Essential PHP Security

Essential PHP Security

by Chris Shiflett
Released October 2005
Publisher(s): O'Reilly Media, Inc.
ISBN: 9780596006563

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Buy on Amazon Buy on ebooks.com
Start your free trial

Book description

Being highly flexible in building dynamic, database-driven web applications makes the PHP programming language one of the most popular web development tools in use today. It also works beautifully with other open source tools, such as the MySQL database and the Apache web server. However, as more web sites are developed in PHP, they become targets for malicious attackers, and developers need to prepare for the attacks.

Security is an issue that demands attention, given the growing frequency of attacks on web sites. Essential PHP Security explains the most common types of attacks and how to write code that isn't susceptible to them. By examining specific attacks and the techniques used to protect against them, you will have a deeper understanding and appreciation of the safeguards you are about to learn in this book.

In the much-needed (and highly-requested) Essential PHP Security, each chapter covers an aspect of a web application (such as form processing, database programming, session management, and authentication). Chapters describe potential attacks with examples and then explain techniques to help you prevent those attacks.

Topics covered include:

  • Preventing cross-site scripting (XSS) vulnerabilities
  • Protecting against SQL injection attacks
  • Complicating session hijacking attempts

You are in good hands with author Chris Shiflett, an internationally-recognized expert in the field of PHP security. Shiflett is also the founder and President of Brain Bulb, a PHP consultancy that offers a variety of services to clients around the world.

Publisher resources

View/Submit Errata

Table of contents

  1. Foreword
  2. Preface
    1. What’s Inside
    2. Style Conventions
    3. Comments and Questions
    4. Safari Enabled
    5. Acknowledgments
  3. 1. Introduction
    1. 1.1. PHP Features
      1. 1.1.1. Register Globals
      2. 1.1.2. Error Reporting
    2. 1.2. Principles
      1. 1.2.1. Defense in Depth
      2. 1.2.2. Least Privilege
      3. 1.2.3. Simple Is Beautiful
      4. 1.2.4. Minimize Exposure
    3. 1.3. Practices
      1. 1.3.1. Balance Risk and Usability
      2. 1.3.2. Track Data
      3. 1.3.3. Filter Input
      4. 1.3.4. Escape Output
  4. 2. Forms and URLs
    1. 2.1. Forms and Data
    2. 2.2. Semantic URL Attacks
    3. 2.3. File Upload Attacks
    4. 2.4. Cross-Site Scripting
    5. 2.5. Cross-Site Request Forgeries
    6. 2.6. Spoofed Form Submissions
    7. 2.7. Spoofed HTTP Requests
  5. 3. Databases and SQL
    1. 3.1. Exposed Access Credentials
    2. 3.2. SQL Injection
    3. 3.3. Exposed Data
  6. 4. Sessions and Cookies
    1. 4.1. Cookie Theft
    2. 4.2. Exposed Session Data
    3. 4.3. Session Fixation
    4. 4.4. Session Hijacking
  7. 5. Includes
    1. 5.1. Exposed Source Code
    2. 5.2. Backdoor URLs
    3. 5.3. Filename Manipulation
    4. 5.4. Code Injection
  8. 6. Files and Commands
    1. 6.1. Traversing the Filesystem
    2. 6.2. Remote File Risks
    3. 6.3. Command Injection
  9. 7. Authentication and Authorization
    1. 7.1. Brute Force Attacks
    2. 7.2. Password Sniffing
    3. 7.3. Replay Attacks
    4. 7.4. Persistent Logins
  10. 8. Shared Hosting
    1. 8.1. Exposed Source Code
    2. 8.2. Exposed Session Data
    3. 8.3. Session Injection
    4. 8.4. Filesystem Browsing
    5. 8.5. Safe Mode
  11. A. Configuration Directives
    1. A.1. allow_url_fopen
    2. A.2. disable_functions
    3. A.3. display_errors
    4. A.4. enable_dl
    5. A.5. error_reporting
    6. A.6. file_uploads
    7. A.7. log_errors
    8. A.8. magic_quotes_gpc
    9. A.9. memory_limit
    10. A.10. open_basedir
    11. A.11. register_globals
    12. A.12. safe_mode
  12. B. Functions
    1. B.1. eval()
    2. B.2. exec()
    3. B.3. file()
    4. B.4. file_get_contents()
    5. B.5. fopen()
    6. B.6. include
    7. B.7. passthru()
    8. B.8. phpinfo()
    9. B.9. popen()
    10. B.10. preg_replace()
    11. B.11. proc_open()
    12. B.12. readfile()
    13. B.13. require
    14. B.14. shell_exec()
    15. B.15. system()
  13. C. Cryptography
    1. C.1. Storing Passwords
    2. C.2. Using mcrypt
    3. C.3. Storing Credit Card Numbers
    4. C.4. Encrypting Session Data
  14. About the Author
  15. Index
  16. About the Author
  17. Colophon
  18. Copyright

Product information

  • Title: Essential PHP Security
  • Author(s): Chris Shiflett
  • Release date: October 2005
  • Publisher(s): O'Reilly Media, Inc.
  • ISBN: 9780596006563