PHP - Keeping Input Through Php Safe.

Hi guys, I have been using the same code for years now to include my default page and pull content into my layouts.   I found the code online and its a bit confusing so was just wondering if its still safe to use, and is it all needed nowadays? or is there a simpler way i could be doing this?   Thanks for any help

<?php

    if (isset($_GET['nav'])) 
{
    if (strpos($_GET['nav'], "/")) 
{
    $direc = substr(str_replace('..', '', $_GET['nav']), 0, strpos($_GET['nav'], "/")) . "/";
    $file = substr(strrchr($_GET['nav'], "/"), 1);
    if (file_exists($direc.$file.".php")) 
{
    require($direc.$file.".php");
} else {
    require("error.php");
}
} else {
    if (file_exists(basename($_GET['nav']).".php")) 
{
    require(basename($_GET['nav']).".php");
} else {
    require("error.php");
}
}
} else {
    require("links.php");
}
?>

I have a button that uses $_POST to send information to another page.  The data is in a hidden input so it's not possible for users to change information.  I have nothing to check if the data is correct on the other page.  Is it still possible for people to change the $_POST data though?  Or somehow send false $_POST data to the other page?

Hello,   I've noticed that there are services that I can pay to have my code checked for possibly unsafe / insecure code. But I'd rather audit the code myself, as my code is not meant to make money. Is there a list of safe ways to use PHP?   Also is there any automatic way to do this that is free? For instance is there a code checker?   I've noticed there are a number of ways to do PHP wrongly that can be easy to overlook. Is there a list of common PHP pitfalls?   Thanks.

I am building an XML string to send to another server.

The manual I am going off of says,

Quote

NOTE:
    * XML has a special set of characters that cannot be used in normal XML strings. These characters a
      Special Character    Equivalent
      &    &
      <    &lt;
      >    &gt;
      "    &quot;
      '    &#39;


It goes on to say...
Quote

# To avoid problems with special characters, URLEncode special characters (example: ~ ! @ # % ^ &) before sending to the IS Gateway
# If you are using POST method, UTF-8 encoding must be used.



I am unsure of what to do based on the information above?!

It looks like I might want to use urlencode??

Also, maybe I need either htmlentities (or possibly htmlspecialchars)??

Please enlighten me (and help protect my data)!! 

Thanks,



Debbie

I have created this login class (In all honesty this is the most commented and well structured class I have ever written, I usualy just use random functions in a functions.php file, which works but this felt good when I finished it )

I just wanted some advice to how safe and whether the way I have done this is 'good practise', or if there is anything I should add to future proof it.

This is the class:
Code: [Select]
<?php
/* 
Author: Craig Dennis
File: user_session.class.php
Purpose: Flexible user login class that handles logging in, checking a user is logged in, and logging out.

NOTE TO USE THIS CLASS YOU MUST ALREADY HAVE ALREADY CONNECTED TO THE DATABASE

Include this file at the top of each page you wish to protect
 include("inc/user_session.class.php"); //(This could be put at the top of a global include file)
 
Use the following code to check the user is logged in:
 $user_session = new user_session; //(This could be put at the top of a global include file)
 $user_session->validate_user(); //(This should only be left on the pages you wish to check for user validation)
 
You will want to use the public redirect_if_logged_in() function instead of validate_user() on the login page like this:
 $user_session->redirect_if_logged_in(); //(This will redirect a user from the current page to the specified landing page)
*/
class user_session{
// Change these variables below if the table and fields in your database do not match
public $t_name = "admins";
public $t_user = "username";
public $t_pass = "password";
public $t_lastlogin = "last_login"; //set $t_lastlogin = NULL if you do not have this field in your database

//Change $login_page and $landing_page if your page names are different to this one
public $login_page = "login.php";
public $landing_page = "logged_in.php";

//Change $log_in_error_msg if you wish to change the general error message when the user is unable to log in
public $log_in_error_msg = "The username or password you have entered is incorrect or does not exist";

//Do not touch anything below unless you know what your doing

/*
 * logged_in_user()
 * Returns value of the current logged in username
 */
public function logged_in_user(){
return $_SESSION['user_username'];
}

