SydPHP Security in PHP
•Download as PPTX, PDF•
3 likes•2,086 views
Security in PHP talk for SydPHP, Thursday 24th February, 2011
Recommended
Recommended
More Related Content
What's hot
What's hot (16)
Viewers also liked
Viewers also liked (20)
Similar to SydPHP Security in PHP
Similar to SydPHP Security in PHP (20)
Recently uploaded
Recently uploaded (20)
SydPHP Security in PHP
- 1. Security and PHP February 2011
- 2. Allan Shone Technical Yahoo!, Local Paranoid @Yahoo!7 Been at Yahoo!7 just under 3 years allan.shone@yahoo.com
- 3. Website Security February 2011
- 4. What is Security? Why is Security important? What can you do about it?
- 5. Types of issues XSS SQL Injection Session Hijacking CSRF Phishing
- 6. Why XSS? February 2011
- 7. Lead to larger problems Used to inject code into your site Bad people ™ can steal user information
- 11. POST too February 2011
- 12. What do I do?! February 2011
- 13. Filter Simplest solution: htmlentities() February 2011
- 14. SQL what? February 2011
- 15. Arbitrary SQL code being executed Bypass login, edit database content Find passwords, hidden information
- 16. http://sydphp.leetbix.com/login.php Password: ‘ OR 1=1 -- ‘ ‘ OR 1=1; DROP TABLE users; -- ‘ ‘ OR 1=1; UPDATE TABLE users SET password=‘’ WHERE 1=1; -- ‘ February 2011
- 17. Oh no! February 2011
- 20. mysql_real_escape_string() addslashes() PDO PDO::quote()
- 21. Session hijacking February 2011
- 22. Bad for users Bad for data integrity Easy to prevent
- 23. Not stand-alone February 2011
- 25. Integrity checking February 2011
- 26. CSRF? Sugar? February 2011
- 27. Cross-site request forgery February 2011
- 28. Simple, but un-common February 2011
- 29. <imgsrc=“http://othersite.com/changepasswd?new=onlyIKnow” /> <script> a=document.createElement(‘img’);a.src=‘http://badsite../’;document.firstChild.appendChild(a); a.src=‘http://badsite.com/otherpage’; </script> February 2011
- 30. Integrity, integrity February 2011
- 32. Same, but different? February 2011
- 33. But what can you do February 2011
- 34. PHP’s filter functions February 2011
- 35. filter_has_var filter_id filter_input_array filter_input filter_list filter_var_array filter_var
- 36. No more SuperGlobals February 2011
- 37. $search = filter_input(INPUT_GET, 'search', FILTER_SANITIZE_SPECIAL_CHARS); echo ”<h3>No results found for ‘{$search}’.</h3>"; echo "<a href='?search=$search&page=2'>Next page</a>"; February 2011
- 38. INPUT_GET INPUT_POST INPUT_COOKIE INPUT_SERVER INPUT_ENV February 2011
- 39. Twitter Allan Shone - @cerealboy Jared Mooring - @jadzor Filter function filters: http://au2.php.net/manual/en/filter.filters.php February 2011