Marco.Tabini.and.Associates.PHP.Architects.Guide.to.PHP.Security.Sep.2005

php|architect’s
Guide to
PHP Security

Written by Ilia Alshanetsky, one of the foremost experts on PHP security in
the world, php|architect’s Guide to PHP Security focuses on providing you
with all the tools and knowledge you need to both secure your existing
applications and writing new systems with security in mind.
This book gives you a step-by-step guide to each security-related topic,
providing you with real-world examples of proper coding practices and their
implementation in PHP in an accurate, concise and complete way.
¸ Provides techniques applicable to any version of PHP,
including 4.x and 5.x
¸ Includes a step-by-step guide to securing your applications
¸ Includes a comprehensive coverage of security design
¸ Teaches you how to defend yourself from hackers
¸ Shows you how to distract hackers with a “tar pit” to help you
fend off potential attacks

php|architect’s Guide to PHP Security

With the number of security flaws and exploits discovered and released
every day constantly on the rise, knowing how to write secure and reliable
applications is become more and more important every day.

php|architect’s
Guide to
PHP Security
A Step-by-step Guide to Writing
Secure and Reliable PHP Applications
Ilia Alshanetsky

NanoBooks are excellent, in-depth resources created by the publishers of
php|architect (http://www.phparch.com), the world’s premier magazine dedicated
to PHP professionals.

US
Canada
UK (net)

From the publishers of

$32.99
$47.99
£18.99

Shelve under PHP/Web Development/Internet Programming

7.50 x 9.25

Ilia Alshanetsky

NanoBooks focus on delivering high-quality content with in-depth analysis and
expertise, centered around a single, well-defined topic and without any of the fluff
of larger, more expensive books.

.424

Foreword by Rasmus Lerdorf

7.50 x 9.25

PHP|ARCHITECT’S

GUIDE TO

PHP SECURITY
by Ilia Alshanetsky

php|architect’s฀Guide฀to฀Security

Contents Copyright © 2005 Ilia Alshanetsky – All Rights Reserved
Book and cover layout, design and text Copyright © 2005 Marco Tabini & Associates, Inc. – All Rights Reserved
First Edition: First Edition
ISBN 0-9738621-0-6
Produced in Canada
Printed in the United States
No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical reviews or
articles.

Disclaimer

Although every effort has been made in the preparation of this book to ensure the accuracy of the information contained
therein, this book is provided “as-is” and the publisher, the author(s), their distributors and retailers, as well as all affiliated, related or subsidiary parties take no responsibility for any inaccuracy and any and all damages caused, either
directly or indirectly, by the use of such information.
We have endeavoured to properly provide trademark information on all companies and products mentioned in this book
by the appropriate use of capitals. However, we cannot guarantee the accuracy of such information.
Marco Tabini & Associates, The MTA logo, php|architect, the php|architect logo, NanoBook and NanoBook logo are trademarks or registered trademarks of Marco Tabini & Associates Inc.

Bulk฀Copies

Marco Tabini & Associates, Inc. offers trade discounts on purchases of ten or more copies of this book. For more information, please contact our sales offices at the address or numbers below.

Credits
Written by

Ilia Alshanetsky

Published by
Marco Tabini & Associates, Inc.
28 Bombay Ave.

Toronto, ON M3H 1B7
Canada

Edited By

Martin Streicher

Technical Reviewers

Marco Tabini

Layout and Design

Arbi Arzoumani

Managing Editor

Emanuela Corso

(416) 630-6202

(877) 630-6202 toll free within North America
info@phparch.com / www.phparch.com
Marco Tabini, Publisher

