Talk:PHP Security Cheat Sheet - Revision history

Markus Malkusch: reference to PHP distribution

2014-03-18T12:31:48Z

reference to PHP distribution

Roy Vanegas: Just signing my name.

2014-03-18T03:45:47Z

Just signing my name.

Roy Vanegas: /* Citing 72% of servers stat */ new section

2014-03-18T03:41:40Z

‎Citing 72% of servers stat: new section

Jmanico at 00:07, 26 November 2012

2012-11-26T00:07:35Z

Peter Mosmans: added question

2012-10-16T04:47:16Z

added question

Abbas Naderi: removed unappropriate public discussions

2012-09-21T14:51:23Z

removed unappropriate public discussions

Abbas Naderi: continue on discussion on PHP.ini settings

2012-07-08T11:38:58Z

continue on discussion on PHP.ini settings

Achim: /* php.ini */

2012-07-05T21:56:30Z

‎php.ini

Abbas Naderi: mediawiki is stupid on newlines

2012-07-04T23:09:09Z

mediawiki is stupid on newlines

Abbas Naderi: added link to my page

2012-07-04T23:08:32Z

added link to my page

← Older revision		Revision as of 12:31, 18 March 2014
Line 62:		Line 62:
	Can someone provide the source for the statistic under the “PHP overview” section that 72% of web servers run PHP. Also, is that 72% of ''all'' servers worldwide?		Can someone provide the source for the statistic under the “PHP overview” section that 72% of web servers run PHP. Also, is that 72% of ''all'' servers worldwide?
	— [[User:Roy Vanegas\|Roy Vanegas]] ([[User talk:Roy Vanegas\|talk]]) 22:45, 17 March 2014 (CDT)		— [[User:Roy Vanegas\|Roy Vanegas]] ([[User talk:Roy Vanegas\|talk]]) 22:45, 17 March 2014 (CDT)
		+
		+	: W3 Techs claims [http://w3techs.com/technologies/details/pl-php/all/all 81.8%] "of all the websites whose server-side programming language we know". --[[User:Markus Malkusch\|Markus Malkusch]] ([[User talk:Markus Malkusch\|talk]]) 07:31, 18 March 2014 (CDT)

← Older revision		Revision as of 03:45, 18 March 2014
Line 61:		Line 61:

	Can someone provide the source for the statistic under the “PHP overview” section that 72% of web servers run PHP. Also, is that 72% of ''all'' servers worldwide?		Can someone provide the source for the statistic under the “PHP overview” section that 72% of web servers run PHP. Also, is that 72% of ''all'' servers worldwide?
		+	— [[User:Roy Vanegas\|Roy Vanegas]] ([[User talk:Roy Vanegas\|talk]]) 22:45, 17 March 2014 (CDT)

← Older revision		Revision as of 03:41, 18 March 2014
Line 57:		Line 57:

	Hi Abbas, could you add some clarification for ORM? Not everyone knows the acronym which diminishes the general readability and usability. Thanks! --[[User:Peter Mosmans\|Peter Mosmans]] 04:47, 16 October 2012 (UTC)		Hi Abbas, could you add some clarification for ORM? Not everyone knows the acronym which diminishes the general readability and usability. Thanks! --[[User:Peter Mosmans\|Peter Mosmans]] 04:47, 16 October 2012 (UTC)
		+
		+	== Citing 72% of servers stat ==
		+
		+	Can someone provide the source for the statistic under the “PHP overview” section that 72% of web servers run PHP. Also, is that 72% of ''all'' servers worldwide?

