Full On Design » Security http://www.fullondesign.co.uk Design & Web Technologies Sun, 30 Oct 2011 21:37:16 +0000 en hourly 1 http://wordpress.org/?v=3.3.1 Basic PHP Security http://www.fullondesign.co.uk/coding/security/571-basic-php-security.htm http://www.fullondesign.co.uk/coding/security/571-basic-php-security.htm#comments Fri, 27 Mar 2009 22:02:59 +0000 Rogem http://www.fullondesign.co.uk/?p=571 Saying “Don’t trust your users” would be a little over statement, but in the world of programming it’s the best mindset. Here are some really basic tips for programming in general (but mostly focusing on PHP).

Validate All Input

It’s very important to check all input to your script; a client could accidentally put a semi-colon in a field and possibly break your code. Always check that the user is posting what you expect. Here are some simple methods to validate input.

<?php
// Input must be a number
if(is_numeric($input)){
	echo 'Input is a number';
} else {
	echo 'Input is not a number';
}

// Input can only contain numbers and letters.
if(preg_match('/([^A-z0-9])/', $input)){
	echo 'Input does not contain only numbers and letters.';
} else {
	echo 'Input contains only numbers and letters.';
}

// Input must be an email
if(preg_match('/^([a-zA-Z0-9])+@([a-zA-Z0-9_-])+(\.[a-zA-Z0-9_-]+)+/', $input)){
	echo 'Email Is Valid.';
} else {
	echo 'Email Is Invalid.';
}
?>

Hash Passwords

Hashing passwords is mostly important from a privacy view point; if a hacker gets in they could sell your users details.

Use Sessions, not cookies

Never set sensitive data in cookies, users could edit them and potentially cause problems on your website. Instead use Sessions; they are a server side solution which is a little more secure.

<?php
session_start(); // Start the session. Always put this at the top of your html.

// Set some sessions
$_SESSION['name'] = 'Example 1';

// echo session data
echo $_SESSION['name'];
// Would return Example 1
?>

Related Links

PHP and MySQL Web Development (Developer’s Library)
Using Regular Expressions with PHP
10 Advanced PHP Tips To Improve Your Programming

]]> http://www.fullondesign.co.uk/coding/security/571-basic-php-security.htm/feed 0 Twitter in a Nutshell http://www.fullondesign.co.uk/uncategorized/517-twitter-in-a-nutshell.htm http://www.fullondesign.co.uk/uncategorized/517-twitter-in-a-nutshell.htm#comments Fri, 20 Mar 2009 15:53:24 +0000 Rogem http://www.fullondesign.co.uk/?p=517 twitter_in_a_nutshell

Click here to play Video

]]> http://www.fullondesign.co.uk/uncategorized/517-twitter-in-a-nutshell.htm/feed 0 Securing publicly available folders http://www.fullondesign.co.uk/coding/security/304-securing-publicly-available-folders.htm http://www.fullondesign.co.uk/coding/security/304-securing-publicly-available-folders.htm#comments Mon, 23 Feb 2009 20:48:03 +0000 Rogem http://www.fullondesign.co.uk/?p=304 Anyone who has ever developed a website which allows users to upload files will tell you “It’s best to think everyone is out to destroy your server”, which unfortunately is the best mindset to be in when setting up any website. One of the main methods used to by hackers to breach security on your website is to upload a file which allows them to execute code.

Here is a very quick and easy solution to stop potential hackers executing files in certain folders.

Open the .htaccess file in the folder you wish to protect and add the following code:

Options -Indexes
Options -ExecCGI
AddHandler cgi-script .php .php3 .php4 .phtml .pl .py .jsp .asp .htm .shtml .sh .cgi

This will essentially stop the folders returning an index of what is inside them and stop various files from running.

