PHP and mySql security issues

AES Encryption and Decryption in PHP See example

Question: What is AES encryption? Advanced Encryption Standard is a specification for the encryption of data established by the NIST (National Institute of Standards and Technology) in 2001. Question: What are different key...
XMLRPC Wordpress Attack

Queston: What is XMLRPC? XML-RPC is one of the protocols that use XML for messages between two server. It is used to "Remote Procedure Calls" using XML. Queston: Question: What is JSON-RPC? JSON-RPC is one of the protocols that use JSON for messages between...
How can I read request-headers in PHP

$headers = apache_request_headers(); print_r($headers); Following are the Response of apache_request_headers() Question: What is apache_request_headers()? This function fetch all HTTP request headers. Question: What format it return when success? An...
How can I prevent SQL-injection in PHP?

Question: What is SQL Injection? SQL injection is a code injection technique, which is used to attack on database driven applications. In this malicious SQL statements are inserted into an database query. Question: How attackers attack...
Shared Server Security Risk open_basedir disable_functions disable_classes

There are a variety of security issues that arise when using shared hosting solutions. There are three php.ini directives that remain important in a shared hosting open_basedir :Â The open_basedir directive provides the ability to limit the files that PHP can open to...
What is Best method for sanitizing user input with PHP?

Sanitize user-input when using in Mysql Query. You can use real_escape_string of mysqli. For Example: $mysqliObj = new mysqli("localhost", "root", "", "mydb"); $city =...
Difference between Notice and warning and fatal error

Notice A notice is an advisory message like "You probably shouldn't be doing what you're doing" Execution of the script is not halted Example echo $undefinedVariable; Warning A warning is a message like "You are doing something wrong and it is...
How can I prevent SQL-injection in PHP [SOLVED]

Following are different 3 ways to prevent from SQL Injection. 1. Using PHP inbuilt Functions. $name = mysql_real_escape_string($_POST["name"]); mysql_query("INSERT INTO users VALUES($name)"); 2. Use...
PHP Register Globals

register_globals is Â PHP Setting,Â In which it registers the GET/POST array's elements as variables. For example, If URL is /index.php?name=php-tutorial-php, when you echo $name; It will print the value i.e php-tutorial-php (if register_globals is ON). Same...
PHP Sessions and Cookie and Security

Session is Super global variable, that preserve certain data across multiple requests. A visitor accessing your web-site is assigned a unique id, the so-called session id. Its either stored in a cookie on the user side OR is propagated in the URL. Why its is used 1. Get...
PHP Check Mime Type of File - Return Information About A File

Now a days, we are uploading files like Profile images, Video files OR excel files in our web application.Â With uploading these files there are chances some user upload the .exe file (Virus) by renaming the .exe into .jpg, which can damage website. You might have added the...
Improve Ajax Performance

Following are few steps toÂ Improve Ajax Performance First try to Reduce the Number of Ajax Call If same call send again, abort the previous call If ajax call is executing, and user go for another link, then cancel the previous one. Use GET Method, As its...
PHP Captcha Code Example Code Snippets

AÂ CAPTCHAÂ (CompletelyÂ AutomatedÂ PublicÂ Turing testÂ to tellÂ Computers andÂ HumansÂ Apart) is a type ofÂ challenging-responseÂ test used inÂ computer fieldÂ to determine whether user is Human OR robot program. Captcha is used in website to confirm that your website is accessing by...
PHP - Secure Ajax Call from Hackers - Example

Today, In all web application we use Ajax call to get the server data without refresh the full page. In this cases, we get required data from server without refresh the page. For Example In Registration Page, We want to validate the unique email address of user Following the Simple...
htaccess code snippets example

.htaccess file is used for configuration on File Level/Directory Level and its supported by all webserver. Today all types of websites useÂ htaccess technology. Following are Benefits of .htaccess Mange...
Manage Cron Job with PHP - SSH2 Connection

Today, Cron play very vital role in our website. It reduce the lots of manual work like update the record, Caching the pages, Remove not-required data etc. Following are use of Cron Job Update Database records Copy/Move...
Spoofed Forms - Stop Spoofed Form Submissions

It is method in which attacker create a copy of html form of another website, fill the data whatever he want to sent and submit the form. There are various ways to spoof forms, the easiest of which is to simply copy a target form and execute it from...
Session Fixation

In this an attacker explicitly sets the session identifier of a session for a user. Typically in PHP it's done by giving them a url like http://www.mysite.com/index.php?session_name=session_id. Once the attacker gives the url to the client, the attack is the same...
Session Hijacking

Session Hijacking is term where attackers hold of a session identifier and is able to send requests as if they were that user. In particular, it is used to refer to the theft of a magic cookie used to authenticate a user to a remote server. It has particular relevance to web developers, as...
openssl private encrypt

bool openssl_private_encrypt ( string $data , string &$crypted , mixed $key [, int $padding = OPENSSL_PKCS1_PADDING ] ) Encrypts data with private key openssl_private_encrypt() encrypts data with private key and stores the result...