writing secure php code

... Subscribe to php| a Today and Win a book from Wrox Press php| architect The Magazine For PHP Professionals January 2003 · PHP Architect · www.phparch.com PHP- WIN PHP- WIN W Reviewed For You CodeCharge ... $myword->Visible = 1; 10 ?> January 2003 · PHP Architect · www.phparch.com 47 FEATURES Using The NET Assembly through COM in PHP Listing - phpnet .php < ?php $MyObj = new COM (“phpclass.HealthRecord.patient”); ... tip for all of you generating PHP code: Make sure you define your session.save_path in your php. ini file prior to previewing your code on the live server The PHP code uses session_start() in its...

Ngày tải lên: 05/07/2014, 11:12

... about secure coding back then Few of us did, and those few certainly did not to the same extent that many people understand secure code today By secure code, we don߀™t mean security code or code ... features We mean code that is designed to withstand attack by malicious attackers Secure code is also robust code Teaching you to design, write, and test application code in a secure manner is ... don߀™t know how to design and build security This book changes that Writing Secure Code offers practical insights into secure design, secure coding, and testing techniques, many of which are not documented...

Ngày tải lên: 25/03/2014, 12:14

... thả liệu lặp Demo Code: < ?php { ?> < ?php echo $row_Recordset1['TieuDe']; ?> < ?php echo $row_Recordset1['TomTat']; ... < ?php } while ($row_Recordset1 = mysql_fetch_assoc($Recordset1)); ?> Click this bar to view the small image Click this bar to view the small image Code sau ... view the small image Click this bar to view the small image Code sau chèn xong Code: < ?php for ($i=0; $i

Ngày tải lên: 14/12/2013, 17:16

... Example 1-9 File: DatabaseIndependentCodeForm.cs // Namespaces, variables, and constants using System; using System.Configuration; using ... This allows applications that support multiple data providers to reuse common provider-independent code The provider-specific functionality of the classes is not available when the base interfaces ... provider-specific class of the providerindependent interface Branching logic is then used execute code specific to that class [ Team LiB ] ...

Ngày tải lên: 26/01/2014, 10:20

... FM.qxd 4/4/03 9:23 AM Page i Secure PHP Development: Building 50 Practical Applications 01549669 FM.qxd 4/4/03 9:23 AM Page ii 01549669 FM.qxd 4/4/03 9:23 AM Page iii Secure PHP Development: Building...

Ngày tải lên: 07/07/2014, 07:20

... http://www.evoknow.com/publications/books/phpbook .php 01549669 FM.qxd 4/4/03 9:23 AM Page vii Preface Welcome to Secure PHP Development: Building 50 Practical Applications PHP has come a long way since ... not a PHP language book for use as reference There are many good PHP language books out there This book is designed for intermediate- to advancedlevel PHP developers who can review the fifty PHP ... Perl and other shell scripting languages Arguably, PHP is one of the most popular Web platforms In this book you will learn about how to secure PHP applications, how to develop and use an application...

Ngày tải lên: 07/07/2014, 07:20

... xi Part I Designing PHP Applications Chapter Chapter Chapter Features of Practical PHP Applications Understanding and Avoiding Security Risks 25 PHP Best Practices ... 4/4/03 9:23 AM Page xiii Part VI Tuning and Securing PHP Applications Chapter 21 Chapter 22 Speeding Up PHP Applications 713 Securing PHP Applications 737 Part VII Appendixes ... 473 E-campaign System 507 Part IV Using PHP for Sysadmin Tasks Chapter 16 Chapter 17 Chapter 18 Command-Line PHP Utilities 559 Apache Virtual Host Maker ...

Ngày tải lên: 07/07/2014, 07:20

... xi Part I Designing PHP Applications Chapter Features of Practical PHP Applications Chapter Chapter Features of a Practical PHP Application Employing ... 54 Avoiding HTML in application code 54 Generating HTML combo lists in application code 55 Reducing template code 58 Best Practices ... 30 Using validation code 35 Not Revealing Sensitive Information 38 Summary 40 PHP Best Practices ...

Ngày tải lên: 07/07/2014, 07:20

... 424 Security Considerations 427 Restricting access to makeindex .php script 428 Summary 428 Part III Developing...

Ngày tải lên: 07/07/2014, 07:20

... Tuning and Securing PHP Applications Chapter 21 Speeding Up PHP Applications 713 Chapter 22 Benchmarking Your PHP Application 714 Benchmarking your code ... Stress-testing your PHP applications using ApacheBench 722 Buffering Your PHP Application Output 723 Compressing Your PHP Application Output 725 Caching Your PHP Applications ... Applications 727 Caching PHP contents using the jpcache cache 727 Caching PHP contents using the PEAR cache 729 Using PHP opcode caching techniques ...

Ngày tải lên: 07/07/2014, 07:20

... Chapter Features of Practical PHP Applications IN THIS CHAPTER ◆ Exploring the features of a practical PHP application ◆ Putting the features to work in applications PHP BEGAN AS A PERSONAL home ... question that PHP development is often faster than other Web-development platforms like Java However, the reasons for PHP development’s faster cycle are often questioned by serious non -PHP developers ... introduce you to a PHP application design that is both well planned and practical, therefore, highly maintainable Features of a Practical PHP Application When developing a practical PHP application...

Ngày tải lên: 07/07/2014, 07:20

... $PHPLIB_DIR = $_SERVER[‘DOCUMENT_ROOT’] ‘/phplib’; The first line of the script sets a variable called $PHPLIB_DIR to a path where PHPLIB library files are stored The path is set to PHPLIB (phplib) ... of code is as follows: ini_set( ‘include_path’, ‘:’ $PHPLIB_DIR ‘:’ ini_get(‘include_path’)); It adds the $PHPLIB_DIR path to PHP s include_path setting, which enables PHP to find files in PHPLIB ... that is not the case, you can change it as needed For example: $PHPLIB_DIR = ‘/www/phplib’; Here the PHPLIB path is set to /www/phplib, which may or may not be within your document root As long...

