PHP - Security Need Advice

I'm building an e-commerce website using php and mysql and I'm a bit worried about security issues.  The website is going to be handling personal information so I want to make sure that it's secure and that no-one can get hold of it.  I don't really have any idea about and security issues or problems that I could run into and perhaps you could point me in the direction or some tutorials that would be really great.  Also if anyone here has been in the same situation what did you do to make your site as secure as possible?

Thanks for any help. 

Hi everyone

I'm kinda new to PHP and have a couple of questions;

1: How secure is PHP, is it very hackable? Are there things you recommend to make it more secure?

2: I am building a little employee system for staff at a friends company and they can view personal information when they login, as well as ordering stuff with online payment through WorldPay.

What is therefore the best and most secure way of handling passwords, logins, data, insert statements etc.

I basically want to make it as secure as possible and hopefully learn some new skills

Any tips or help would be great

Thanks

I have just made a couple of forms that submit data to a mysql database.  I was wondering what measures I need to make to in order to keep the whole thing very secure.  At the moment I have stripped the inputs of tags and forward slashes.  Is there anything else I should do?

Also some field in the form allow the user to enter a url.  With these fields I have not stripped them of forward slashes.  Is this a bad idea?  Should I do something like replace the forward slashes with something else and then reverse this process every time I extract that data from the database?

I really have less idea about website security. Yesterday for the first time I learned website hacking and applied that method to my web page. My webpage was completely down after applying that.
Q) To free a site from hacking what techniques are followed?

I want to create an ADMIN directory with several directory under that.  I want to be certain that the user cannot log into any of the directory unless they have confirmed login.

Is $_session id's the best way to go?  Should I create on the flyer and attached to username?  What is the best practice for this?

Regards,
DED

Hi, I am looking to create a directory that can not be accessed using .htaccess and neither can files directly.
But I want to make it so when you are signed into joomla you can access the files via a mp3 player on the sight.   My mp3 extention is joomline player flplayer.
And I heard that if I cange the name of the file in joomla fomr lovelove.com/audio/love/abc.mp3 to lovelove.com/audio/love/abc.php?name=abc   and then that abc.php script (inside the script it checks if you are logged in) will retrieve the file name, and the joomline will play it it will work.   is this possible?

Also, if not what can I do for this to work?   Right now my script is not working as the joomline looks up all the mp3 files as one big string. this is the abc.php which on my site its calld psp.php

<?php
 define( '_JEXEC', 1 );
    define( 'JPATH_BASE', realpath(dirname(__FILE__).'/../../' ));  
    require_once ( JPATH_BASE .'/includes/defines.php' );
    require_once ( JPATH_BASE .'/includes/framework.php' );
$mainframe =& JFactory::getApplication('site');

 if( !empty( $_GET['name'] ) )
{
  // check if user is logged    
if(JFactory::getUser()->guest) {
die( "ERROR: invalid song or you don't have permissions to download it." );
}
else { 
    $psp = preg_replace( '#[^-\w]#', '', $_GET['name'] );
    $psp_file = "{$_SERVER['DOCUMENT_ROOT']}/audio/live/{$psp}.mp3";
    if( file_exists( $psp_file ) )
    {
      header( 'Cache-Control: public' );
      header( 'Content-Description: File Transfer' );
      header( "Content-Disposition: attachment; filename={$psp_file}" );
      header( 'Content-Type: application/mp3' );
      header( 'Content-Transfer-Encoding: binary' );
      readfile( $psp_file );
      exit;
    }
  }
}
 ?>

then I have joomline player    jlplayer

<?php
/**
 * JoomLine mp3 player - Joomla mp3 player
 *
 * @version 1.5
 * @package JoomLine mp3 player
 * @author Anton Voynov (anton@joomline.ru), Sergii Gaievskiy (shturman.kh@gmail.com)
 * @copyright (C) 2010 by Anton Voynov(http://www.joomline.ru)
 * @license GNU/GPL: http://www.gnu.org/copyleft/gpl.html
 *
 * If you fork this to create your own project,
 * please make a reference to JoomLine someplace in your code
 * and provide a link to http://www.joomline.ru
 **/

defined('_JEXEC') or die('Restricted access');