Useful Links

PHP File Upload Security
Apache Tutorial: .htaccess files
Apache, MySQL, and PHP Web Development All-in-one Desk Reference for Dummies

]]> http://www.fullondesign.co.uk/coding/security/304-securing-publicly-available-folders.htm/feed 0 Securing Links http://www.fullondesign.co.uk/coding/233-securing-links.htm http://www.fullondesign.co.uk/coding/233-securing-links.htm#comments Sat, 14 Feb 2009 21:49:14 +0000 Rogem http://www.fullondesign.co.uk/?p=233 Have you ever wanted to secure links on your website (for example hide the real source of a file)? Here is a quick and easy way to do this.

<?php # File created on 11th February 2009 by Mike Rogers (http://www.fullondesign.co.uk/). 

## Start defining constants ## 

define(RUN_ERRORS, TRUE); // Do you want the script to display errors? TRUE = yes you do.

define(redirect_or_echo, 'redirect'); // Do you want to redirect the user to another website, or just echo the other other webpages' content. 'rediect' will redirect, 'echo' will return the web pages constents. I recommend redirect.

## End defining constants ##

/* Start the link codes. The code is the ?code=123 part of the URL. The array should be fotmatted like:

$link['code'] = 'http://URL';

You may find it easier to do this with MySQL or including this as a seperate file. Too many links could lower performance, but for a small website just trying to cloak a few links this is good :) 

*/

$link['1'] = 'http://www.site.com/';

// Start the system.

function external_url($url){

    if($return = @file_get_contents($url)){

        return $return;

    }elseif(function_exists("curl_init")){

        $ch = curl_init();

        curl_setopt($ch, CURLOPT_URL, $url);

        curl_setopt($ch, CURLOPT_HEADER, 0);

        curl_setopt($ch, CURLOPT_TIMEOUT, 10);

        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); 

        $return = curl_exec($ch);

        curl_close($ch);

        return $return;

    }elseif($return = @implode("", @file($url))){

        return $return;

    } else {

        return NULL;

    }

}

// Checks if the code is a number

if(is_numeric($_GET['code']) && is_array($link)){

    if(isset($link[$_GET['code']])){

        if(redirect_or_echo === 'redirect'){

            header('location: '.$link[$_GET['code']]);

        } elseif(redirect_or_echo === 'echo'){

            echo external_url($link[$_GET['code']]);

        }else{

            if(RUN_ERRORS === TRUE){

                echo 'Sorry, an internal error has occoured.';    

            }

        }

    } else {

        if(RUN_ERRORS === TRUE){

            echo 'Sorry, the code you have provided is incorrect.';    

        }

    }

}else{

    if(RUN_ERRORS === TRUE){

        echo 'Sorry, the code you have provided is incorrect.';    

    }

}

/*

You are free to share, modify and use this code for commercial uses. Please give a link back (to http://www.fullondesign.co.uk/ ) if you can, but you don't have you.

You use this at your own risk.

*/

?>

Download the Code

Useful Links

PHP’s Offical Website – It has a fantastic documentation section. Well worth a look.
PHP 6 and MySQL 5 for Dynamic Web Sites: Visual QuickPro Guide – The book I learnt PHP from, it’s really good for beginners and reference guide.

]]> http://www.fullondesign.co.uk/coding/233-securing-links.htm/feed 0 Blocking users via .htaccess http://www.fullondesign.co.uk/coding/security/14-blocking-people-via-htaccess.htm http://www.fullondesign.co.uk/coding/security/14-blocking-people-via-htaccess.htm#comments Wed, 28 Jan 2009 22:25:53 +0000 Rogem http://www.fullondesign.co.uk/?p=14 Every website has problems with users . Here is a cool way to ban users who prove to be annoying.

Open your .htaccess file (should be above your public_html folder and you may need to show hidden files), then add the following:

order allow,deny
deny from [IP here]
allow from all

If you want to add more than one IP, just add an extra “deny from [ip here]” line. On the other hand, if you want to just let one person onto a website just use the following:

order allow,deny
allow from [IP here]
deny from all

Allowing just a few IP’s to certain areas is useful when protecting administrator sections or user areas.

]]> http://www.fullondesign.co.uk/coding/security/14-blocking-people-via-htaccess.htm/feed 0