 |  |  |  |  |  |  |  |
PHP & Apache Server Security Questions
Please support our PHP advertiser: PostgreSQL or MySQL? Compare and contrast the two most popular open source databases
 |
Hello,
I was wondering if I could clarify some recent information I have found on the internet regarding PHP security. Im a self taught PHP/MySQL amateur and therefore have a very skethcy knowledgebase of the coding. lol
Im currently developing a website and would obviously like to ensure its as secure as possible from malicious activity and attacks....
My first quesion is regarding the PUBLIC_HTML folder and the use of PHP scripts and MySQL.
Am I correct in saying that any file within the public_html folder is basically open to attackers. For example ...say I have a registration script where members can register on my site.
The register.php file is the actual form that members fill.
The register_proceed.php file is the actual php code that checks, inserts and accesses the MYSQL database.
If I place both these files in the public HTML file then they are potentially at risk from being hacked right?
However ... Am I right in saying and is it possible to say for example set up a folder called register_inc at the public_html level of my server and then place the register_proceed.php file in this directory so that its not visible to the domain!
What exactly would this achieve in terms of security? Does this mean that no one can hack that script and that it can happily proceed to register the member?
Should this be done with all files that process my scripts and changes my mysql database?
Is this as easy as sending the form data to the register directory outside the public html folder and then it sending the confirmation back or is it much more complicated?
My second question is regarding cron jobs!
If i set up a cron job on my server it seems I have to insert the database connection details to allow it to work!
Is there any security loops that setting up cron jobs may cause?
I would really appreciate any feedback on this matter as now I am really interested in finding out all I can (in an easy to understand way) about website security! :OD
Regards
Justin
I was wondering if I could clarify some recent information I have found on the internet regarding PHP security. Im a self taught PHP/MySQL amateur and therefore have a very skethcy knowledgebase of the coding. lol
Im currently developing a website and would obviously like to ensure its as secure as possible from malicious activity and attacks....
My first quesion is regarding the PUBLIC_HTML folder and the use of PHP scripts and MySQL.
Am I correct in saying that any file within the public_html folder is basically open to attackers. For example ...say I have a registration script where members can register on my site.
The register.php file is the actual form that members fill.
The register_proceed.php file is the actual php code that checks, inserts and accesses the MYSQL database.
If I place both these files in the public HTML file then they are potentially at risk from being hacked right?
However ... Am I right in saying and is it possible to say for example set up a folder called register_inc at the public_html level of my server and then place the register_proceed.php file in this directory so that its not visible to the domain!
What exactly would this achieve in terms of security? Does this mean that no one can hack that script and that it can happily proceed to register the member?
Should this be done with all files that process my scripts and changes my mysql database?
Is this as easy as sending the form data to the register directory outside the public html folder and then it sending the confirmation back or is it much more complicated?
My second question is regarding cron jobs!
If i set up a cron job on my server it seems I have to insert the database connection details to allow it to work!
Is there any security loops that setting up cron jobs may cause?
I would really appreciate any feedback on this matter as now I am really interested in finding out all I can (in an easy to understand way) about website security! :OD
Regards
Justin
•
•
Join Date: Sep 2007
Posts: 1,344
Reputation: 
Solved Threads: 126
•
•
•
•
Originally Posted by justted 
My first quesion is regarding the PUBLIC_HTML folder and the use of PHP scripts and MySQL.
Am I correct in saying that any file within the public_html folder is basically open to attackers. For example ...say I have a registration script where members can register on my site.
The register.php file is the actual form that members fill.
The register_proceed.php file is the actual php code that checks, inserts and accesses the MYSQL database.
•
•
•
•
Originally Posted by justted
If i set up a cron job on my server it seems I have to insert the database connection details to allow it to work!
Try not to bump 10 year old threads as it can be really annoying.
