PHP - Security / Hack Question

I have a business social network site on hosting server. I am wondering if sessions are enough secure.
ini_set('session.use_only_cookies', 1); //this prevent Session Fixation?
session_start();

if($_SESSION['loggedIn'] && $_SESSION['userIP']==$_SERVER["REMOTE_ADDR"]) // extra security
//user is logged in, assign all data to this profile from session
else
//user is not logged in, no data are assigned

Would you consider that as enough secure?

Hi all,

I have heard stories that hackers/viruses or basically something that you don't want uploaded to a server through a website form have been able to type some sort of code in to a html form field to access information.

I know how to control the length of fields, how to validate that an email address is in the correct format etc. - but when it comes to having a textfield for the user to add up to 2000 characters of their own words, how can I protect from malicious code being inserted?

The textfield is located inside the user area but anyone can join, so anyone ultimately can enter code!

Thanks for the help. 

I have a php page that processes a form.  How do I prevent someone from making their own form on their own domain and then saying <form metod=post action = "www.hackerdomain.com/bad.php">

and then passing their own variables?

Do I set up a $session variable on my form page and assign it to  $_SERVER["PHP_SELF"]?

I have a login system that uses a flat file database.  The flat file is in a directory outside the public_html.  My questions;

1- Is is still possible to hack into that file?

Currently I do not encrypt the passwords as I have been told that having the file outside the public_html makes the file unavailable to the public.  This allows me the advantage of sending the Username and Password to the user in an email if they forget there password or username.  Otherwise- I would have to set up a more complicated method to allow them to change their password to re-gain access to the site.  I have an SSL on the site also so I am not worried about packet sniffing.

Thanks

Hi Guys

I have built a simple form, which has text fields Name, Telephone Number, Best Time to Call and E-mail.  For security purposes, I am testing each against the function shown below which looks for dangerous code snippets, in an effort to protect against email header injection attacks. 

When it comes to the E-mail field, I am not actually testing whether a valid e-mail address has been entered, as it is the telephone number which is essential, not the e-mail.  My question is, do you think this is a security weakness? 

Many thanks

Code: [Select]
//http://www.tonyspencer.com/2005/12/15/email-injection-exploit-through-a-php-contact-form/
//preg_match string to match goes within forward slashes, i.e. /str/, and i at the end makes it case insensitive
function containsInjectionAttempt($input) {
if (preg_match("/\r/i", $input) ||
preg_match("/\n/i", $input) ||
preg_match("/%0a/i", $input) ||
preg_match("/%0d/i", $input) ||
preg_match("/Content-Type:/i", $input) ||
preg_match("/<script>/i", $input) ||
preg_match("/bcc:/i", $input) ||
preg_match("/to:/i", $input) ||
preg_match("/cc:/i", $input)) {
return true;
} else {
return false;
}
}

I am trying to keep the user input clean with this script but can't figure out what is wrong with it.
the error I am getting is Warning: preg_match() expects parameter 1 to be string,

 $bad_strings = array(
                "content-type:",
                "mime-version:",
                "multipart/mixed",
"Content-Transfer-Encoding:",
                "bcc:",
"cc:",
"to:",
   );
if (preg_match($bad_strings, $first_name)) {
    die;

Hello, all: I'm a newbie and I'm trying to understand the whole php security thing a bit better, and found this function that seems easy to implement, as well as easy to understand... my question is...

Does this means I could use regular $_POST, $_GET, $_COOKIE, $_REQUEST variables without having to individually worry about escaping them every time I use them in queries... is this correct? or safe enough? see example below, along with how I'm using variable in a query...  it seems to be working fine, as it does echo out the \ escape character when I test it, or when I try to inject it...

Appreciate your input!


