Beginner confused about PHP security

[Rod Carrol]

Hello all,

As a beginner I've been exeperiencing lots of errors while building my
website, (I'm currently attempting to implement a member
login/registration piece for my site using mySQL and PHP)

I've read that PHP is secure in that it hides lots of code from
hackers and people trying to snoop around on the web site running the
PHP scripts - however, one thing I've noticed is that whenever I get a
script error, (for example, failure to connect, it lists the file
contining the php code - see below:

Warning: mysql_connect() : Access denied for user: 'xxxxx@localhos t'
(Using password: YES) in
/content/host/x/x/www.xxxxxxx.com/web/classes/access_check/access_check.ph p
on line 98

Is this to be expected? Is this a security risk? Is it possible,
(and/or a good idea), to disable these warnings once I'm happy that
the code is stable?

Thanks for any advice.

Rod.

[Markku Uttula]

Rod Carrol wrote:

Warning: mysql_connect() : Access denied for user: 'xxxxx@localhos t'
(Using password: YES) in
/content/host/x/x/www.xxxxxxx.com/web/classes/access_check/access_check.ph p
on line 98

Is this to be expected?
Yes.
Is this a security risk?
Definetly.
Is it possible, (and/or a good idea), to disable these
warnings once I'm happy that the code is stable?
Yes.
Thanks for any advice.

See http://fi.php.net/manual/en/function...-reporting.php

--
Markku Uttula

[Andrew M.]

Markku Uttula wrote:

Rod Carrol wrote:

Warning: mysql_connect() : Access denied for user: 'xxxxx@localhos t'
(Using password: YES) in
/content/host/x/x/www.xxxxxxx.com/web/classes/access_check/access_check.ph p

on line 98

Is this to be expected?

Yes.

Is this a security risk?

Definetly.

Is it possible, (and/or a good idea), to disable these
warnings once I'm happy that the code is stable?

Yes.

Thanks for any advice.

See http://fi.php.net/manual/en/function...-reporting.php

You can stop the error messages from being output to the browser by
putting @ in front of funtions. For example:

@if ( $_SESSION['auth'] == 'ok') {
header ("location:entr ance.php");
}

instead of

if ( $_SESSION['auth'] == 'ok') {
header ("location:entr ance.php");
}

[Markku Uttula]

Andrew M. wrote:

You can stop the error messages from being output to the browser by
putting @ in front of funtions. For example:

Which is a bad thing during development. If the error message is
supressed, you have no idea of something havnig gone wrong, and the
bughunt might take a lot longer than necessary.

--
Markku Uttula

[Mark]

Markku Uttula wrote:

Andrew M. wrote:

You can stop the error messages from being output to the browser by
putting @ in front of funtions. For example:

Which is a bad thing during development. If the error message is
supressed, you have no idea of something havnig gone wrong, and the
bughunt might take a lot longer than necessary.

which is why is is NOT acceptable to write EITHER:
$file = fopen(...);
$data = fread($file);
//etc

OR:

$file = @fopen(...);
$data = fread($file...) ;
//etc.
proper, secure, and robust coding ALWAYS involves checking return values
and errors:

$file = fopen(...);
if ($file === NULL)
{
header("Locatio n: showerror.php?e rrno=" . ERR_FOPEN_FAILE D);
exit;
}
$data = fread($file...) ;
// etc.

one should never be spending time tracking down bugs like this -- they
should always be checked and reported right away.

mark.

--
I am not an ANGRY man. Remove the rage from my email to reply.

[Justin Koivisto]

NO!!! The error control operator should be used only when doing custom
error control!

For instance, say I want to include a file, but it doesn't exist on the
system.
<?php include 'file.php'; ?>

That will spit out a warning (cannot open stream). This is something
you want to know about! Obviously, there is a reason why I wanted the
file in the first place. Don't suppress the warning, or you may never
know what is wrong.

However, you may want to do something more elaborate:
<?php
if( !@include 'file.php' ){
// file doesn't exist, call a user function
file_doesnt_exi st('file.php',_ _FILE,__LINE__) ;
}
?>

Here, the error is suppressed, but it was intentional. The
file_doesnt_exi st function might send the webmaster an email or do some
other helpful procedure.