Like php then read my website at http://syntax.cwarn23.net/
Star-Trek-Atlantis - now that's what I call a movie ^_^
My favourite PC. - MacGyver Fan
Bad english note: dis-iz-2b4u
Like php then read my website at http://syntax.cwarn23.net/
Star-Trek-Atlantis - now that's what I call a movie ^_^
My favourite PC. - MacGyver Fan
Bad english note: dis-iz-2b4u
•
•
Join Date: Sep 2005
Posts: 1,053
Reputation:
Solved Threads: 66
Hello Justin,
Security in PHP is the same as any server side programming language, they are all vulnerable to the same attacks.
PHP has a history of being vulnerable mainly because of its popularity.
1) More non-security aware developers use PHP then any other language, so there code has flaws almost 100% of the time.
2) There are more sites written in PHP then any other server side language, thus more chances to find security holes amongst so many.
PHP has had a rep of having security problems in the PHP core itself, but this has improved greatly. Much of which can be attributed to the Hardened-PHP project.
http://www.hardened-php.net/suhosin/
If you are using a shared host, ask if they have PHP4 with the suhosin patch or PHP5 or higher. I'm not sure if PHP5 still needs Suhosin but it seems many large sites aren't using the two together so I believe PHP5 has a better security then PHP4 natively.
As a developer I think there are just about 4 or so main security vulnerabilities to keep in mind when coding.
1) XSS (Cross Site Scripting)
This is the most common vulnerability in any website. It is estimated that around 70% of websites have an XSS vulenerability.
http://en.wikipedia.org/wiki/Cross-site_scripting
A simple example in PHP:
What happens is the PHP echo's a variable passed in from HTTP (in this case a GET parameter). If a user typed in the browser URL:
They would see the cookies saved for their session. An attacker can make a user click a link that will also retrieve these cookies from JavaScript, and send it to them - without the user knowing.
To prevent it:
This will turn any HTML into HTML entities. You also have to specify the encoding you used for the page (in this case UTF-8). The reason is so PHP codes not mangle the character encoding, which can also result in XSS.
2) XSRF - Cross Site Request Forgery
This is similar to XSS and just as common or maybe even more common. It is when a website fails to protect it's users from being used by 3rd parties without their knowledge.
http://en.wikipedia.org/wiki/Cross-site_request_forgery
And example of this in PHP is a simple comment form.
Imagine the comment form is only available for logged in users. Now an attacker can just send an already logged in user the URL:
So when the logged in user clicks on that link, they have posted the comment without knowing. This can even be done in a hidden frame, so the user never see's it.
So the attacker is using the user's already authenticated session (privileges) to do his/her bidding.
Preventing XSRF:
Notice the new <input> called "key". It will contain a random value remembered by PHP. This random value should be saved, and be unique for every form that is sensitive.
This way, the attacker would not be able to make the user post something on their behalf, since they don't know the value of "key".
(This only works if you don't have an XSS vulnerability of the page itself, as that can lead to the attacker knowing what the value of "key" is)
3) SQL injection
SQL injection is when an attacker manages to manipulate any SQL database queries in your website in a way you didn't intend.
Example:
Because the $_GET['password'] can be anything the attacker wishes to put in the URL, they could craft a URL like:
Notice the ' in the value for the parameter "password"
This will make your sql query:
SELECT * FROM users where password = 'nothing' or 1
This would make it return the first user instead of the user with password = "nothing" since "or 1"is always true.
Preventing SQL injection:
the function mysql_real_escape_string() will prevent any SQL injection by escaping any character that would otherwise terminate the string.
4) Remote File inclusion
Remote file inclusion is when an attacker can include remote file into your PHP code. This is the most dangerous attack, as it allows the attacker to execute arbitrary code on your PHP server.
eg:
With this code the developer is hoping to have a URL such as:
site.com/pages.php?page=home
And this would include the file:
/pages/home.php
However, any attacker can now place a URL such as:
site.com/pages.php?page=../../passwords.txt
And it would reveal the contents of the file passwords.txt
Or they could use it to include a remove file from their server, if the URL wrappers are enabled for file includes (which is common).
With these precautions in mind, I'll answer your questions:
The public_html folder is the default web directory on many server setups. This has nothing to do with PHP, it is dependent on your web server and its configuration.
In order for a file on your website to be accessible, the web server must allow access to it from the public web.