Code: [Select]
<?php

$_POST=sanitize($_POST);
$_GET=sanitize($_GET);
$_COOKIE=sanitize($_COOKIE);
$_REQUEST=sanitize($_REQUEST);

function sanitize($input){
if(is_array($input)){
foreach($input as $k=>$i){
$output[$k]=sanitize($i);
}
}
else{
if(get_magic_quotes_gpc()){
$input=stripslashes($input);
}
$output=mysql_real_escape_string($input);
}
return $output;
}


// mysql query then I could use be:

$money = $_GET['money'];
$result = mysql_query("SELECT * FROM countries WHERE currencies = '$money'");

 
?>

Hi guys,

I have a coupon software developed in PHP by some developers but I need to add a small functionality as the developers are not reachable anymore. The software is based on the LAMP model.

I am NOT a PHP developer but can reasonably work with this stuff.

First, let me give you a brief background of the system.

The user gets the coupon from the website that the system auto generates and stores them in the user mgmt area which is coming from the mySQL database.

Basically I need 3 things.

1. I need to have an encrypted URL (must be available from my system) that should carry both the code of the coupon (already system generated) and the Merchant ID (already in the system).

2. A small javascript or any other PHP code (to be placed in Merchant's sales page) that authenticates THIS URL which then calls an encrypted special page that holds the discounted page of the Merchant's product.

3. A small snippet of code to be kept in the 'Thank You' page of the Merchant's website which should then update the coupon status (redeemed/expired) back in my system.

As far as variables of these coupons are concerned, I will manage that myself. But I just need the code or some good clear pointers to get this thing done.

Please ask for any further clarification in case you don't understand what I described above.

Any help would be greatly appreciated.

Thanks in advance.

Meenop

Hi, I am looking to create a directory that can not be accessed using .htaccess and neither can files directly.
But I want to make it so when you are signed into joomla you can access the files via a mp3 player on the sight.   My mp3 extention is joomline player flplayer.
And I heard that if I cange the name of the file in joomla fomr lovelove.com/audio/love/abc.mp3 to lovelove.com/audio/love/abc.php?name=abc   and then that abc.php script (inside the script it checks if you are logged in) will retrieve the file name, and the joomline will play it it will work.   is this possible?

Also, if not what can I do for this to work?   Right now my script is not working as the joomline looks up all the mp3 files as one big string. this is the abc.php which on my site its calld psp.php

<?php
 define( '_JEXEC', 1 );
    define( 'JPATH_BASE', realpath(dirname(__FILE__).'/../../' ));  
    require_once ( JPATH_BASE .'/includes/defines.php' );
    require_once ( JPATH_BASE .'/includes/framework.php' );
$mainframe =& JFactory::getApplication('site');

 if( !empty( $_GET['name'] ) )
{
  // check if user is logged    
if(JFactory::getUser()->guest) {
die( "ERROR: invalid song or you don't have permissions to download it." );
}
else { 
    $psp = preg_replace( '#[^-\w]#', '', $_GET['name'] );
    $psp_file = "{$_SERVER['DOCUMENT_ROOT']}/audio/live/{$psp}.mp3";
    if( file_exists( $psp_file ) )
    {
      header( 'Cache-Control: public' );
      header( 'Content-Description: File Transfer' );
      header( "Content-Disposition: attachment; filename={$psp_file}" );
      header( 'Content-Type: application/mp3' );
      header( 'Content-Transfer-Encoding: binary' );
      readfile( $psp_file );
      exit;
    }
  }
}
 ?>

then I have joomline player    jlplayer

<?php
/**
 * JoomLine mp3 player - Joomla mp3 player
 *
 * @version 1.5
 * @package JoomLine mp3 player
 * @author Anton Voynov (anton@joomline.ru), Sergii Gaievskiy (shturman.kh@gmail.com)
 * @copyright (C) 2010 by Anton Voynov(http://www.joomline.ru)
 * @license GNU/GPL: http://www.gnu.org/copyleft/gpl.html
 *
 * If you fork this to create your own project,
 * please make a reference to JoomLine someplace in your code
 * and provide a link to http://www.joomline.ru
 **/

defined('_JEXEC') or die('Restricted access');

function ascii2hex($ascii, $reverse = false) {
	$hex = array();
	for ($i = 0; $i < strlen($ascii); $i++) {
		$byte = strtoupper(dechex(ord($ascii{$i})));
		$byte = str_repeat('0', 2 - strlen($byte)).$byte;
		$hex[] = $byte;
	}
	if ($reverse) $hex = array_reverse($hex);
	return implode(" ",$hex);
}

function read_frame (&$f, &$tagdata, $frame) {
	$pos = strpos($tagdata,$frame);
	if ( $pos !== FALSE) {
		// frame found. read length of this frame
		fseek($f, 10+$pos+4);
		$frame2len = hexdec(ascii2hex(fread($f,4)));
		if (($frame2len-1) > 0) {
			// read frame data
			fseek($f, 10+$pos+4+2+4+1);
			$data = trim(fread($f,$frame2len-1));