function ascii2hex($ascii, $reverse = false) {
	$hex = array();
	for ($i = 0; $i < strlen($ascii); $i++) {
		$byte = strtoupper(dechex(ord($ascii{$i})));
		$byte = str_repeat('0', 2 - strlen($byte)).$byte;
		$hex[] = $byte;
	}
	if ($reverse) $hex = array_reverse($hex);
	return implode(" ",$hex);
}

function read_frame (&$f, &$tagdata, $frame) {
	$pos = strpos($tagdata,$frame);
	if ( $pos !== FALSE) {
		// frame found. read length of this frame
		fseek($f, 10+$pos+4);
		$frame2len = hexdec(ascii2hex(fread($f,4)));
		if (($frame2len-1) > 0) {
			// read frame data
			fseek($f, 10+$pos+4+2+4+1);
			$data = trim(fread($f,$frame2len-1));

			$hexfdata = ascii2hex($data);
				if ( substr($hexfdata,0,5) == 'FF FE' or substr($hexfdata,0,5) == 'FE FF' ) {
					$data = iconv("UCS-2","UTF-8",$data);
				} else {
					if (!preg_match('//u', $data)) {
						$data = iconv("cp1251", "UTF-8",$data);
			}
				}
			return $data;
		} else {
			return false;
		}
	} else {
		return false;
	}
	
}

function readmp3tag($file) {
	$f = fopen($file, 'rb');
	rewind($f);
	fseek($f, -128, SEEK_END);
	$tmp = fread($f,128);
	if ($tmp[125] == Chr(0) and $tmp[126] != Chr(0)) {
		// ID3 v1.1
		$format = 'a3TAG/a30NAME/a30ARTISTS/a30ALBUM/a4YEAR/a28COMMENT/x1/C1TRACK/C1GENRENO';
	} else {
		// ID3 v1
		$format = 'a3TAG/a30NAME/a30ARTISTS/a30ALBUM/a4YEAR/a30COMMENT/C1GENRENO';
	}
	$id3v1tag = unpack($format, $tmp);

	// read tag length
	fseek($f, 8);
	$tmp = fread($f,2);
	$tmp = ascii2hex($tmp);
	$taglen= hexdec($tmp);
	$tagdata = "";
	if ($taglen > 0) {
	//read tag data
	fseek($f, 10);
	$tagdata = fread($f,$taglen);
	}
	
	// find song title frame
	$title = read_frame ($f, $tagdata, "TIT2");
	if (!$title) {
		if ($id3v1tag['TAG']== 'TAG' && ascii2hex(substr($id3v1tag['NAME'],0,1)) != '00' ) {
			$title = $id3v1tag['NAME'];
		} else {
		$title = explode(DS,$file);
		$title = $title[count($title)-1];
		$title = explode('.',$title);
		$title=$title[0];
	}
		if (!preg_match('//u', $title)) $title = iconv("cp1251", "UTF-8",$title);
	}
	$artist = read_frame ($f, $tagdata, "TPE1");
	if (!$artist) {
		if ($id3v1tag['TAG']== 'TAG' &&  ascii2hex(substr($id3v1tag['ARTISTS'],0,1)) != '00') {
			$artist = $id3v1tag['ARTISTS'];
		} else {
			$artist = "";
	}
	}
	if (!preg_match('//u', $artist)) $artist = iconv("cp1251", "UTF-8//TRANSLIT",$artist);
	
	$id3tag['NAME']		= $title;
	$id3tag['ARTIST']	= $artist;

	return $id3tag;
}

if (DS == "/") 
	$dir = str_replace("\\",DS,$music_dir);
else 
	$dir = str_replace("/",DS,$music_dir);
$dir = JPATH_ROOT.DS.$dir;


if (!is_dir($dir)) {
	echo "Wrong dir in settings";
} else {
	$files = glob($dir.DS."*.{mp3,MP3}",GLOB_BRACE);
	if (count($files) > 0) {
		sort($files);
		$host = $base_uri;
		foreach ($files as $file) {
			$tags = readmp3tag($file);
			$file = explode (DS, $file);
			if ($server_utf8 == 1) {
				$fname = rawurlencode($file[count($file)-1]);
			} else {
				$fname = rawurlencode($file[count($file)-1]);
			}
$fname = substr($fname, 0, -4);
			
