Wednesday, September 17, 2008

$_REQUEST Security Problem

hello all! it has been quite some time. i have been studying for my national examinations. oh well, today i am going to talk about security issues in PHP regarding the $_REQUEST variable.

The $_REQUEST variable is a combination of key and values of $_POST, $_GET and $_COOKIE variables. This is a 'superglobal', or automatic global, variable. This simply means that it is available in all scopes throughout a script.

The problem with this variable, is that when you are using it, you never know where the value came from. It might come from a cookie, it might come from a GET header request, or even a POST data.

This often allows hijacking of sessions to occur.
1) Hackers gets the Session ID of the user, visitor, or worse of all: Administrators.
2) They inject into the cookies to get into the session of the user/administrator.
3) this allows the server to show the hijacker what the real user sees.
4) and the hijacker is also able to access whatever the user is able to access.

Worse still, if you want to double check the session via a POST and GET, and you use the $_REQUEST variable to check, the hacker can simply put it into cookie and he passes through.

It also allows bots to POST data easily using cookies if you use $_REQUEST. Especially if you have forms using $_REQUEST, the bot can keep bypassing your form using cookies or get headers.

You should use a more specific variable to further secure your application. Well, that's all i have. Goodnights!

Wednesday, September 10, 2008

Script Bundle

I have recently started building a php scripts bundle for sales. The bundle includes

  • Password and String Encryption Class - pcrypt
    A class that helps you to encode a string with a password and a random salt. The same password is required to decode the encrypted string. useful for storing data that requires password encryption. it offers common hashing methods: SHA1, MD5 and CRC32.

  • Hypertext Markup Language PHP Builder Class - htmlbuilder
    Using this class, you can build XHTML and HTML valid web pages with php codes. it uses object-based codes and you can nest objects in objects with class parent-children relations.

  • Javascript in HTML Optimizer Control Class - scriptcontrol
    Puts all the codes in javascripts tags into a file and call from there. this allow optimized loading and thus decreasing server load.

  • Script and File Pre-Processor - sp
    Pre-process your xml, javascript and css files with this processor. it is not a class, instead, you can call it directly. Also, instead of calling individual files, you can combine many files into one: eg sp.php?f=file1.css;file2.css;file4.css

  • Alternative Logging - altlog
    a great logging tool that allows error logging to be managed easy via a class. commonly used by the rest of the scripts for error logging.

  • PHP Cache Control - cachec
    Allows you to cache variables, data so as to speed up page loading. it saves cache into files in a directory and will load it later for faster loading.

Would you want to buy it? Comment your thoughts.