			$hexfdata = ascii2hex($data);
				if ( substr($hexfdata,0,5) == 'FF FE' or substr($hexfdata,0,5) == 'FE FF' ) {
					$data = iconv("UCS-2","UTF-8",$data);
				} else {
					if (!preg_match('//u', $data)) {
						$data = iconv("cp1251", "UTF-8",$data);
			}
				}
			return $data;
		} else {
			return false;
		}
	} else {
		return false;
	}
	
}

function readmp3tag($file) {
	$f = fopen($file, 'rb');
	rewind($f);
	fseek($f, -128, SEEK_END);
	$tmp = fread($f,128);
	if ($tmp[125] == Chr(0) and $tmp[126] != Chr(0)) {
		// ID3 v1.1
		$format = 'a3TAG/a30NAME/a30ARTISTS/a30ALBUM/a4YEAR/a28COMMENT/x1/C1TRACK/C1GENRENO';
	} else {
		// ID3 v1
		$format = 'a3TAG/a30NAME/a30ARTISTS/a30ALBUM/a4YEAR/a30COMMENT/C1GENRENO';
	}
	$id3v1tag = unpack($format, $tmp);

	// read tag length
	fseek($f, 8);
	$tmp = fread($f,2);
	$tmp = ascii2hex($tmp);
	$taglen= hexdec($tmp);
	$tagdata = "";
	if ($taglen > 0) {
	//read tag data
	fseek($f, 10);
	$tagdata = fread($f,$taglen);
	}
	
	// find song title frame
	$title = read_frame ($f, $tagdata, "TIT2");
	if (!$title) {
		if ($id3v1tag['TAG']== 'TAG' && ascii2hex(substr($id3v1tag['NAME'],0,1)) != '00' ) {
			$title = $id3v1tag['NAME'];
		} else {
		$title = explode(DS,$file);
		$title = $title[count($title)-1];
		$title = explode('.',$title);
		$title=$title[0];
	}
		if (!preg_match('//u', $title)) $title = iconv("cp1251", "UTF-8",$title);
	}
	$artist = read_frame ($f, $tagdata, "TPE1");
	if (!$artist) {
		if ($id3v1tag['TAG']== 'TAG' &&  ascii2hex(substr($id3v1tag['ARTISTS'],0,1)) != '00') {
			$artist = $id3v1tag['ARTISTS'];
		} else {
			$artist = "";
	}
	}
	if (!preg_match('//u', $artist)) $artist = iconv("cp1251", "UTF-8//TRANSLIT",$artist);
	
	$id3tag['NAME']		= $title;
	$id3tag['ARTIST']	= $artist;

	return $id3tag;
}

if (DS == "/") 
	$dir = str_replace("\\",DS,$music_dir);
else 
	$dir = str_replace("/",DS,$music_dir);
$dir = JPATH_ROOT.DS.$dir;


if (!is_dir($dir)) {
	echo "Wrong dir in settings";
} else {
	$files = glob($dir.DS."*.{mp3,MP3}",GLOB_BRACE);
	if (count($files) > 0) {
		sort($files);
		$host = $base_uri;
		foreach ($files as $file) {
			$tags = readmp3tag($file);
			$file = explode (DS, $file);
			if ($server_utf8 == 1) {
				$fname = rawurlencode($file[count($file)-1]);
			} else {
				$fname = rawurlencode($file[count($file)-1]);
			}
$fname = substr($fname, 0, -4);
			