			$file = $host."/".$music_dir."/psp.php?name=".$fname;
echo $file;
			$artist = trim($tags['ARTIST']);
			$artist = $artist == "" ? "" : "{$tags['ARTIST']} - ";
			$playlist[] = '{name:"'.$artist.$tags['NAME'].'",mp3:"'.$file.'"}';
		}
	}
	/*
	 * 	
	//if(!window.jQuery) {
		document.write(unescape('<script type="text/javascript" src="<?=$base_uri?>/modules/mod_jlplayer/js/jq.js">%3C/script%3E'));
		document.write(unescape('<script type="text/javascript">jQuery.noConflict();%3C/script%3E'));
	//}

	 * 
	 */
	?>
	<script type="text/javascript">
	var myPlayList = [
		<?php 
			echo implode(",\n		",$playlist)."\n"; 
		?>
		];
		Array.prototype.find=function(v){
				for (i=0;i<this.length;i++){
						if (this[i]==v) return i;
				}
				return 0;
		}
		var plIndex = [];
		for (i=0;i<myPlayList.length;i++) {
				plIndex[i] = i;
		}
		<?php if ($shfl == 1) : ?>
		//shuffle
		function randOrd(){
			return (Math.round(Math.random())-0.5);
		}
		plIndex.sort(randOrd);
		<?php endif; ?>
		function setCookie (name, value) {
					document.cookie = name + "=" + escape(value) + "; expires=Thu, 01-Jan-2055 00:00:01 GMT; path=/";
		}

		function getCookie(name) {
			var cookie = " " + document.cookie;
			var search = " " + name + "=";
			var setStr = null;
			var offset = 0;
			var end = 0;
			if (cookie.length > 0) {
				offset = cookie.indexOf(search);
				if (offset != -1) {
					offset += search.length;
					end = cookie.indexOf(";", offset)
					if (end == -1) 	{
						end = cookie.length;
					}
					setStr = unescape(cookie.substring(offset, end));
				}
			}
			return(setStr);
		}		
		
		function changeShflStatus(el) {
			nowPlay = plIndex[playItem];
			
			if (el.checked) {
				setCookie("jlp_shfl","shuffle");
				plIndex.sort(randOrd);
			} else {
				setCookie("jlp_shfl","notshuffle");
				plIndex.sort();
			}
			playItem = plIndex.find(nowPlay);
			 
		}
		
	</script>	
	<script type="text/javascript" src="<?=$base_uri?>/modules/mod_jlplayer/js/jq.js"></script>
	<script type="text/javascript">jQuery.noConflict();</script>
	<link href="<?=$base_uri?>/modules/mod_jlplayer/skin/skin.css" rel="stylesheet" type="text/css" />
	<script type="text/javascript" src="<?=$base_uri?>/modules/mod_jlplayer/js/jquery.jplayer.min.js"></script>
	
	<script type="text/javascript">
		var playItem = 0;
	 
		jQuery(function(){
			var jpPlayTime = jQuery("#jplayer_play_time");
			var jpTotalTime = jQuery("#jplayer_total_time");
			var jlp_shfl = getCookie("jlp_shfl");
			if (jlp_shfl == "shuffle") {
				document.getElementById('jlp_shfl').checked = true;
			} else if (jlp_shfl == "notshuffle") {
				document.getElementById('jlp_shfl').checked = false;
			}
			jsuri = baseuri+"/modules/mod_jlplayer/js/";
			jQuery("#jquery_jplayer").jPlayer({
				ready: function() {
					displayPlayList();
					playListInit(enable_autoplay); // Parameter is a boolean for autoplay.
				},
				errorAlerts:true,
				warningAlerts:true,
				swfPath: jsuri
			})
			.jPlayer("onProgressChange", function(loadPercent, playedPercentRelative, playedPercentAbsolute, playedTime, totalTime) {
				jpPlayTime.text(jQuery.jPlayer.convertTime(playedTime));
				jpTotalTime.text(jQuery.jPlayer.convertTime(totalTime));
			})
			.jPlayer("onSoundComplete", function() {
				playListNext();
			});
		 
			
			
			jQuery("#jplayer_previous").click( function() {
				playListPrev();
				return false;
			});
		 
			jQuery("#jplayer_next").click( function() {
				playListNext();
				return false;
			});
			
