general security

[Chris Mosser]

I'm still somewhat new with php, only able to play with it now and again.
Anyway, I was recently sent an email about poss security flaws, not in php
itself but in my code on a site that I am working on. Here is a list of
security issues that poss exist and I'm just looking for other ways to
improve the overall security of the site.

*transactions
this site accepts transactions through IBILL. I need a way to validate
that after the client goes to ibill's site and gets sent to back to my site,
that it really is coming from Ibill. I hear that 'http_referrer' can be
spoofed and should therefore not be trusted, at least not by itself. Right
now I am just using a hidden form field and passing through a var from my
site, to ibill, and back to my site. Problem is of course that someone
could just copy and paste my source and change the action of the form to
just bypass ibill and go directly to the processing page after ibill, should
they find a way to know what it is. This is all assuming they know how of
course. I just need a good way of validating that they actually payed
through ibill and did not get a free account. I thought about registering
that hidden form field var within the session and comparing it to the
returned var from ibill, if that makes any sense to you guys..any idea's
here?????????????

*file uploads
after paying, clients can upload images via thier personal control
panel. I perform a mime check only at this time. I recently found:
is_uploaded_file() and move_uploaded_file() and will incorparate them into
the code rather than just using copy. Should I also set permissions, or
will they be set correctly after the move allready. The uploads are just
images. I am also thinking of setting file set checks also.

*client supplied text
I am also worried about "sql injection" and things of that nature. I
found add_slashes(), strip_tags(), htmlspeacialchars() and will start to use
those on user supplied text. Any other functions that I might want to
include and run my text vars through.

PS: I'm also open to any other issues that may not be covered here. I just
read through some old posts but just don't want to miss anything.

-thnx
Chris Mosser

[Moxley Stratton]

Chris Mosser wrote:

*file uploads
after paying, clients can upload images via thier personal control
panel. I perform a mime check only at this time. I recently found:
is_uploaded_file() and move_uploaded_file() and will incorparate them into
the code rather than just using copy. Should I also set permissions, or
will they be set correctly after the move allready. The uploads are just
images. I am also thinking of setting file set checks also. 1. Avoid using the upload's original filename as the new filename.
2. Have the uploaded files reviewed by a human before they are made
available to the public.

*client supplied text
I am also worried about "sql injection" and things of that nature. I
found add_slashes(), strip_tags(), htmlspeacialchars() and will start to use
those on user supplied text. Any other functions that I might want to
include and run my text vars through. This is a very important security topic because it seems to be so often
ignored. Besides sql injection, cross-site scripting is another
malicious type of attack.

Pay close attention to the way magic_quotes_gpc, addslashes(), and
stipslashes() relate. That will help make your applications treat user
input more consistently.

PS: I'm also open to any other issues that may not be covered here. I just
read through some old posts but just don't want to miss anything.

There are two classic security problems with scripting technologies on a
shared hosting environment:
1. If my script will be opening a database connection, how do I securely
store my database password?
2. If my script will be writing files, how do I securely give it
permission to do so without giving permission to everybody else to do it
too?

--
-Moxley
moxleystratton.com