I swear, if I get another project to take over/maintain that has blocks
like this:

<?php
$rowcount = mysql_num_rows( $result);
if($rowcount > 0)
{
$row = mysql_fetch_arr ay($result);

@ $securityquesti on = $row['securityquesti on'];
@ $securityanswer = $row['securityanswer '];
@ $company = $row['company'];
@ $title = $row['title'];
@ $division = $row['division'];
@ $firstname = $row['firstname'];
@ $lastname = $row['lastname'];
@ $emailaddr1 = $row['emailaddr1'];
@ $emailaddr2 = $row['emailaddr2'];
@ $website = $row['website'];
@ $phone1 = $row['phone1'];
@ $phone2 = $row['phone2'];
@ $phone3 = $row['phone3'];
@ $address1 = $row['address1'];
@ $address2 = $row['address2'];
@ $city = $row['city'];
@ $state = $row['state'];
@ $zip = $row['zip'];
$uts=$row['updatetimestam p'];
@ $updateuserid=$ row['updateuserid'];
$hour = substr($uts,8,2 );
$ampm = " AM";
if($hour > 12)
{
$hour = $hour - 12;
$ampm = " PM";
}
@ $updatetimestam p = substr($uts,4,2 )."/".
substr($uts,6,2 )."/".
substr($uts,0,4 )."@".
$hour.":".subst r($uts,10,2).$a mpm;
@ $lastupdated = " - last updated by {$updateuserid} on
{$updatetimesta mp}";
}
?>

I'm going to go POSTAL!!!

(Since I dug that snippet out, I just had to submit it to
http://www.thephpwtf.com/ !)

[steve]

"rodtheplod der" wrote:

Hello all,

As a beginner I've been exeperiencing lots of errors while
building my
website, (I'm currently attempting to implement a member
login/registration piece for my site using mySQL and PHP)

I've read that PHP is secure in that it hides lots of code
from
hackers and people trying to snoop around on the web site
running the
PHP scripts - however, one thing I've noticed is that whenever
I get a
script error, (for example, failure to connect, it lists the
file
contining the php code - see below:

Warning: mysql_connect() : Access denied for user:
'xxxxx@localhos t'
(Using password: YES) in
/content/host/x/x/www.xxxxxxx.com/web/classes/access_check/access_check.ph p
on line 98

Is this to be expected? Is this a security risk? Is it
possible,
(and/or a good idea), to disable these warnings once I'm happy
that
the code is stable?

Thanks for any advice.

Rod.

Hi,
The best thing you can do (and I have done) IMHO is to have the
warning/error emailed to yourself... and don’t show it to the visitor.

I find that if I just write the error to a file, I never get to visit
and see what is going on. With an email alert (which shows exactly
what the error is), I react instantly.

steve

--
Posted using the http://www.dbforumz.com interface, at author's request
Articles individually checked for conformance to usenet standards
Topic URL: http://www.dbforumz.com/PHP-Beginner...ict191933.html
Visit Topic URL to contact author (reg. req'd). Report abuse: http://www.dbforumz.com/eform.php?p=649596

[Chung Leong]

"Rod Carrol" <ro***********@ yahoo.co.uk> wrote in message
news:65******** *************** ***@posting.goo gle.com...

Hello all,

As a beginner I've been exeperiencing lots of errors while building my
website, (I'm currently attempting to implement a member
login/registration piece for my site using mySQL and PHP)

I've read that PHP is secure in that it hides lots of code from
hackers and people trying to snoop around on the web site running the
PHP scripts - however, one thing I've noticed is that whenever I get a
script error, (for example, failure to connect, it lists the file
contining the php code - see below:

Warning: mysql_connect() : Access denied for user: 'xxxxx@localhos t'
(Using password: YES) in
/content/host/x/x/www.xxxxxxx.com/web/classes/access_check/access_check.ph p on line 98

Is this to be expected? Is this a security risk? Is it possible,
(and/or a good idea), to disable these warnings once I'm happy that
the code is stable?

Well, that raises the ever contentious "security through obscurity"
question. Is it a security risk to let others know about your software's
archecture? A reasonable answer is "it shouldn't, but it might."

[lesperancer]

I couldn't find it on 'thephpwtf.com' , and for us beginner's (if, it's
not too time consuming), can you show us how you would replace this
snippet ?
tia

[rodtheplodder]

Wow! Thanks for all the replies - very helpful!

This seems to be a cool place to hang out while I get my head around
PHP :o)

Once my code is stable and errors are hidden from the user, emailing
the errors to myself sounds like a good idea.

Much appreciated!

RodC.