About฀the฀Author

Ilia Alshanetsky is the principal of Advanced Internet Designs Inc., a company that specializes in security auditing, performance analysis and application development.
He is the author of FUDforum (http://fudforum.org), a highly popular, Open Source bulletin board focused on providing the maximum functionality at the highest level of security and performance.
Ilia is also a Core PHP Developer who authored or co-authored a series of extensions, including SHMOP, PDO, SQLite,
GD and ncurses. An active member of PHP’s Quality Assurance Team, he is responsible for hundreds of bug fixes, as
well as a sizable number of performance tweaks and features.
Ilia is a regular speaker at PHP-related conferences worldwide and can often be found teaching the Zend Certification
Training and Professional PHP Development courses that he has written for php|architect. He is also a prolific author, with
articles for PHP|Architect, International PHP Magazine, Oracle Technology Network, Zend.com and others to his name.
Ilia maintains an active blog at http://ilia.ws, filled tips and tricks on how to get the most out of PHP.

To฀my฀parents,
Who฀are฀and฀have฀been฀my฀pillar฀of฀support

Contents

Foreword • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • 13
Introduction฀ • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • 17

1฀฀฀Input฀Validation฀

• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • 21

The฀Trouble฀with฀Input
An฀Alternative฀to฀Register฀Globals:฀Superglobals
The฀Constant฀Solution
The฀$_REQUEST฀Trojan฀Horse
Validating฀Input
Validating฀Numeric฀Data
Locale฀Troubles
String฀Validation
Content฀Size฀Validation
White฀List฀Validation

22

25
25
27
28
28
29
30
34
36

฀ ฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

8

Contents

Being฀Careful฀with฀File฀Uploads
Configuration฀Settings
File฀Input
File฀Content฀Validation
Accessing฀Uploaded฀Data
File฀Size

The฀Dangers฀of฀Magic฀Quotes
Magic฀Quotes฀Normalization
Magic฀Quotes฀&฀Files
Validating฀Serialized฀Data
External฀Resource฀Validation

37
37
38
39
41
42
43
44
46
47
49

฀฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

2฀฀฀Cross-Site฀Scripting฀Prevention฀
The฀Encoding฀Solution
Handling฀Attributes
HTML฀Entities฀&฀Filters
Exclusion฀Approach
Handling฀Valid฀Attributes
URL฀Attribute฀Tricks
XSS฀via฀Environment฀Variables
IP฀Address฀Information
Referring฀URL
Script฀Location
More฀Severe฀XSS฀Exploits
Cookie/Session฀Theft
Form฀Data฀Theft
Changing฀Page฀Content฀

• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • 53

54
54
56
60
63
64
66
66
67
67
68
69
70
71

฀ ฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

3฀฀฀SQL฀Injection

• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • 73

Magic฀Quotes
Prepared฀Statements
No฀Means฀of฀Escape
The฀LIKE฀Quandary฀
SQL฀Error฀Handling

74
75
77
78
79

฀ ฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

Contents

Authentication฀Data฀Storage
Database฀Permissions
Maintaining฀Performance฀
Query฀Caching

80
83
83
85

฀ ฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

4฀฀฀Preventing฀Code฀Injection

• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • 87

Path฀Validation
Using฀Full฀Paths
Avoiding฀Dynamic฀Paths
Possible฀Dangers฀of฀Remote฀File฀Access
Validating฀File฀Names
Securing฀Eval
Dynamic฀Functions฀and฀Variables
Code฀Injection฀via฀PCRE

88
88
89
89
91
94
95
97

฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

5฀฀฀Command฀Injection฀

• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • 101

Resource฀Exhaustion฀via฀Command฀Injection
The฀PATH฀Exploit
Hidden฀Dangers
Application฀Bugs฀and฀Setting฀Limits
PHP฀Execution฀Process

102
104
105
106
108

฀ ฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

฀ ฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀฀•฀ ฀

6฀฀฀Session฀Security

• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • 113

Sessions฀&฀Cookies
Man฀in฀the฀Middle฀Attacks
Encryption฀to฀the฀Rescue!
Server฀Side฀Weakness
URL฀Sessions
Session฀Fixation
Surviving฀Attacks
Native฀Protection฀Mechanism
User-land฀Session฀Theft
Expiry฀Time฀Tricks

114
114
115
115
115
117
1