Web Technology Experts Notes

Showing posts with label PHP security. Show all posts

Monday 5 January 2015

Difference between Notice and warning and fatal error

Notice

A notice is an advisory message like "You probably shouldn't be doing what you're doing"
Execution of the script is not halted
Example
```
echo $undefinedVariable;
```

Warning

A warning is a message like "You are doing something wrong and it is very likely to cause errors in the future, so please fix it." Execution of the script is not halted;
Example
```
echo 1/0;
```

Fatal Error

Fatal run-time errors
Execution of the script is not halted
Example
```
require_once "notexistfile.php"
```

Thursday 18 December 2014

How can I prevent SQL-injection in PHP [SOLVED]

Following are different 3 ways to prevent from SQL Injection.
1. Using PHP inbuilt Functions.

$name = mysql_real_escape_string($_POST["name"]);
mysql_query("INSERT INTO users VALUES($name)");

2. Use MySqli instead of MySQL. MySqli is far better than MySql because is object oriented MySql.

$stmt = $dbConnection->prepare('INSERT INTO users VALUES(?)');
$name=$_POST["name"];
$stmt->bind_param('s', $name);
$stmt->execute();

3. Using PDO

$stmt = $conn->prepare("INSERT INTO users VALUES(:name)");
$stmt->bindValue(':name', $_POST["name"]);
$stmt->execute();

Tuesday 7 October 2014

PHP Register Globals

register_globals is PHP Setting, In which it registers the GET/POST array's elements as variables.

For example, If URL is /index.php?name=php-tutorial-php, when you echo $name; It will print the value i.e php-tutorial-php (if register_globals is ON). Same applicable to POST methods also.

When register_globals is ON you need not to extract the value of GET/POST explicitly, variable values are available with the element-Name.

Example with POST Data (if register_globals is ON)

If you post following data
Array
(
    [name] => php-tutorial-php
    [description] => Web Technology Experts Notes
)
echo $name;//php-tutorial-php
echo $description;//Web Technology Experts Notes

For Example COOKIE Data(if register_globals is ON)

$_SESSION[value] = 123;
$value = 'This is session value';
echo $_SESSION[value]; //This is session value

When register_globals=on, anything passed via $_GET / $_POST / $_SESSION / $_COOKIE automatically appears to be global variable, this can might have security consequences. Due to this register_globals has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 5.4.

If you are using lower than php5.4 version, It's highly recommended you should set off the value of register_global.

Sunday 8 June 2014

PHP Sessions and Cookie and Security

Session is Super global variable, that preserve certain data across multiple requests. A visitor accessing your web-site is assigned a unique id, the so-called session id. Its either stored in a cookie on the user side OR is propagated in the URL.

Why its is used
1. Get the Number of unique visitor
2. For Login functionality we need this.
3. It tell us whether user is registered OR not.

Requirements
No external libraries are needed to build this extension.

Installation
Session is enabled in PHP by default. If you would not like to build your PHP with session support, you should specify the
--disable-session

Session configuration options
Name	Default	Changeable	Changelog
session.save_path	""	PHP_INI_ALL
session.name	"PHPSESSID"	PHP_INI_ALL
session.save_handler	"files"	PHP_INI_ALL
session.auto_start	"0"	PHP_INI_PERDIR
session.gc_probability	"1"	PHP_INI_ALL
session.gc_divisor	"100"	PHP_INI_ALL	Available since PHP 4.3.2.
session.gc_maxlifetime	"1440"	PHP_INI_ALL
session.serialize_handler	"php"	PHP_INI_ALL
session.cookie_lifetime	"0"	PHP_INI_ALL
session.cookie_path	"/"	PHP_INI_ALL
session.cookie_domain	""	PHP_INI_ALL
session.cookie_secure	""	PHP_INI_ALL	Available since PHP 4.0.4.
session.cookie_httponly	""	PHP_INI_ALL	Available since PHP 5.2.0.
session.use_strict_mode	"0"	PHP_INI_ALL	Available since PHP 5.5.2.
session.use_cookies	"1"	PHP_INI_ALL
session.use_only_cookies	"1"	PHP_INI_ALL	Available since PHP 4.3.0.
session.referer_check	""	PHP_INI_ALL
session.entropy_file	""	PHP_INI_ALL
session.entropy_length	"0"	PHP_INI_ALL
session.cache_limiter	"nocache"	PHP_INI_ALL
session.cache_expire	"180"	PHP_INI_ALL
session.use_trans_sid	"0"	PHP_INI_ALL	PHP_INI_ALL in PHP <= 4.2.3. PHP_INI_PERDIR in PHP < 5. Available since PHP 4.0.3.
session.bug_compat_42	"1"	PHP_INI_ALL	Available since PHP 4.3.0. Removed in PHP 5.4.0.
session.bug_compat_warn	"1"	PHP_INI_ALL	Available since PHP 4.3.0. Removed in PHP 5.4.0.
session.hash_function	"0"	PHP_INI_ALL	Available since PHP 5.0.0.
session.hash_bits_per_character	"4"	PHP_INI_ALL	Available since PHP 5.0.0.
url_rewriter.tags	"a=href,area=href,frame=src,form=,fieldset="	PHP_INI_ALL	Available since PHP 4.0.4.
session.upload_progress.enabled	"1"	PHP_INI_PERDIR	Available since PHP 5.4.0.
session.upload_progress.cleanup	"1"	PHP_INI_PERDIR	Available since PHP 5.4.0.
session.upload_progress.prefix	"upload_progress_"	PHP_INI_PERDIR	Available since PHP 5.4.0.
session.upload_progress.name	"PHP_SESSION_UPLOAD_PROGRESS"	PHP_INI_PERDIR	Available since PHP 5.4.0.
session.upload_progress.freq	"1%"	PHP_INI_PERDIR	Available since PHP 5.4.0.
session.upload_progress.min_freq	"1"	PHP_INI_PERDIR	Available since PHP 5.4.0.