			
		});	
		
		
		function displayPlayList() {
			for (i=0; i < myPlayList.length; i++) {
				jQuery("#jplayer_playlist").append("<div id='jplayer_playlist_item_"+i+"'>"+ myPlayList[i].name +"</div>");
				jQuery("#jplayer_playlist_item_"+i).data( "index", i ).click( function() {
					var index = jQuery(this).data("index");
					if (plIndex[playItem] != index) {
						_index = plIndex.find(index);
						playListChange( _index, index );
					} else {
						jQuery("#jquery_jplayer").jPlayer("play");
					}
				});
			}
		}
	 
		function playListInit(autoplay) {
			if(autoplay) {
				playListChange(0, plIndex[0] );
			} else {
				playListConfig(0, plIndex[0] );
			}
		}
	 
		function playListConfig(_index, index ) {
			jQuery("#jplayer_playlist_item_"+plIndex[playItem]).removeClass("jplayer_playlist_current");
			jQuery("#jplayer_playlist_item_"+index).addClass("jplayer_playlist_current");
			playItem = _index;
			jQuery("#jquery_jplayer").jPlayer("setFile", myPlayList[plIndex[playItem]].mp3);
		}
	 
		function playListChange(_index, index ) {
			playListConfig(_index, index );
			jQuery("#jquery_jplayer").jPlayer("play");
		}

		function playListNext() {
			var _index = (playItem+1 < myPlayList.length) ? playItem+1 : 0;
			var index = plIndex[_index];
			playListChange(_index, index );
		}
	 
		function playListPrev() {
			var _index = (playItem-1 >= 0) ? playItem-1 : myPlayList.length-1;
			var index = plIndex[_index];
			playListChange(_index, index );
		}	
	
	</script>
	
	<?php include_once(JPATH_ROOT.DS.'modules/mod_jlplayer/skin/tpl.php'); ?> 
	
	
	<?php
}

I was messing around in there with $file
 

	if ($server_utf8 == 1) {
				$fname = rawurlencode($file[count($file)-1]);
			} else {
				$fname = rawurlencode($file[count($file)-1]);
			}
$fname = substr($fname, 0, -4);
			
			$file = $host."/".$music_dir."/psp.php?name=".$fname;
echo $file;

I am unsure how to retreive a file title only, with out the whole path, just the name and not even the file ext.
It comes up with all the files names in the echo.
Also I am not sure how joomline chooses just one file.   I am not a php designer and I am quite confused lol   Any help would be appreciated! Thank you.

I have nearly finished a website that i am making for my local community, they will be registering on the site and i am wandering what sort of security for the site i should be thinking about. I just dont want someone out there doing something to cause problem with the site and ruining it for everyone else.

Hi everyone,

     So, like my name says, I'm just a hobbyist PHPer, but I write the occassional PHP application for people, I've been doing it for quite a while and I fear that perhaps my way of securing my applications may be a bit antiquated... I was hoping that you guys/gals might be able to take a look and give me some help with perhaps how I could go about making these apps more secure...

     So, without further ado, here it is...

standard application page, e.g. index.php
Code: [Select]
<?
session_start();
if(!$_SESSION['Condition'] == 'Logged') {
    header("Location: login.php");
}
elseif($_SESSION['Condition'] == 'Logged') {
require "connection.inc";
?>