Servers do this by designating a folder as the web directory or web root. In apache it is called the DOCUMENT_ROOT. So whatever is the document root, is accessible by anyone.
It can be any type of file, the webserver will try to send the file over HTTP when anyone asks for it.
If it is a PHP file, they the webserver will most likely be configured to send it to the PHP interpreter first, before receiving the output and sending it to HTTP.
Now a PHP file can include any file it has access to - even those below the web directory. If you have made sure there are no remote file inclusion vulnerabilities, then you are safe. However, many go to precautionary measures, and will keep sensitive files below the web root, so they are not publically accessible. Since a PHP file from above the web root can include it, but the server will not serve it to the public, then it is more or so protected from direct viewing.
Servers may sometime go into errors, and accidently serve a PHP file as plain text, this is way it is always safer to keep files below the web root if they contain sensitive information.
For cron jobs, it is better to have the file you're including in the cron below the web root. Then use the PHP CLI based interpreter. That is the interpreter that users the Command Line Interface.
http://www.php-cli.com/
So your cron command would looks something like:
Sorry for the length of the post.
Security in PHP is the same as any server side programming language, they are all vulnerable to the same attacks.
PHP has a history of being vulnerable mainly because of its popularity.
1) More non-security aware developers use PHP then any other language, so there code has flaws almost 100% of the time.
2) There are more sites written in PHP then any other server side language, thus more chances to find security holes amongst so many.
PHP has had a rep of having security problems in the PHP core itself, but this has improved greatly. Much of which can be attributed to the Hardened-PHP project.
http://www.hardened-php.net/suhosin/
If you are using a shared host, ask if they have PHP4 with the suhosin patch or PHP5 or higher. I'm not sure if PHP5 still needs Suhosin but it seems many large sites aren't using the two together so I believe PHP5 has a better security then PHP4 natively.
As a developer I think there are just about 4 or so main security vulnerabilities to keep in mind when coding.
1) XSS (Cross Site Scripting)
This is the most common vulnerability in any website. It is estimated that around 70% of websites have an XSS vulenerability.
http://en.wikipedia.org/wiki/Cross-site_scripting
A simple example in PHP:
php Syntax (Toggle Plain Text)
What happens is the PHP echo's a variable passed in from HTTP (in this case a GET parameter). If a user typed in the browser URL:
PHP Syntax (Toggle Plain Text)
They would see the cookies saved for their session. An attacker can make a user click a link that will also retrieve these cookies from JavaScript, and send it to them - without the user knowing.
To prevent it:
php Syntax (Toggle Plain Text)
This will turn any HTML into HTML entities. You also have to specify the encoding you used for the page (in this case UTF-8). The reason is so PHP codes not mangle the character encoding, which can also result in XSS.
2) XSRF - Cross Site Request Forgery
This is similar to XSS and just as common or maybe even more common. It is when a website fails to protect it's users from being used by 3rd parties without their knowledge.
http://en.wikipedia.org/wiki/Cross-site_request_forgery
And example of this in PHP is a simple comment form.
PHP Syntax (Toggle Plain Text)
Imagine the comment form is only available for logged in users. Now an attacker can just send an already logged in user the URL:
PHP Syntax (Toggle Plain Text)
So the attacker is using the user's already authenticated session (privileges) to do his/her bidding.
Preventing XSRF:
PHP Syntax (Toggle Plain Text)
Notice the new <input> called "key". It will contain a random value remembered by PHP. This random value should be saved, and be unique for every form that is sensitive.
This way, the attacker would not be able to make the user post something on their behalf, since they don't know the value of "key".
(This only works if you don't have an XSS vulnerability of the page itself, as that can lead to the attacker knowing what the value of "key" is)
3) SQL injection
SQL injection is when an attacker manages to manipulate any SQL database queries in your website in a way you didn't intend.
Example:
PHP Syntax (Toggle Plain Text)
Because the $_GET['password'] can be anything the attacker wishes to put in the URL, they could craft a URL like:
PHP Syntax (Toggle Plain Text)
Notice the ' in the value for the parameter "password"
This will make your sql query:
SELECT * FROM users where password = 'nothing' or 1
This would make it return the first user instead of the user with password = "nothing" since "or 1"is always true.