			$file = $host."/".$music_dir."/psp.php?name=".$fname;
echo $file;
			$artist = trim($tags['ARTIST']);
			$artist = $artist == "" ? "" : "{$tags['ARTIST']} - ";
			$playlist[] = '{name:"'.$artist.$tags['NAME'].'",mp3:"'.$file.'"}';
		}
	}
	/*
	 * 	
	//if(!window.jQuery) {
		document.write(unescape('<script type="text/javascript" src="<?=$base_uri?>/modules/mod_jlplayer/js/jq.js">%3C/script%3E'));
		document.write(unescape('<script type="text/javascript">jQuery.noConflict();%3C/script%3E'));
	//}

	 * 
	 */
	?>
	<script type="text/javascript">
	var myPlayList = [
		<?php 
			echo implode(",\n		",$playlist)."\n"; 
		?>
		];
		Array.prototype.find=function(v){
				for (i=0;i<this.length;i++){
						if (this[i]==v) return i;
				}
				return 0;
		}
		var plIndex = [];
		for (i=0;i<myPlayList.length;i++) {
				plIndex[i] = i;
		}
		<?php if ($shfl == 1) : ?>
		//shuffle
		function randOrd(){
			return (Math.round(Math.random())-0.5);
		}
		plIndex.sort(randOrd);
		<?php endif; ?>
		function setCookie (name, value) {
					document.cookie = name + "=" + escape(value) + "; expires=Thu, 01-Jan-2055 00:00:01 GMT; path=/";
		}

		function getCookie(name) {
			var cookie = " " + document.cookie;
			var search = " " + name + "=";
			var setStr = null;
			var offset = 0;
			var end = 0;
			if (cookie.length > 0) {
				offset = cookie.indexOf(search);
				if (offset != -1) {
					offset += search.length;
					end = cookie.indexOf(";", offset)
					if (end == -1) 	{
						end = cookie.length;
					}
					setStr = unescape(cookie.substring(offset, end));
				}
			}
			return(setStr);
		}		
		
		function changeShflStatus(el) {
			nowPlay = plIndex[playItem];
			
			if (el.checked) {
				setCookie("jlp_shfl","shuffle");
				plIndex.sort(randOrd);
			} else {
				setCookie("jlp_shfl","notshuffle");
				plIndex.sort();
			}
			playItem = plIndex.find(nowPlay);
			 
		}
		
	</script>	
	<script type="text/javascript" src="<?=$base_uri?>/modules/mod_jlplayer/js/jq.js"></script>
	<script type="text/javascript">jQuery.noConflict();</script>
	<link href="<?=$base_uri?>/modules/mod_jlplayer/skin/skin.css" rel="stylesheet" type="text/css" />
	<script type="text/javascript" src="<?=$base_uri?>/modules/mod_jlplayer/js/jquery.jplayer.min.js"></script>
	
	<script type="text/javascript">
		var playItem = 0;
	 
		jQuery(function(){
			var jpPlayTime = jQuery("#jplayer_play_time");
			var jpTotalTime = jQuery("#jplayer_total_time");
			var jlp_shfl = getCookie("jlp_shfl");
			if (jlp_shfl == "shuffle") {
				document.getElementById('jlp_shfl').checked = true;
			} else if (jlp_shfl == "notshuffle") {
				document.getElementById('jlp_shfl').checked = false;
			}
			jsuri = baseuri+"/modules/mod_jlplayer/js/";
			jQuery("#jquery_jplayer").jPlayer({
				ready: function() {
					displayPlayList();
					playListInit(enable_autoplay); // Parameter is a boolean for autoplay.
				},
				errorAlerts:true,
				warningAlerts:true,
				swfPath: jsuri
			})
			.jPlayer("onProgressChange", function(loadPercent, playedPercentRelative, playedPercentAbsolute, playedTime, totalTime) {
				jpPlayTime.text(jQuery.jPlayer.convertTime(playedTime));
				jpTotalTime.text(jQuery.jPlayer.convertTime(totalTime));
			})
			.jPlayer("onSoundComplete", function() {
				playListNext();
			});
		 
			
			
			jQuery("#jplayer_previous").click( function() {
				playListPrev();
				return false;
			});
		 
			jQuery("#jplayer_next").click( function() {
				playListNext();
				return false;
			});
			