<?
}
?>
login.php page
Code: [Select]
<?
if(isset($_POST['Login'])) {
    include_once 'connection.inc';
    $count = 0;
    $query = "SELECT UserID FROM Users WHERE UserName = '$_POST[username]' AND UserPassword = '$_POST[password]'";
            $results = mysql_query($query)or die(mysql_error());
            $count = mysql_num_rows($results);
            while($row  =  mysql_fetch_array($results)) {
                $UserID = $row['UserID'];
            }
        if ($count == 1) {
            header("Location: loginaction.php?UserID=$UserID");
        }
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >
    <head>
        <title></title>
        <link rel="stylesheet" type="text/css" href="StyleSheet.css" />
        <script language="javascript" type="text/javascript">
            function loginValidate(form)
            {
                if (form.username.value == '')
                {
                    alert('You must supply a Username.');
                    form.username.focus();
                    return false;
                }
                if (form.password.value == '')
                {
                    alert('You must supply a Password.');
                    form.password.focus();
                    return false;
                }
                else
                {
                return true;
                }
            }
        </script>
    </head>
    <body>
        <?
        include_once 'header.inc';
        ?>
        <div id="LoginBox">
            <div id="SubFormBoxHeading">
                Log In
            </div>
                <form id="thisform" action="<? echo $_SERVER['PHP_SELF']; ?>" onsubmit="return loginValidate(this)" method="post">
                    <table>
                        <tr>
                            <td colspan="2">
                                <?
                                if (isset($_POST['Login']) && !$count == 1) {
                                    echo '<h3>Wrong Username and/or Password</h3>';
                                }
                                ?>
                            </td>
                        </tr>
                        <tr>
                            <td class="Labels">Username:</td>
                            <td><input type="input" id="username" name="username" size="20" /></td>
                        </tr>
                        <tr>
                            <td class="Labels">Password:</td>
                            <td><input type="password" id="password" name="password" size="20" /></td>
                        </tr>
                        <tr>
                            <td colspan="2">
                                <div style="text-align: center; margin-top: 20px; margin-bottom: 20px;">
                                    <input type="submit" id="Login" name="Login" value="Log In" />
                                </div>
                            </td>
                        </tr>
                    </table>
                </form>
        </div>
        <?
        include_once 'footer.inc';
        ?>
    </body>
</html>

loginaction.php page
Code: [Select]
<?
session_start();
$_SESSION['Condition'] = 'Logged';
$_SESSION['UserID'] = $_GET['UserID'];
        header("Location: index.php");
?>
and finally, the logout.php page
Code: [Select]
<?
session_start();
unset($_SESSION['Condition']);
unset($_SESSION['UserID']);
session_destroy();
header("Location: index.php");
?>

Besides "mysql_real_escape_string"ing all the user input what other security strings should you definitely include n your site?

In short i want to use the following code below, when someone selects there option and submits it, it would bring up details from the database on this user from the selected table, can you explain what it would be called doing this so i can look it up, Sorry to be a pain, Cheers.

Code: [Select]
<select name="target2" id="target2">

    <option value=""></option>

  <?php

  $sql = "SELECT player_id, friend_id, name, is_active FROM contacts as c JOIN players as p ON c.friend_id = p.id WHERE c.player_id = $playerID AND is_active = 1 ORDER BY name ASC";

  $que = mysql_query($sql) or die(mysql_error());

  while($list = mysql_fetch_array($que)) {

  ?>

  <option value="<?php echo $list['friend_id'] ?>"><?php echo $list['name'] ?></option>

  <?php } ?>

  </select>

Right now I have a SESSION so when users flip though pages they carry their info with them, what I'm trying to do now is that userhome.php can't be accesses unless the user just was succesful in cracking there system.. game I'm creating for those of you helping and following me while I do this! it's a virutal hacking simulation and where I'm now is that the user's passwordcracker was compared to the target systems 'systemkey' and either granted him access or didn't, if it did it displayed a progress bar then fowarded to userhome.php where the target users info will lay, right now though if I just type in userhome.php i get there without haveing the crack it.... any ideas?

for those of you who don't know i am creating a piece of forum software called ASF. Ive done it by myself so far but as it grows i find it harder to write the code and keep organised. my code is a mess and things arent done the way they should be. So if anyone can give me advice or wants to help i could post some of the files for download. Even if you just want to have a look and let me know waht you think.

Thanks
Carl

http://www.thevault.cz.cc

Hi all,

I am looking as a pet project to develop a review site, with the info stored in a database by id and the information grabbed bet get id and then displayed on a dynamic page, eg review.php?id=1

My question is this, if i throw keywords into the mix for each review, will search engines cache a review like this? Or would I need static pages for google etc to find the info?

Thanks

So here's my problem I'm not sure how to approach this:

I have a table with user_items which are stored together separated by commas.
Code: [Select]
13,12,11,9,27,15,16,22,21,23,24,26,29,30,31,32,33
Now, I have a script where the user is in a trade and I want to verify the item they are trying to trade, but is there an alternative other than grabbing all of that users' items and checking that one item with all of the records?

I've tried using
Code: [Select]
SELECT * FROM MYTABLE WHERE user_item_id IN(33)
As an example to see if it will pull the rows with that ID.  It didn't seem to work, am I doing it wrong? if so, forgive me. Any suggestions/help? The main problem is I don't want to have to explode that data and use a foreach to check that one item against all of that users items, as they could have well over 500.