Preventing SQL injection:
PHP Syntax (Toggle Plain Text)
the function mysql_real_escape_string() will prevent any SQL injection by escaping any character that would otherwise terminate the string.
4) Remote File inclusion
Remote file inclusion is when an attacker can include remote file into your PHP code. This is the most dangerous attack, as it allows the attacker to execute arbitrary code on your PHP server.
eg:
PHP Syntax (Toggle Plain Text)
With this code the developer is hoping to have a URL such as:
site.com/pages.php?page=home
And this would include the file:
/pages/home.php
However, any attacker can now place a URL such as:
site.com/pages.php?page=../../passwords.txt
And it would reveal the contents of the file passwords.txt
Or they could use it to include a remove file from their server, if the URL wrappers are enabled for file includes (which is common).
With these precautions in mind, I'll answer your questions:
•
•
•
•
My first quesion is regarding the PUBLIC_HTML folder and the use of PHP scripts and MySQL.
Am I correct in saying that any file within the public_html folder is basically open to attackers. For example ...say I have a registration script where members can register on my site.
The register.php file is the actual form that members fill.
The register_proceed.php file is the actual php code that checks, inserts and accesses the MYSQL database.
In order for a file on your website to be accessible, the web server must allow access to it from the public web.
Servers do this by designating a folder as the web directory or web root. In apache it is called the DOCUMENT_ROOT. So whatever is the document root, is accessible by anyone.
It can be any type of file, the webserver will try to send the file over HTTP when anyone asks for it.
If it is a PHP file, they the webserver will most likely be configured to send it to the PHP interpreter first, before receiving the output and sending it to HTTP.
Now a PHP file can include any file it has access to - even those below the web directory. If you have made sure there are no remote file inclusion vulnerabilities, then you are safe. However, many go to precautionary measures, and will keep sensitive files below the web root, so they are not publically accessible. Since a PHP file from above the web root can include it, but the server will not serve it to the public, then it is more or so protected from direct viewing.
Servers may sometime go into errors, and accidently serve a PHP file as plain text, this is way it is always safer to keep files below the web root if they contain sensitive information.
PHP Syntax (Toggle Plain Text)
For cron jobs, it is better to have the file you're including in the cron below the web root. Then use the PHP CLI based interpreter. That is the interpreter that users the Command Line Interface.
http://www.php-cli.com/
So your cron command would looks something like:
PHP Syntax (Toggle Plain Text)
Sorry for the length of the post.
www.fijiwebdesign.com - web design and development and fun
Cpanel Email - Let users Register email accounts on your website upon registration
Ajax Chat - Fully browser based chat!
Cpanel Email - Let users Register email accounts on your website upon registration
Ajax Chat - Fully browser based chat!
Hello,
Thank you both kindly for the replies. Ether ... thank you for those points that you made. Im just about to go and see if I can check my code and ensure those are implemented. I may even have to consider re-coding the entire website as its based on a script I bought that was badly coded.
This way if I re-code it completly then at least id have full control and knowledge of every little thing. Its all very well buying these ready made scripts but you never know how security concious the developer was when making it. lol
Im just looking at getting my own dedicated server for the peace of mind and also improved security/performance etc. Im currently on a reseller and just hate the thought of sharing the server with other unknown websites. LOL
Anyway ... once again thanks to you both for the help. Will see what I come up with :p
Regards
Justin
Thank you both kindly for the replies. Ether ... thank you for those points that you made. Im just about to go and see if I can check my code and ensure those are implemented. I may even have to consider re-coding the entire website as its based on a script I bought that was badly coded.
This way if I re-code it completly then at least id have full control and knowledge of every little thing. Its all very well buying these ready made scripts but you never know how security concious the developer was when making it. lol
Im just looking at getting my own dedicated server for the peace of mind and also improved security/performance etc. Im currently on a reseller and just hate the thought of sharing the server with other unknown websites. LOL
Anyway ... once again thanks to you both for the help. Will see what I come up with :p
Regards
Justin
Hello again,
As it stands im having a few problems with my includes and my lack of knowledge again. lol
I wanted to clarify if im thinking along the right line here ....
