Mwahahahahahaha! Did I log you out? If not, refresh the page and witness mmmy powweeerrrr!!!11
...............
Still here? Ah, fine. I'm not here to cause trouble (I'll remove that pseudo-hack later). I made this blog to show that website security is no joke (Little Bobby Tables notwithstanding). This "hack" was just above the level of script kiddies to do (script pre-teens, woot ), and pretty easy to prevent, as it merely takes advantage of images.
So, for you budding, neophyte programmers, I'll lend a few tips on how to add a smidge of securoty to your site using the PHP language.
Validate and Sanitize All User Input
No-brainer. You should never trust user input (the pessimists theory of security ftw?) For all you know, it contains HTML or CSS code that will screw with your site's design. Worse still, it could contain JavaScript code that can send the information to a 3rd-party through dynamic script tag placement containing, say, the information stored in your cookies (hello stored site passwords). At the absolute worst, if your server has enabled the option for PHP code inside the <script> tag, then they can basically wipe everything from your server using command line code.
So, one way to stifle this is to sanitize user input via either the htmlspecialchars() or htmlentities() functions. Basically, they encode data that is run through them in a way that they are no longer interpreted as valid HTML data by replacing characters like "<" or ">" (htmlentities() encodes EVERYTHING) with a character code. Nothing looks different to a human, but to the browser it's. no longer treated as HTML.
Use Challenge/CSRF Tokens
CSRF tokens (Cross-Site Request Forgery) are a randomly generated string of text that is used to try and confirm that the action that is to take place was intended and done by the user. If you didn't catch that, I'll give an example:
Create token and form
<?php
$strong = true;
$token = bin2hex(openssl_pseudo_random_bytes("23", $strong)); //create a random string as your token
if($_POST["fToken"] === $_SESSION["token"]){
//Probably valid form submission
}
else{
//Invalid submission
}
}
That's roughly how CSRF validation works (usually not that simple, but you get the idea (I hope)). In fact, that simple of an implementation would have stopped me from logging you all out. (;
Prevent SQL Injection
Heh, by the time I got here, I was tired of typing from my phone (and the topic is somewhat long), so let it suffice to say that preventing SQL injection is VERY important for website security. Otherwise, malicious users could mess around with your database data, to the point of completely deleting entire tables of data:
A few things to do is to find a decent tutorial on either MySQLi or (preferably) PDO. Paramaterized queries and prepared statements are things to love.
Another really great thing to do is to create another SQL user that only has the ability to UPDATE, INSERT and SELECT things from the SQL database, thereby preventing the possibility of too much damage to structure.
Check this site for some good tutorials on how to prevent SQL injection.
Anyway, that's all I feel like doing right now. I hope that helps some of you.
By @Skittles
), and pretty easy to prevent, as it merely takes advantage of images.
(;
