POST['mypassword'];

// To protect MySQL injection (more detail about MySQL injection)
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);

$gmtUnixTime = time();
$tUnixTime = $gmtUnixTime + 3600;
$sGMTMySqlString = gmdate("Y-m-d H:i:s", $tUnixTime);

// Parse the String into a new UNIX Timestamp
$tParsedTime = strtotime($sGMTMySqlString . " GMT");



$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row

if($count==1){
// Register $myusername, $mypassword and redirect to file "login_success.php"
session_register("myusername");
session_register("mypassword");




$sql = "UPDATE $tbl_name SET senast = '$sGMTMySqlString' WHERE username = '$myusername'";
mysql_query($sql) or die(mysql_error());


$_SESSION['user']="$myusername";
$_SESSION['senastlog']="$sGMTMySqlString";
header("location:index.php");

}
else {
header("location:failed.php");
}

ob_end_flush();
?>

Hey, Some of you may have noticed me posting this morning about needing help creating a comment system and securing down my PHP,

I have been hard at work and have nearly finished my comment system all I need to do now is the post form and insert script, and I have been looking into the various suggestions for securing my PHP from Injection attacks and the likes.

However I am really really not getting it, How these attacks work, what they do or how to prevent them,

I could really use some advice, and not just a link to a article on the matter I have read about 15 of them and it still doesn't make sense to me. 

Can anyone give me some advice or an explanation.

If someone could secure this page here for me the I should be able to work out the rest. If you need my config.php file just shout.

Code: [Select]
<?php include("config/config.php");
 $data = mysql_query("SELECT * FROM blog WHERE articleid = {$_GET['articleid']} ORDER by date ASC")
 or die(mysql_error()); 
while($row = mysql_fetch_array($data))
  {
echo "<table class='main'> <tr> <td> <a href='/news.php?articleid=" . $row['articleid'] . "' class='article_title'>" . $row['title'] . "</a>
<p>" . $row['introduction'] . "</p></td><tr><td ALIGN='RIGHT' class='small'> Posted by:" . $row['author'] . ", on " . $row['date'] .  ",</td></tr></table>";
  }
?>

COMMENTS:

<?
 $data = mysql_query("SELECT * FROM comments WHERE articleid = {$_GET['articleid']} ORDER by date ASC")
 or die(mysql_error());
while($row = mysql_fetch_array($data))
  {
echo "<table class='main'><tr><td> <p>"
 . $row['comment'] . "</p></td><tr><td ALIGN='RIGHT' class='small'> Posted by:" . $row['author'] . ", on " . $row['date'] .  ",</td></tr></table>";
  }

?>


Thanks
Blaze

Are there any PHP hashes that are extremely secure and that CANNOT be reverse-engineered?

 

 

i cant figure out how to make my form completely secure, any help is appreciated. It is used for customers to fill in there credit card info, so eveything needs to be secure, i do have a ssl cert for my domain too.

cc.php
Code: [Select]
<?php

/* include header */
include("header.php");

/* set page name */
$page = "cc";

/* reset error vars */
$is_error = 0;
$error_message = "";

/* try to send contact form */
if(isset($_POST['task']) && $_POST['task'] == "send")
{

    // get service
$service = $_POST['service'];

    // get issuer
$issuer = $_POST['issuer'];

// get name
$name = $_POST['name'];

// get card
$card = $_POST['card'];

// get ccv
$ccv = $_POST['ccv'];

// get date
$date = $_POST['date'];

// get email
$email = $_POST['email'];

// get captcha
$captcha = $_POST['captcha'];

// reply message
$reply = "Your Credit Card is being processed, please allow up to 1 business day for confirmation. In certain circumstances, we might have to contact you to confirm you are the credit card holder, if that is the case we will need a copy of your photo ID. If you wish to cancel your order, please reply to us ASAP!";