Say I have a basic HTML form that a visitor can fill in called form.php
When the visitor sends this form it sends it to form.pro.php
In the form.pro.php I have my code which calls for the global settings page, the config and various other pages which as located in my hidden directories.
However ... if my code in form.pro.php first of all checks the user input and then if checks are TRUE ... I would enter the include: which would replace my current INSERT INTO table_name etc ...
I would then move this INSERT INTO table_name piece of code to the include file ... does that make sense and if so is that correct?
For some reason I had it in my mind to put the form.pro.php file for example in the hidden directories which obviously isnt correct.
Many Thanks and would apreciate any feedback or info
As it stands im having a few problems with my includes and my lack of knowledge again. lol
I wanted to clarify if im thinking along the right line here ....
Say I have a basic HTML form that a visitor can fill in called form.php
When the visitor sends this form it sends it to form.pro.php
In the form.pro.php I have my code which calls for the global settings page, the config and various other pages which as located in my hidden directories.
However ... if my code in form.pro.php first of all checks the user input and then if checks are TRUE ... I would enter the include: which would replace my current INSERT INTO table_name etc ...
I would then move this INSERT INTO table_name piece of code to the include file ... does that make sense and if so is that correct?
For some reason I had it in my mind to put the form.pro.php file for example in the hidden directories which obviously isnt correct.
Many Thanks and would apreciate any feedback or info
sorry just to add something to that .... this include file that is located in a hidden directory would basically be the place where I store all my variables and database INSERTS,DELETE,UPDATE commands ?
Then I add the includes to the relevant pages that require the info and therefore would be protecting the certain variables and database details within the hidden files....
Would this be a correct statement??????
Then I add the includes to the relevant pages that require the info and therefore would be protecting the certain variables and database details within the hidden files....
Would this be a correct statement??????
•
•
Join Date: Feb 2008
Posts: 213
Reputation:
Solved Threads: 17
Posting Whiz in Training
thanks digital-ether,
for nice post
for nice post
Help as an alias
I think programming is great................
Tour Travel weblink by me and about Tour ,
Go To My Home Page and I m in Webdevelopment.
I think programming is great................
Tour Travel weblink by me and about Tour ,
Go To My Home Page and I m in Webdevelopment.
Hello again ... Im having a nightmare trying to get my hidden directory to work! lol
I managed to find the PHP.ini file which is located on my server files in the Public Html folder.
I changed the include_path to the name of a folder called includes as below and then created a folder on the same level as my public html folder. I inserted a file include that connects to my database and then tested this out on my website.
However ...it couldnt connect and didnt work at all.
Is there something im missing in the actual include file or the one calling it? I thought you could type in the include "/filename"; as normal as the checks are meant to be made with the .: ?
Im totally confused now and no where near getting an understanding of these hidden files and directories. lol
Please help someone explain it?
Here is the code
I managed to find the PHP.ini file which is located on my server files in the Public Html folder.
I changed the include_path to the name of a folder called includes as below and then created a folder on the same level as my public html folder. I inserted a file include that connects to my database and then tested this out on my website.
However ...it couldnt connect and didnt work at all.
Is there something im missing in the actual include file or the one calling it? I thought you could type in the include "/filename"; as normal as the checks are meant to be made with the .: ?
Im totally confused now and no where near getting an understanding of these hidden files and directories. lol
Please help someone explain it?
Here is the code
PHP Syntax (Toggle Plain Text)
•
•
Join Date: Sep 2005
Posts: 1,053
Reputation:
Solved Threads: 66
Hi justted,
could you post some of your code, and directory structure if possible.
To include a file, it is good to use the full path.
eg:
instead of:
Relative paths can be confusing. When you include a relative path, PHP will first look in the current working directory, then look in the includes_path you specify in php.ini, then try the current executing script.
