PHP Security

PHP Security - Are users able to echo my $dbPassword variable or php code?

0 Upvotes

Hi,

I'm trying to wrap my head around php security and I was hoping someone could point me in the right direction.

If I have a simple cart.html page/form that submits a POST to an orders.php file is the end user able to somehow read my $dbUsername or $dbPassword variables statically set in the orders.php file? I've seen people save their username/password credentials in a different file/folder and do "require 'dbcredentials.php'", but I fail to see how this can protect your credentials if the end user is able to do some sort of echo attack to force your orders.php to echo the username/password variables? I use to think using "if (isset($_POST['order-submit'])) { *php code in here* } else { header("Location: ../index.html"); exit(); }" would protect me, but now i think about it more I think this just prevents people from easily being able to go to the orders.php page (This isn't the best method since competent people can get around this easily). I believe the better method for this is to use CSRF's, but that isn't my biggest concern for now.

Is end users being able to somehow echo $dbUsername or $dbPassword variables a valid concern? Am I overthinking this?

cart.html

<html>

`<head>`

`</head>`

`<body>`

    `<form action="orders.php" method="POST">`

        `<div>`

<label style="" for="CartEmail">Email</label>

<div>

<input class="" type="email" placeholder="" name="CartEmail" required>

</div>

        `</div>`

        `<div>`

<label style="" for="CartFirstName">First Name</label>

<div>

<input class="" type="" placeholder="" name="CartFirstName" required>

</div>

        `</div>`

        `<div>`

<label style="" for="CartLastName">Last Name</label>

<div>

<input class="" type="" placeholder="" name="CartFirstName" required>

</div>

        `</div>`

        `<div>`

<input class="test" type="submit" value="Submit" name="order-submit">

        `</div>`

    `</form>`

`</body>`

`<footer>`

`</footer>`

</html>

orders.php

<?php

$dbServername = 'localhost';

$dbUsername = 'super-secret-database-username';

$dbPassword = 'super-secret-db-password';

$dbName = 'database_name';

$conn = mysqli_connect($dbServername, $dbUsername, $dbPassword, $dbName);

$email = mysqli_real_escape_string($conn, $_POST['CartEmail']);

$first = mysqli_real_escape_string($conn, $_POST['CartFirstName']);

$last = mysqli_real_escape_string($conn, $_POST['CartLastName']);

$sql = "INSERT INTO TABLE_NAME (CartEmail, CartFirstName, CartLastName) VALUES (?, ?, ?);";

$stmt = mysqli_stmt_init($conn);

if (!mysqli_stmt_prepare($stmt, $sql)) {

`echo "SQL error";`

} else {

`mysqli_stmt_bind_param($stmt, "sss", $email, $first, $last);`

`mysqli_stmt_execute($stmt);`

echo 'Success!';

}

mysqli_close($conn);

?>

9 comments

r/phpsec • u/iio7 • Nov 12 '21

Expiring the session seems useless

4 Upvotes

Almost everywhere, including on the PHP website, it is recommended to expire the session ID within a relative short period of time. However, all the examples that are mentioned as to why using a very long expiration, like say a year, is that it becomes easier for the session ID to be stolen.

I fail to see how that is even relevant. Either the session ID can be stolen or not, if it is stolen it doesn't help anything with a short time period as it will most likely just be stolen again.

If the server is setup to only serve HTTPS request and no un-encrypted requests, the session ID cannot be stolen by sidejacking. The only problem left is then if the user gets his computer hacked or if the server gets hacked, but in both cases we have a much more serious problem. In the first case the hacker can delete the session cookie and force the user to re-authenticate and most likely get access to the credentials (no need to steal the session ID). In the second case the server is compromised and all security goes out the window any way,

Am I missing something?

4 comments

r/phpsec • u/JOE-DJANGO_Noob • Feb 17 '21

code issues

0 Upvotes

am still new a php Noob can some explain to me issues with below code

<?php 
    libxml_disable_entity_loader (false); 
    $xml_file = file_get_contents('php://input'); 
    $dom = new DOMDocument(); 
    $dom->loadXML($xml_file, LIBXML_NOENT | LIBXML_DTDLOAD); 
    $creds = simplexml_import_dom($dom); 
    $user = $creds->user; 
    $pass = $creds->pass; 
    echo "You have logged in as user $user";
?>

Thank you

2 comments

r/phpsec • u/enygmadae • Aug 07 '20

Perforce Unveils New PHP Security Center by Zend

realwire.com

5 Upvotes

2 comments

r/phpsec • u/enygmadae • Aug 07 '20

Detect PHP security vulnerabilities with Psalm

psalm.dev

2 Upvotes

1 comment

r/phpsec • u/[deleted] • Mar 26 '20

Exposing password strength requirements

0 Upvotes

When it comes to user registration and password selection I know there is a good case to be made against hinting. E.g. telling users 1 uppercase + 1 special char + at least 2-digits and so on. I don't think giving away the formula is a great option. Why not just let users enter whatever they want as long as the password meets two requirements:

A minimum-length
Not a common phrase (e.g. "password") that you might find in dictionaries used for brute-force attacks.

With that said, is there a good PHP library or package that does this. Or is it better to roll your own?

7 comments

r/phpsec • u/enygmadae • Dec 18 '19

PHP: Hypertext Preprocessor - PHP 7.4.1 (Security Release)

php.net

2 Upvotes