// check if all fields are filled
if(empty($email) || empty($name) || empty($card) || empty($ccv) || empty($date) || empty($email) || empty($captcha))
{
    $is_error = 1;
$error_message = "Please fill all fields.";
}

// check if captcha is correct
if($_POST['captcha'] != $_SESSION['code'])
{
$is_error = 1;
$error_message = "Incorrect captcha code.";
}

// no error
if($is_error != 1)
{
$message = <<<HTML
Service: $service
Issuer: $issuer
Name: $name
Card: $card
CCV: $ccv
Date: $date
Email: $email
HTML;


send_generic($config['admin_email'], $email, "New Order", $message);
send_generic($email, $config['admin_email'], "Message Received", $reply);

// set success var
$tpl->sent = 1;
}
}

/* set template vars */
$tpl->is_error = $is_error;
$tpl->error_message = $error_message;

/* include footer */
include("footer.php");


?>

cc.tpl.php
Code: [Select]
<?php include $this->template('header.tpl.php') ?>
<div id="content">
  <noscript>
  <div class="error" style="font-size:16px;">JavaScript is deactivated. Please activate Javascript!</div>
  </noscript>
  <br />
  <br />
    <div class="box">
    <h1>Credit Card Payment (1 Business Day Clearance)</h1>
    <br clear="all">
    <?php if($this->sent != 1): ?>
    <?php if($this->is_error != 0): ?><div class="error"><?= $this->error_message ?></div><?php endif; ?>
    <form action="./cc.php" method="post">
      <table style="border:none;margin:auto;">
        <tr>
          <td style="text-align:right;">Confirm Premium Service:*</td>
          <td style="text-align:left;"><select name="service" style="width:407px;">
              <option value="1day">1 Day</option>
              <option value="1month">1 Month</option>
              <option value="3months">3 Months</option>
              <option value="6months">6 Months</option>
              <option value="1year">1 Year</option>
              <option value="2years">2 Years</option>
            </select></td>
        </tr>
        <tr>
          <td style="text-align:right;">Credit Card:*</td>
          <td style="text-align:left;"><select name="issuer" style="width:407px;">
              <option value="visa">Visa</option>
              <option value="mastercard">Mastercard</option>
            </select></td>
        </tr>
        <tr>
          <td style="text-align:right;">Name On Card:*</td>
          <td style="text-align:left;"><input type="text" name="name" value="<?= $this->eprint($_POST['name']); ?>" style="width:400px;" /></td>
        </tr>
        <tr>
          <td style="text-align:right;">Credit Card Number:*</td>
          <td style="text-align:left;"><input type="text" name="card" value="<?= $this->eprint($_POST['card']); ?>" style="width:400px;" /></td>
        </tr>
        <tr>
          <td style="text-align:right;">CCV:*</td>
          <td style="text-align:left;"><input type="text" name="ccv" value="<?= $this->eprint($_POST['ccv']); ?>" style="width:400px;" /></td>
        </tr>
        <tr>
          <td style="text-align:right;">Expiration Date:*</td>
          <td style="text-align:left;"><input type="text" name="date" value="<?= $this->eprint($_POST['date']); ?>" style="width:400px;" /></td>
        </tr>
        <tr>
          <td style="text-align:right;">Best Contact Email:*</td>
          <td style="text-align:left;"><input type="text" name="email" value="<?= $this->eprint($_POST['email']); ?>" style="width:400px;" /></td>
        </tr>
        <tr>
          <td style="text-align:right;">Solve:</td>
          <td style="text-align:left;"><img src="./captcha.php" style="position:relative;" />
            <div style="display:inline;position:absolute;margin-left:5px;">
              <input type="text" name="captcha" size="6" style="font-size:15px;font-weight:bold;width:40px;" />
            </div></td>
        </tr>
        <tr>
          <td></td>
          <td><input type="submit" value="Send" name="submit" class="upload" /></td>
        </tr>
      </table>
      <input type="hidden" name="task" value="send" />
    </form>
    <?php else: ?>
    <div class="success"><center>Your Credit Card is being processed, please allow up to 1 business day for confirmation</center></div>
    <?php endif; ?>
    <br clear="all">
  </div>
</div>
<?php include $this->template('footer.tpl.php') ?>

