Beginner confused about PHP security

[Rod Carrol]

Hello all,

As a beginner I've been exeperiencing lots of errors while building my
website, (I'm currently attempting to implement a member
login/registration piece for my site using mySQL and PHP)

I've read that PHP is secure in that it hides lots of code from
hackers and people trying to snoop around on the web site running the
PHP scripts - however, one thing I've noticed is that whenever I get a
script error, (for example, failure to connect, it lists the file
contining the php code - see below:

Warning: mysql_connect() : Access denied for user: 'xxxxx@localhos t'
(Using password: YES) in
/content/host/x/x/www.xxxxxxx.com/web/classes/access_check/access_check.ph p
on line 98

Is this to be expected? Is this a security risk? Is it possible,
(and/or a good idea), to disable these warnings once I'm happy that
the code is stable?

Thanks for any advice.

Rod.

[Justin Koivisto]

le*********@nat pro.com wrote:

I couldn't find it on 'thephpwtf.com' , and for us beginner's (if, it's not too time consuming), can you show us how you would replace this
snippet ?

He must be in the process of getting it ready to post. I noticed that
he just added 2 more entries, and has emailed me 2 times about the one
I sent in...

Unfortunately, I'm a bit pressed for time today (deadlines!), but if it
doesn't get to the phpwtf site by my lunch time tomorrow, I'll try and
show an example.

[Justin Koivisto]

As I always tell my students:

Security through obscurity is not security at all.

While I'm teaching classes, I continuously bring up questions like,
"Should we trust the value of this variable?" This is usually followed
by blank stares, so the next question is, "What if the value was...."

The SQL Injection thing really got them to thinking. I'm hoping that if
any of them go on to do web development that they will keep things like
this at the forefront of their planning stages.

[Chung Leong]

<ro***********@ yahoo.co.uk> wrote in message
news:11******** *************@z 14g2000cwz.goog legroups.com...

Wow! Thanks for all the replies - very helpful!

This seems to be a cool place to hang out while I get my head around
PHP :o)

Once my code is stable and errors are hidden from the user, emailing
the errors to myself sounds like a good idea.

Until you're bombarded by e-mails triggered by various PHP exploit scanners
out there.

[Michael Fesser]

.oO(Mark)

proper, secure, and robust coding ALWAYS involves checking return values
and errors:

$file = fopen(...);
if ($file === NULL)
{
header("Locatio n: showerror.php?e rrno=" . ERR_FOPEN_FAILE D);
exit;
}

Proper, secure and robust coding also uses an absolute URL in a Location
header, as required by the HTTP RFC.

Micha

[Mark]

Michael Fesser wrote:

.oO(Mark)

proper, secure, and robust coding ALWAYS involves checking return values
and errors:

$file = fopen(...);
if ($file === NULL)
{
header("Locatio n: showerror.php?e rrno=" . ERR_FOPEN_FAILE D);
exit;
}

Proper, secure and robust coding also uses an absolute URL in a Location
header, as required by the HTTP RFC.

Micha

touche` :-)

i'll consider myself reprimanded!!

mark.

--
I am not an ANGRY man. Remove the rage from my email to reply.

[R. Rajesh Jeba Anbiah]

Chung Leong wrote:

<ro***********@ yahoo.co.uk> wrote in message
news:11******** *************@z 14g2000cwz.goog legroups.com... <snip>

Once my code is stable and errors are hidden from the user, emailing the errors to myself sounds like a good idea.

Until you're bombarded by e-mails triggered by various PHP exploit

scanners out there.

And so, one should send email alerts on daily or hourly basis by
parsing the error log via cron--but certainly not on error basis.

--
<?php echo 'Just another PHP saint'; ?>
Email: rrjanbiah-at-Y!com Blog: http://rajeshanbiah.blogspot.com/

[jblanch]

well, to address the original problem, no, mysql will not aburbtly spit
out your username and password, it MAY however spit out information
about bad querys. Error checking on mysql is somthing that every
website needs, along with good logging, and you have a flexible,
dynamic, fast site.

Hiding errors with @ is a good idea, but what it is used for is to
check for an error, then display your own custom error message..

if you get an error on
mysql_connect() ;
and you have no error checking at all, the mysql/php error checking
will tell you what went wrong by itself, but if you have error
checking, then you can pick what to say, if anything at all.

a good way of doing this is somthing like

if(!@mysql_conn ect($user,$pass ,$host)){
//print error here, log it, do w/e
echo "Could not connect to database";
}

And for advanced error checking you can accutally create your own error
handler, or you can just disable error warnings/messages completely..
but thats not a good idea seeing as you never know what could go wrong.

Just find a way to create a library that you can use for all your
mysql/database functions, and then make sure they have proper error
checking.