How to set the Cookie?
bool setcookie ($name, $value);//set the cookie

bool setcookie ($name, $value,time()+3600); //set the cookie with expire 1 hour
bool setcookie ($name, $value, $expire = 0, $path, $domain, $secure = false, $httponly = false );//all parameter of set cookie
bool setrawcookie ($name, $value, $expire = 0, $path, $domain, $secure = false, $httponly = false );//Send a cookie without urlencoding the cookie value

Parameter of set_cookie function
name: The name of the cookie.
value: The value of the cookie. This value is stored on the clients computer; do not store sensitive information.
expire: The time the cookie expires. This is a Unix timestamp so is in number of seconds since the epoc. If set to 0, or omitted, the cookie will expire when the browser closes.
path: The path on the server in which the cookie will be available on. If set to '/', the cookie will be available within the entire domain.
domain: The domain that the cookie is available to.
secure: Indicates that the cookie should only be transmitted over a secure HTTPS connection from the client.
httponly: When TRUE the cookie will be made accessible only through the HTTP protocol.

How to get cookie?

echo $_COOKIE["cookieName"];

How to print all cookie?

print_r($_COOKIE);

How to delete a cookie?

setcookie ("cookieName", "", time() - 60);

How to set Array Cookie?

setcookie("cookieName[one]", "c_1");
setcookie("cookieName[three]", "c_2");
setcookie("cookieName[two]", "c_3");

How to get Array cookie?

print_r($_COOKIE["cookieName"]);

Monday 19 May 2014

PHP Check Mime Type of File - Return Information About A File

Now a days, we are uploading files like Profile images, Video files OR excel files in our web application.
With uploading these files there are chances some user upload the .exe file (Virus) by renaming the .exe into .jpg, which can damage website.

You might have added the extension check from javaScript as well as PHP. But this is not enough from security end because someone can upload the file after changing the extension of file( ".exe" to ".png"). In this case your security check will be failed.

What to do.
Answer is check the Mime of file before get uploaded in your web server.

How to do this
"fileinfo" is extension which must be enabled in your php.ini. (for existence you can check in phpinfo)
If this extension is not enabled ask your server admin, he will do this for you OR you can also do this your self (http://php.net/manual/en/fileinfo.installation.php).

After installing the fileinfo extension, use following code to get the mime type of file before get uploaded in web server.

if (function_exists("finfo_file")) {
    $finfo = finfo_open(FILEINFO_MIME_TYPE);    

    //file which you want to check the mime of the file
    $file = $_SERVER['DOCUMENT_ROOT'] . '/images/feedback.png';    //file which is going to get uploaded in web server
    try {
        $type = finfo_file($finfo,$file);        
        echo "File Type: ".$type;
    } catch (Exception $e) {
        echo $e->getMessage();
    }
} else {
    echo "'finfo_file' is Not installed";
}

When you execute above code, if will get the mime-type of file. This is directly checking the mime type of already uploaded file.
You can use $type = finfo_file($finfo,$file); for checking the file type, before using move_uploaded_file function.