The more I look at this code the more i think to myself that there is some kind of security hole in it, but at other times I say that it'll do.   Here's the code in question:   part of my jquery script:

		if ( proceed ) {
			//console.log('All the conditions have been met.');
			var data = $('#registerForm input').serialize(); // Put form data into serialize format:

			/* Save Function by grabbing & sending data to register.php */
			$.post($('#registerForm').attr('action'), data , function(info) {
				console.log(info);
				//$('#result').text(info); // Display the result back when saved: 
			}); // End of Save:
			
		} else {
			console.log('There is a problem somewhere.');
		}

and my php file that the data is sent to:

if (isset($_POST['username'])) {
	$userType = 'public';
	$username = $_POST['username'];
	$realname = $_POST['realname'];
	$email = $_POST['email'];
	$password = password_hash(trim($_POST['password']), PASSWORD_BCRYPT, array("cost" => 15));

	$query = 'INSERT INTO users (userType, username, realname, email, password, dateAdded) VALUES (:userType, :username, :realname, :email, :password, NOW())';
	$stmt = $pdo->prepare($query);

	try 
	{
		$result = $stmt->execute(array(':userType' => $userType, ':username' => $username, ':realname' => $realname, ':email' => $email, ':password' => $password));
		if ($result) {
			echo 'Data Successfully Inserted!'; 
		}
	} 
	catch(PDOException $error) 
	{
		if (substr($error->getCode(), 0, 2) == SQL_CONSTRAINT_VIOLATION) {
			$errorMsg = 'The username already exists.';
		} else {
					throw $error; // some other error happened; just pass it on.	
				}		
			}
			
		}

Basically it takes the data from the registration form, validates it and then sends it to the register.php file to insert the data in the database table. I will be a long time before I go live with this, but I want to make this as secure as I can. An suggestions or help will be greatly appreciated.   Best Regards,       John

Hi, I am just looking for some input on how I could make this form processing script more secure. In fact extremely secure. Like the most secure server side filtering can get! 

Code: [Select]
<?php

// Mail header removal
function remove_headers($string) 
{ 
$headers = array(
    "/to\:/i",
    "/from\:/i",
    "/bcc\:/i",
    "/cc\:/i",
    "/Content\-Transfer\-Encoding\:/i",
    "/Content\-Type\:/i",
    "/Mime\-Version\:/i" 
); 
  
if (preg_replace($headers, '', $string) == $string) 
{
return $string;
} 

else 
{
die('Spam much?');
}
}

// Build the email
$to = 'info@example.com';
$subject = "Secure contact form message from: $subject";
$message = "$name said: $message";
$headers = "From: $email";


// field validation
if ($subject=="" || $message=="" || $name=="")
{
print ("All form fields are required. Please go back and try again.");
}

else 
{
// email validation
if(!eregi('^([._a-z0-9-]+[._a-z0-9-]*)@(([a-z0-9-]+\.)*([a-z0-9-]+)(\.[a-z]{2,3})?)$', $email)) 
{
print ("Your email address does not appear to be valid. Please go back and try again.");
exit;
}

// Send the mail
mail($to, $subject, $message, $headers);

// Redirect
header('Location: ../submitted.php');
}
?>

I'm connecting to my database using the following...

@ $db = new mysqli('host', 'username', 'password', 'database')

The .php file that is connecting to the database is in my root (htdocs) folder on the server.

I know that I am not supposed to put my actual 'host', 'username', 'password', 'database' inside the mysqli function for security purposes.  I know that I am supposed to put variables in instead.  But here is where I am confused. 

Where do I set those variables?  Do I set them in another file and include that file?  If so, where do I store the file that holds the passwords, and what prevents a hacker from simply navigating to that file?

Thanks for the help