5 PHP Security Issues and What You should to do About Them?

SQL Injection

1

$query = “SELECT * FROM users WHERE username = ‘niki’”;

1

$query = “SELECT * FROM users WHERE username = ” or ’1=1′”;

• What are the implications? 

•  How can it be prevented? 

1.  For better prevention of this security issue, the data must be validated, verified and cleaned up before it can enter the application; 
2. All the sensitive information such as passwords should be encrypted using SHA1 or SHA; 
3. Technical information can sometimes contain technical details that might reveal security vulnerabilities to an attacker; therefore, it must be removed from error messages;
4.  An attacker specifically looks to error messages to get information such as database names, usernames and table name, hence, you should disable error messages or you can create your own custom error messages; 
5. You can limit the permissions granted on the database and fewer permissions results lower chances of attack;
6.  You may use stored procedures and previously defined cursors to abstract data access so that users do not directly access tables or views;
7.  You can prevent words such as ‘insert’, ‘update’, ‘drop’, and ‘union’ from being added to the database (these all being words which can alter tables and databases).

Remote File Inclusion and Remote Code Execution

• You should make OFF The register_globals directive, in later versions of PHP, it is OFF by default, but one should always check that. If the directive has to be set to ON for some reason, all variables must be properly initialized.
• There are other PHP directives can be used to prevent this security breach, which include:
• allow_url_fopen (set to on by default) that controls whether remote files should be includable and should be turned to OFF
• allow_url_include (set to off by default) that controls whether include_once(), include(), require() and require_once() commands are able to include remote files into the code
• Enabling safe_mode which forces PHP to test of user ID permissions before opening any file
• Always validate user input and be very careful with any data retrieved from remote servers or locations. In order to stop it, you can ensure that all include files are locally hosted and never accept files from anywhere else unless absolutely necessary
• Restrict user privileges to an absolute minimum can also help in prevention from this security threat

Cross Site Scripting (XSS)

• The best way to prevent XSS is to use escape functions, specifically to escape characters that comprise HTML and JavaScript syntax like ‘>’ and ‘<’ or to convert these into HTML entities, (so < would become < for example);
• In forum websites, where users want to post HTML like links, an alternative syntax like bbcodes (which is very common on forums) can be used in order to overcome the escaping of HTML characters;
• The htmlspecialchars () function indentifies any output you do not want to be HTML output and converts it into plain HTML entities, for example: ‘&’ becomes ‘&’ and ‘”‘ (double quote) becomes ‘"’;
• You should rigorously test the website before launching it.

Session and Cookie Hacking

• In order to prevent hackers from setting session ID’s prior to login, ID’s should be changed often, therefore, the session_regenerate_id() function should be used every time the user logs in, assigning them a fresh ID;
• The risk of this hacking can be mitigated by revalidating a user who is about to perform important or sensitive tasks like resetting their password (i.e. by making them re-enter their old password);
• If user’s password is to be stored in a session variable, it must be encrypted (using the sha1() function)
• If your web application is handling sensitive information like debit and credit card numbers, then using an SSL or any other secured connection can also prevent session and cookie hacking

Directory Traversal (aka path traversal)

• You should validate and sanitize all user input correctly by removing all suspect data and filtering out meta-characters;
• Another precaution from this hacking is to never store sensitive configuration files inside the web root;
• If a suspect request to a file is made, the full file-path should be built up and all the characters in the path should be normalized (e.g. change %20 to spaces);
• Careful programming on the web-server is important and you should make use of security software, patches and vulnerability scanners.