			
		});	
		
		
		function displayPlayList() {
			for (i=0; i < myPlayList.length; i++) {
				jQuery("#jplayer_playlist").append("<div id='jplayer_playlist_item_"+i+"'>"+ myPlayList[i].name +"</div>");
				jQuery("#jplayer_playlist_item_"+i).data( "index", i ).click( function() {
					var index = jQuery(this).data("index");
					if (plIndex[playItem] != index) {
						_index = plIndex.find(index);
						playListChange( _index, index );
					} else {
						jQuery("#jquery_jplayer").jPlayer("play");
					}
				});
			}
		}
	 
		function playListInit(autoplay) {
			if(autoplay) {
				playListChange(0, plIndex[0] );
			} else {
				playListConfig(0, plIndex[0] );
			}
		}
	 
		function playListConfig(_index, index ) {
			jQuery("#jplayer_playlist_item_"+plIndex[playItem]).removeClass("jplayer_playlist_current");
			jQuery("#jplayer_playlist_item_"+index).addClass("jplayer_playlist_current");
			playItem = _index;
			jQuery("#jquery_jplayer").jPlayer("setFile", myPlayList[plIndex[playItem]].mp3);
		}
	 
		function playListChange(_index, index ) {
			playListConfig(_index, index );
			jQuery("#jquery_jplayer").jPlayer("play");
		}

		function playListNext() {
			var _index = (playItem+1 < myPlayList.length) ? playItem+1 : 0;
			var index = plIndex[_index];
			playListChange(_index, index );
		}
	 
		function playListPrev() {
			var _index = (playItem-1 >= 0) ? playItem-1 : myPlayList.length-1;
			var index = plIndex[_index];
			playListChange(_index, index );
		}	
	
	</script>
	
	<?php include_once(JPATH_ROOT.DS.'modules/mod_jlplayer/skin/tpl.php'); ?> 
	
	
	<?php
}

I was messing around in there with $file
 

	if ($server_utf8 == 1) {
				$fname = rawurlencode($file[count($file)-1]);
			} else {
				$fname = rawurlencode($file[count($file)-1]);
			}
$fname = substr($fname, 0, -4);
			
			$file = $host."/".$music_dir."/psp.php?name=".$fname;
echo $file;

I am unsure how to retreive a file title only, with out the whole path, just the name and not even the file ext.
It comes up with all the files names in the echo.
Also I am not sure how joomline chooses just one file.   I am not a php designer and I am quite confused lol   Any help would be appreciated! Thank you.

Hey, so basically this is what im trying to do:

I'm writing an mp3 store, and want the user to be able to play the whole track before purchase. Currently all the music files are in a protected folder with permissions set so access isnt possible.

The mp3 player calls play.php?fid=encryptedfileid rather than the direct music link. This is all working perfectly.

The bit i am now stuck on is stopping the users going to play.php?fid=encryptedfileid directly and downloading the mp3 directly.

How do I make it so the server can execute the play.php file, but the user cannot?

I attempted to set a cookie in play.php and deny access if cookie was present, however the server also set the cookie, so this didnt work.

See play.php code (in this example, fid is just the filename, but it will be more encrypted, calling to a special md5 hash, albumid and artistid).


<?PHP

 // Define the path to file
 $filename=$_GET[fid];
 $file = "music/$filename.mp3";
 
 if(!$file)
 {
     // File doesn't exist, output error
     die('file not occupied');
 }
 elseif(!file_exists($file))
 {
    die('Error: File not found.');
 }
 else
 {
     // Set headers
     header("Cache-Control: public");
     header("Content-Description: File Transfer");
     header("Content-Disposition: attachment; filename=$file");
     header("Content-Type: application/octet-stream");
     header("Content-Transfer-Encoding: binary");
    
     // Read the file from disk
     readfile($file);
 }
 ?>


So to clarify, I need the server to access and execute this script with the mp3 player (simple javascript player) and the server not be able to visit play.php?fid=xxx directly to download.