@@ Line 1: / Line 1: @@
 === NOTOC ===
-<nowiki>__NOTOC__</nowiki>
+I want to keep the TOC in so this is standard like other cheat sheets in this series (Jim Nov 25 2012)
 === TBD ===

← Older revision		Revision as of 04:47, 16 October 2012
Line 58:		Line 58:

	--[[User:Abbas Naderi\|Abbas Naderi]]		--[[User:Abbas Naderi\|Abbas Naderi]]
		+
		+	Hi Abbas, could you add some clarification for ORM? Not everyone knows the acronym which diminishes the general readability and usability. Thanks! --[[User:Peter Mosmans\|Peter Mosmans]] 04:47, 16 October 2012 (UTC)

← Older revision		Revision as of 14:51, 21 September 2012
Line 58:		Line 58:

	--[[User:Abbas Naderi\|Abbas Naderi]]		--[[User:Abbas Naderi\|Abbas Naderi]]
−
−	~~PS. I really appreciate you working on this page, ignore my rude tone!~~
−	~~: LOL~~
−
−	~~:: Why lol :D when it comes to serious discussions in text, I'm a little harsh. If you saw my face when I did it, you would laugh, so I'm assuming you have control of my webcam :D~~

@@ Line 19: / Line 19: @@
 : Hence '''Off''' is the choice for produktive systems. --[[User:Achim|Achim]], 5-jul-2012
 Why the hell is file_uploads off? Are you one of those guys who believe everything should be off to provide a secure system?
 : Yes (but there is a hint that some settings need to be adapted to real systems:) --[[User:Achim|Achim]], 5-jul-2012
 Also disabling functions and etc. its a very bad practice. This is only used in dull shared web hosting systems, and nobody gets their hosts.
@@ Line 28: / Line 32: @@
 : Either we try to make a crappy PHP secure, or you have to live with brain-dead develpers using something like <code>system($_REQUEST['killme'])</code>
 : --[[User:Achim|Achim]], 5-jul-2012
 Most usage of PHP is available source code (Wordpress, Joomla, MyBB, etc.) and they all use these abilities. What you're indicating just says "dont follow this cheat sheet", no offence!
 : the cheat sheet is about security, not about using insecure frameworks. --[[User:Achim|Achim]], 5-jul-2012
 We gotta discuss session handling, there's a lot of issues there.
@@ Line 39: / Line 47: @@
 : Right. But if set on, it's definitely insecure and very easy to exploit. --[[User:Achim|Achim]], 5-jul-2012
 The memory and execution time limit defined there,  is very bad practice. This limit kills the php script, and results in numerous errors which are extremely hard to debug. They do not mitigate DOS, you can simply run 10 scripts instead of 1.  The optimum values are 32MB memory, 30 second execution time, with ability to extend it in user code.
 : It's a suggestion, feel free to adapt it to proper values. Just using the default may bring you to some risks. --[[User:Achim|Achim]], 5-jul-2012
 Please get back to me on this, or my email at owasp@abiusx.com
@@ Line 50: / Line 61: @@
 PS. I really appreciate you working on this page, ignore my rude tone!
 : LOL

@@ Line 16: / Line 16: @@
 I've seen infinite developers set it to off, then set it to On for debugging, and leave it there.
-Why the hell is file_uploads off? Are you one of those guys who believe everything should be off to provide a secure system? Also disabling functions and etc. its a very bad practice. This is only used in dull shared web hosting systems, and nobody gets their hosts.
+: OWASP makes suggestions for security not for compfy debugging. Security is the goal.
 Most usage of PHP is available source code (Wordpress, Joomla, MyBB, etc.) and they all use these abilities. What you're indicating just says "dont follow this cheat sheet", no offence!
 We gotta discuss session handling, there's a lot of issues there.
 Allow_url_fopen Off is not secure at all. my most recent paper lists 12 methods of converting and LFI to a RFI, if somehow has an LFI flaw in the code, url_fopen On or Off wont matter.
 The memory and execution time limit defined there,  is very bad practice. This limit kills the php script, and results in numerous errors which are extremely hard to debug. They do not mitigate DOS, you can simply run 10 scripts instead of 1.  The optimum values are 32MB memory, 30 second execution time, with ability to extend it in user code.
 Please get back to me on this, or my email at owasp@abiusx.com
@@ Line 32: / Line 49: @@
 PS. I really appreciate you working on this page, ignore my rude tone!