Ngày tải lên: 07/07/2014, 07:20

... for Listing 1-4 Script < ?php // Set PHPLIB path $PHPLIB_DIR = $_SERVER[‘DOCUMENT_ROOT’] ‘/phplib’; // Add PHPLIB path to PHP s include path ini_set( ‘include_path’, ‘:’ $PHPLIB_DIR ‘:’ ini_get(‘include_path’)); ... Page 12 Part I: Designing PHP Applications In Listing 1-2, we had the following lines: $PHPLIB_DIR = $_SERVER[‘DOCUMENT_ROOT’] ‘/phplib’; ini_set( ‘include_path’, ‘:’ $PHPLIB_DIR ‘:’ ini_get(‘include_path’)); ... look at a simple calculator script Listing 1-6 shows the script, called calc .php The configuration file used by calc .php is calc.conf, which is similar to Listing 1-5 and not shown here This script...

Ngày tải lên: 07/07/2014, 07:20

... Page 20 Part I: Designing PHP Applications The difference between calc .php and calc2 .php is that calc2 .php doesn’t have any error messages hard-coded in the script The calc .php error messages have ... also means that the end user would have to change the code A better solution is shown in Listing 1-7 and Listing 1-8 Listing 1-7: calc2 .php < ?php // Enable all error reporting error_reporting(E_ALL); ... dimension is error code For example: $ERRORS[‘US’][‘NUM1_MISSING’] = “You did not enter number 1.”; ‘US’ is shorthand code for the U.S English language The NUM1_MISSING is a code that has the...

Ngày tải lên: 07/07/2014, 07:20

... ‘/pear’ ; // If you have installed PHPLIB in a different // directory than %DocumentRoot%/phplib, change the setting below $PHPLIB_DIR = $_SERVER[‘DOCUMENT_ROOT’] ‘/phplib’; 03 549669 ch01.qxd 4/4/03 ... %DocumentRoot% | + -framework | + -pear | + -phplib | + -calendar | + apps | + -class | + -templates This directory structure can be created using the following PHP code // If you have installed PEAR packages ... DESIGN secure PHP applications, you have to understand the security risks involved and know how to deal with them In this chapter, we will discuss the most common risks involved with Web-based PHP...

Ngày tải lên: 07/07/2014, 07:20

... next user is Listing 2-2 shows an improved version of bad_whois .php script called better_whois .php Listing 2-2: better_whois .php < ?php // Set error reporting to all error_reporting(E_ALL); // Get ... following example: http://server/bette_whois .php? domain=evoknow.com When better_whois .php is called, it automatically gets a variable called $domain created by PHP itself The value of the $domain variable ... Listing 2-3 Listing 2-3: bad_autovars .php < ?php error_reporting(E_ALL); // This bad example will only work // if you have register_globals = Off // in your php. ini // This example is for educational...

Ngày tải lên: 07/07/2014, 07:20

... Initialize $is_customer = FALSE; // Get coupon code $couponCode = (! empty($_REQUEST[‘couponCode’])) ? $_REQUEST[‘couponCode’] : null; if (is_coupon($couponCode)) { $is_customer = isCustomer(); } if ... ?> < ?php // Enable all error reporting error_reporting(E_ALL); // Initialize $is_customer = FALSE; // Get coupon code $couponCode = (! empty($_REQUEST[‘couponCode’])) ? $_REQUEST[‘couponCode’] ... you not win!\n”; } function is_coupon( $code = null) { // some code to verify coupon code echo “Check if user given coupon is valid or not ”; return ( $code % 1000 == 0) ? TRUE : FALSE; Continued...

Ngày tải lên: 07/07/2014, 07:20

... of information For example, say you have a script called mysite .php as follows: < ?php phpinfo(); ?> This script shows all the PHP information about the current site, which is often very useful ... Understanding and Avoiding Security Risks Listing 2-5: myform .php < ?php error_reporting(E_ALL); define(‘DEBUG’, FALSE); include(“class.Validator .php3 ”); // Create a Validator object $check = new Validator ... print “Debug Code here \n”; // Call validation methods if (!$check->is_email($email)) { echo “Invalid email format\n”;} if (!$check->is_state($state)) { echo “Invalid state code\n”; if...

Ngày tải lên: 07/07/2014, 07:20

... Designing PHP Applications function outputDisplayMsg($outTextMsgData = null) { echo $outTextMsgData; } ?> Now look at the same code segment with meaningful names for variables and functions: < ?php ... function or method code Returning arrays with care When your function (or method) returns an array, you need to ensure that the return value is a defined array because the code from which the ... nothing when the SQL statement returns no rows In such a case, the following code segment, which calls the function, produces a PHP warning message: error_reporting(E_ALL); $rowObjectArray = $this->getData();...

Ngày tải lên: 07/07/2014, 07:20

... bad It is a good side effect only if your code is smart enough to handle the new data Most codes are not written to so The bad effect could be that your code can become slower due to additional ... vise versa when needed By changing the DBI class code to connect to a new database, an application can be easily ported from one database to another Writing good SELECT statements SELECT is the most ... example, look at the following code segment: // Bad SELECT statement $statement = “SELECT * FROM myTable”; 47 05 549669 ch03.qxd 48 4/4/03 9:24 AM Page 48 Part I: Designing PHP Applications $result...

Ngày tải lên: 07/07/2014, 07:20