/*
 * log_in()
 * Takes 2 parameters ($username, $password)
 * Attempts to log in with the provided credentials, on success, the username and password are saved in the session for future testing
 */
public function log_in($username, $password){
$username = stripslashes(mysql_real_escape_string($username));
$password = stripslashes(mysql_real_escape_string($password));

$query_login = mysql_query("SELECT * FROM ".$this->t_name."
  WHERE ".$this->t_user."='$username' AND ".$this->t_pass."='$password'");;

$login_accepted = mysql_num_rows($query_login);

if($login_accepted == 1){
if($t_lastlogin != NULL){
$query_update_last_login = mysql_query("UPDATE ".$this->t_name." SET ".$this->t_lastlogin."='".time()."'
WHERE ".$this->t_user."='$username'");
}
$_SESSION['user_username'] = $username;
$_SESSION['user_password'] = $password;
return true;
}else{
return false;
}
}

/*
 * check_user()
 * Returns true if the current session credentials can be found in the database, otherwise returns false
 */
public function check_user(){
$query_login = mysql_query("SELECT * FROM ".$this->t_name."
  WHERE ".$this->t_user."='".$_SESSION['user_username']."' 
AND ".$this->t_pass."='".$_SESSION['user_password']."'");

$login_accepted = mysql_num_rows($query_login);

if($login_accepted == 1){
return true;
}else{
return false;
}
}

/*
 * validate_user()
 * Returns true if the current session credentials can be found in the database, otherwise logs user out and returns false
 */
public function validate_user(){
$login_accepted = $this->check_user();

if($login_accepted == 1){
return true;
}else{
$this->log_out();
return false;
}
}

/*
 * redirect_if_logged_in()
 * Redirects the user to the specified landing page if the user is logged in
 */
public function redirect_if_logged_in(){
if($this->check_user()){
header("Location: ".$this->landing_page);
}
}

/*
 * log_out()
 * Logs the user out by setting the session credentials to an empty string and redirecting them to the specified login page
 */
public function log_out(){
$_SESSION['user_username'] = "";
$_SESSION['user_password'] = "";
header("Location: ".$this->login_page);
}
}
?>

Any comments or advice are appreciated.

Hi guys, I've been around here for a few years, but for some reason my other account doesn't seem to 'exist' anymore which was real annoying. I also noticed the captcha here was kind of buggy has anyone else been getting that? I'd enter it in case sensative 9-10 times before it would finally work.   Anyways, I've been looking through a lot of research in upgrading my server from Mysql to Mysqli funtions. What I am curious about though is other peoples opinions and thoughts on how to make user input safer. For the time being I've just been using mysql_real_escape_string and htmlspecialchars. I've done quite a bit of research on this and there really isn't much for any guides on how to keep your data clean and safe. I've seen a lot of posts that anymore these two functions are not enough to secure your data. So I'm curious what people in this community are doing (annonomysly) to keep your user input safe. I'm also looking into prepared statements as well with Mysqli. Anyways any responses are much appreciated, would love to chat with you guys about this!   Does anyone know if there was some deal with why I can't access my origional account? I entered in all of the only 5 email addresses I use. It said it sent an email to the one, but it never appeared in junk/inbox.

I built a address book for customers and i realize now im not sure the best way to allow the customer to edit/delete their addresses, but stopping them from pulling/editing other customers info.

Even if i use post data only they could still view the page source and see the address ID being posted to the next page and change it, to see or edit someone elses data...

Should i encrypt the ID? Is that even good enough?

Im using PHP/MYSQL

Hey guys!
I have a doubt and this is a question that relates Flash and PHP...

I have a flash (swf) file that grabs/sends variables from/to php.
That swf file is FULLY encrypted and the paths to the PHP urls are also encrypted.

Is there any other way a hacker could find out where and which my PHP files are located/named?