Thanks

hi php freaks

I am using pdo as the driver for my new app the issue is I can't seem to find a clear answer. I want to sanise the vars that
are coming  into the database but pdo is suppose to fix all the issues. Is this true what other things do I need to watch for when using pdo they must have some flaws.

Thanks

Hi everyone,

     So, like my name says, I'm just a hobbyist PHPer, but I write the occassional PHP application for people, I've been doing it for quite a while and I fear that perhaps my way of securing my applications may be a bit antiquated... I was hoping that you guys/gals might be able to take a look and give me some help with perhaps how I could go about making these apps more secure...

     So, without further ado, here it is...

standard application page, e.g. index.php
Code: [Select]
<?
session_start();
if(!$_SESSION['Condition'] == 'Logged') {
    header("Location: login.php");
}
elseif($_SESSION['Condition'] == 'Logged') {
require "connection.inc";
?>


<?
}
?>
login.php page
Code: [Select]
<?
if(isset($_POST['Login'])) {
    include_once 'connection.inc';
    $count = 0;
    $query = "SELECT UserID FROM Users WHERE UserName = '$_POST[username]' AND UserPassword = '$_POST[password]'";
            $results = mysql_query($query)or die(mysql_error());
            $count = mysql_num_rows($results);
            while($row  =  mysql_fetch_array($results)) {
                $UserID = $row['UserID'];
            }
        if ($count == 1) {
            header("Location: loginaction.php?UserID=$UserID");
        }
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >
    <head>
        <title></title>
        <link rel="stylesheet" type="text/css" href="StyleSheet.css" />
        <script language="javascript" type="text/javascript">
            function loginValidate(form)
            {
                if (form.username.value == '')
                {
                    alert('You must supply a Username.');
                    form.username.focus();
                    return false;
                }
                if (form.password.value == '')
                {
                    alert('You must supply a Password.');
                    form.password.focus();
                    return false;
                }
                else
                {
                return true;
                }
            }
        </script>
    </head>
    <body>
        <?
        include_once 'header.inc';
        ?>
        <div id="LoginBox">
            <div id="SubFormBoxHeading">
                Log In
            </div>
                <form id="thisform" action="<? echo $_SERVER['PHP_SELF']; ?>" onsubmit="return loginValidate(this)" method="post">
                    <table>
                        <tr>
                            <td colspan="2">
                                <?
                                if (isset($_POST['Login']) && !$count == 1) {
                                    echo '<h3>Wrong Username and/or Password</h3>';
                                }
                                ?>
                            </td>
                        </tr>
                        <tr>
                            <td class="Labels">Username:</td>
                            <td><input type="input" id="username" name="username" size="20" /></td>
                        </tr>
                        <tr>
                            <td class="Labels">Password:</td>
                            <td><input type="password" id="password" name="password" size="20" /></td>
                        </tr>
                        <tr>
                            <td colspan="2">
                                <div style="text-align: center; margin-top: 20px; margin-bottom: 20px;">
                                    <input type="submit" id="Login" name="Login" value="Log In" />
                                </div>
                            </td>
                        </tr>
                    </table>
                </form>
        </div>
        <?
        include_once 'footer.inc';
        ?>
    </body>
</html>

loginaction.php page
Code: [Select]
<?
session_start();
$_SESSION['Condition'] = 'Logged';
$_SESSION['UserID'] = $_GET['UserID'];
        header("Location: index.php");
?>
and finally, the logout.php page
Code: [Select]
<?
session_start();
unset($_SESSION['Condition']);
unset($_SESSION['UserID']);
session_destroy();
header("Location: index.php");
?>

Besides "mysql_real_escape_string"ing all the user input what other security strings should you definitely include n your site?

I have nearly finished a website that i am making for my local community, they will be registering on the site and i am wandering what sort of security for the site i should be thinking about. I just dont want someone out there doing something to cause problem with the site and ruining it for everyone else.

I want to create an ADMIN directory with several directory under that.  I want to be certain that the user cannot log into any of the directory unless they have confirmed login.

Is $_session id's the best way to go?  Should I create on the flyer and attached to username?  What is the best practice for this?

Regards,
DED