PHP Top 5 - Revision history

Imifos at 11:04, 21 January 2016

2016-01-21T11:04:10Z

2015-12-02T08:52:04Z

2007-01-16T19:50:55Z

‎How to Protect Against It: fixed function typo and linked it

2007-01-16T19:40:24Z

‎How to Protect Against It: added session tampering fix for devs

2006-08-17T14:45:58Z

‎addslashes() / magic_quotes

2006-07-12T08:15:07Z

‎References

2006-07-12T08:13:55Z

‎References

2006-07-12T08:13:15Z

‎References

2006-07-12T08:12:43Z

‎References

2006-07-12T08:12:10Z

‎References

← Older revision		Revision as of 11:04, 21 January 2016
Line 556:		Line 556:
	[[User:Vanderaj\|Vanderaj]] 00:15, 25 June 2006 (EDT)		[[User:Vanderaj\|Vanderaj]] 00:15, 25 June 2006 (EDT)

−	[[Category:~~OWASP~~ PHP ~~Project~~]]	+	[[Category:PHP]]

@@ Line 555: / Line 555: @@
 [[User:Vanderaj|Vanderaj]] 00:15, 25 June 2006 (EDT)
-[[Category:PHP]]
 [[Category:OWASP PHP Project]]

@@ Line 523: / Line 523: @@
 * Move PHP’s session variables from the default location and secure the new location to prevent cross-user session disclosure and tampering (this is not easy)
 * Enable safe_mode as appropriate (there are many options :-) but be aware that safe_mode really isn't safe and can be worse than useless)
-* Use open_base_dir restrictions
+* Use [http://no2.php.net/manual/en/features.safe-mode.php#ini.open-basedir open_basedir] restrictions
 * Ensure that users have a place outside the web root (public_html) to store logs and secrets
 * Run PHP under a least privilege model, preferably as the user, via the use of PHPsuExec, php_suexec or suPHP

@@ Line 517: / Line 517: @@
 * Try to move secrets and logs out of the web root if at all possible – see the references on “Shared Hosting” by Chris Shiflett
 * Ensure that your scripts are compatible with safe mode restrictions and will work under suPHP or other user execution wrapper
 '''''Hosters'''''

@@ Line 31: / Line 31: @@
 * magic_quotes_gpc is disabled in all PHP installations
 * addslashes() should be deprecated - it does not protect against SQL injections
-* Software should move post-haste to support safe(r) database access mechanisms, such as PDO or mysql_escape_real_string()
+* Software should move post-haste to support safe(r) database access mechanisms, such as PDO or mysql_real_escape_string()
 PDO requires hosters to upgrade their PHP to the latest PHP 5.1. Unfortunately, there has been low take up of the safer versions of PHP due to perceived incompatibilities with much of the PHP software base. Hosters should move to the latest PHP as quickly as possible to encourage the adoption of safer software.

@@ Line 393: / Line 393: @@
 ===References===
 * [[:Category:OWASP_WebScarab_Project]]
 * PEAR::DB, http://pear.php.net/package/DB
 * Shiflett, C., SQL Injection, http://shiflett.org/articles/security-corner-apr2004
 ==P4: PHP Configuration==

@@ Line 236: / Line 236: @@
 ===References===
 * PHP htmlentities():http://php.net/htmlentities
@@ Line 241: / Line 250: @@
 * Klein, Amit, Cross-site Scripting Explained, http://crypto.stanford.edu/cs155/CSS.pdf
 * Klein, Amit, Cross-site Scripting of the Third Kind, http://www.webappsec.org/projects/articles/071105.shtml
 * Shiflett, C., Ideology, http://shiflett.org/articles/security-corner-nov2004
 ==P3: SQL Injection==

@@ Line 110: / Line 110: @@
 ===References===
 * http://php.net/features.safe-mode
 * http://php.net/features.remote-files.php
 ==P2: Cross-site scripting==

@@ Line 447: / Line 447: @@
 * Alshanetsky, I., php|architect's Guide to PHP Security, (C) 2005 Marco Tabini & Associates, Inc ISBN 0973862106
-* Shiflett, C., Essential PHP Security (© October 2005, O'Reilly)
+* Shiflett, C., Essential PHP Security, © October 2005, O'Reilly ISBN 059600656X
 Web sites