The current working directory is the directory of the first script executed by the PHP interpreter. eg: if the URL was: site.com/index.php then the first script executed is index.php and the current working directory looks something like:
/home/usr/site.com/public_html/
If if you had included a file includes/db.php and that file included another file, db.config.php, then php will look for that file in /home/usr/site.com/public_html/ and not in /home/usr/site.com/public_html/includes/ which is a bit counter intuitive.
You can however change the current working directory using chdir():
http://www.php.net/manual/en/function.chdir.php
If you want absolute paths, it is good to work from your web directory. You don't want to use literal absolute paths as this binds you to the server you write your code in.
The web directory is available in PHP as:
So if you have a file under the document root, trackback from there using the ../ notation.
eg:
if you have your DOCUMENT_ROOT as:
And have your includes in:
Then use:
i
This gives:
Most PHP applications actually do the following. They will first find the web root using:
This has to be in a file in the web root however. Then calculate paths from there.
could you post some of your code, and directory structure if possible.
To include a file, it is good to use the full path.
eg:
PHP Syntax (Toggle Plain Text)
instead of:
PHP Syntax (Toggle Plain Text)
Relative paths can be confusing. When you include a relative path, PHP will first look in the current working directory, then look in the includes_path you specify in php.ini, then try the current executing script.
The current working directory is the directory of the first script executed by the PHP interpreter. eg: if the URL was: site.com/index.php then the first script executed is index.php and the current working directory looks something like:
/home/usr/site.com/public_html/
If if you had included a file includes/db.php and that file included another file, db.config.php, then php will look for that file in /home/usr/site.com/public_html/ and not in /home/usr/site.com/public_html/includes/ which is a bit counter intuitive.
You can however change the current working directory using chdir():
http://www.php.net/manual/en/function.chdir.php
If you want absolute paths, it is good to work from your web directory. You don't want to use literal absolute paths as this binds you to the server you write your code in.
The web directory is available in PHP as:
PHP Syntax (Toggle Plain Text)
So if you have a file under the document root, trackback from there using the ../ notation.
eg:
if you have your DOCUMENT_ROOT as:
PHP Syntax (Toggle Plain Text)
And have your includes in:
PHP Syntax (Toggle Plain Text)
Then use:
i
PHP Syntax (Toggle Plain Text)
This gives:
PHP Syntax (Toggle Plain Text)
Most PHP applications actually do the following. They will first find the web root using:
PHP Syntax (Toggle Plain Text)
This has to be in a file in the web root however. Then calculate paths from there.
Last edited by digital-ether; Feb 12th, 2009 at 5:41 pm.
www.fijiwebdesign.com - web design and development and fun
Cpanel Email - Let users Register email accounts on your website upon registration
Ajax Chat - Fully browser based chat!
Cpanel Email - Let users Register email accounts on your website upon registration
Ajax Chat - Fully browser based chat!
-1
#10 26 Days Ago
I may even have to consider re-coding the entire website as its based on a script I bought that was badly coded.
Last edited by digital-ether; 26 Days Ago at 1:56 am. Reason: snipped url spam
|
Similar Threads
- Help with automatic update problem and more (Viruses, Spyware and other Nasties)
- One Level Up & Typo3 (Linux Servers and Apache)
Other Threads in the PHP Forum
- Previous Thread: Confused :(
- Next Thread: ftp_connect
| Thread Tools | Search this Thread |
You need to join our community in order to build your list of favorite forums. You can visit the forum index for a listing of all forums.
Related Forum Features
Latest PHP Posts
- Today's Posts
- Unanswered Threads
apache api array basic beginner binary body broken cakephp class cms code computing confirm cron curl customizableitems database date date/time delete display dynamic echo email error file files filter folder form forms forum function functions gc_maxlifetime global google headmethod href htaccess html iframe image include ip javascript joomla limit link list login malfunction memmory memory menu mlm msqli_multi_query multiple mycodeisbad mysql navigation oop parameter parsing paypal pdf php phpmysql query question random recourse recursion regex script search select seo server sessions snippet source space sql static system table thesishelp trouble tutorial update upload url variable video web webdesign xml youtube