Any ideas, suggestions?
Thanks in advance!
Cheers,

Hi,     Recently I've been trying writing a safe password hash and I wanted to know that if I use an MD5 hash at the end, just so it will be like some short of "packed",so instead of saving a 128 string, I'll use md5 to "pack" it into 32 characters and save up to 96 characters.   I know MD5 isn't safe and all, but the question is, does it lower the security ?   Also, would be happy for feedbacks about my password hash

function hash_($input,$key) {

     $op=hash("whirlpool",hash("sha512",$key) . "$" . $input . "$" . hash("sha512",$key));

I am using seo friendly urls so when someone makes a post named "this is a post" the url will point to www.example.com/topic/this_is_a_post

But when the user enters a character in their post name that means something in a url(? /) it obviously breaks. How can i make the urls safe from this without str_replace as i want to keep the characters.

I am using this script for "remember me" option:
                      if (isset($_POST['rememberme']))
                        {
                          /* Set cookie to last 1 year */
                          setcookie('username', $_POST['user_name'], time() + 60 * 60 * 24 * 365);
                          setcookie('password', sha1($_POST['user_pass']), time() + 60 * 60 * 24 * 365);
                        }

Is it safe to save user data in cookie or there is better way? Can somebody steal password if there is more than one user at same computer? What do you suggest?

Hi,

I am using parameterized queries on my code, here's the relevant part

Code: [Select]
$params=$_POST['ITGtable'];

$tsql2 = "SELECT COLUMN_NAME, DATA_TYPE, ORDINAL_POSITION,
  COLUMN_DEFAULT, CHARACTER_MAXIMUM_LENGTH, IS_NULLABLE
  FROM INFORMATION_SCHEMA.COLUMNS
  WHERE TABLE_NAME=?";

/* Execute the statement with the specified parameter value.
Display the returned data if no errors occur. */
$stmt2 = sqlsrv_query( $conn, $tsql2, $params);
if( $stmt2 === false )
{
     echo "Statement 2 could not be executed.\n";
     die( print_r(sqlsrv_errors(), true));
}
else
{
     $qty = sqlsrv_fetch_array( $stmt2);
}
Do I really have to sanitize $_POST['ITGtable'] for apostrophe, semicolon, etc, to avoid SQL injection problems? Or just with above code I should be safer (I did not say safe) against SQL injection? And if the answer is "No", what could be the sanitize code of function? I am using sqlsrv and MS-SQL database engine; most of the functions we have for sanitize inputs on MySQL are not available for MS-SQL.

Thanks in advance,

I am trying to implement what I call private uploads. Basically, users can check a box to indicate they want their file "private"

If so, the upload location is then (exampled as): _domain_/private-folder/$randomfolder

Upon uploading their file, the random folder is created, their file moved to the directory, the upload information stored to the database, .htaccess file is created like so:


info to add to new .htaccess:
Code: [Select]
<files "*.*">
Deny from All
</files>

<files "*.*">
Allow from
$domains
</files>

the string $domains is the domains they enter each seperated by a new line in a form textarea.

The problem - how can I make sure this is safe. i.e. I want the string to be obviously proofed with php so that no matter what they input, only domains will be outputted.

I don't need code written for me (maybe), I'm just unsure of the necessary methods I should use.

Customers visit a "select merchandise page."
Their list of items is displayed (merchandise SKU numbers). The displayed list of their expands as they add more stuff.
When they're done, they create a packing slip that appears on a new "finished.php" page.

Question: Is using 2 forms and hidden inputs the secure and accepted way to do this?

--------------------------------------------------------
<?php
$added = $_POST["added"] . ',' . $_POST["more-stuff"];
echo "Here is what's been added: $added"; // item 1, item 2, item 3, etc.
?>

<form method="post" action="<?=$SERVER['PHP_SELF']?>">
<input type="text" name="added">
<input type="hidden" name="more-stuff" value="<?=$added?>">
</form>

When finished, click here to create Packing Slip:

<form method="post" action="finished.php">
<input type="submit" value="CREATE PACKING SLIP">
<input type="hidden" name="finished" value="<?=$added?>">
</form>
--------------------------------------------------------

Thank you!!

 

Several months ago I created an "Add an Article" form to create articles for my website.

Just now it dawned on me that this is really insecure, because if someone happened to know that my form was located at...
Code: [Select]
http://local.dev3/create_article.php
...then they could insert things into my database?!   

What are some things I can do to make this back-end, admin form secure and out of the hands of hackers?

Thanks,


Debbie