PHP Security Audit

This is a general review of ensuring security in PHP and is a background for and supplement to Drupal Handbook's writing secure code.

Filter all incoming data

Create a tree diagram for every input. Every time information is assigned to another variable, it taints that one also. Just like zombie bites.

Escape all outgoing data

Includes SQL queries and HTML.

$html = array();
$html['username'] = htmlentities($clean['username'], ENT_QUOTES, 'UTF-8');

echo "<p>Welcome back, {$html['username']}.</p>";

The content type ('UTF-8') must match that used in your HTML headers.

PHP's MySQL escaping function takes the database's entity reference into account automatically.

Identifying output and tracing backward

echo $html

Step backward looking for $html:

$html = "<p>$greeting</p>";

Step back looking for $greeting:

$greeting = "Welcome back, $username";

Step back:

$username = $_COOKIE['username'];

That's a big problem. Trusting cookie data.

Common Gotcha's

• Trusting HTTP Headers:
  • Referer
• Trust of $_SERVER
• Trust of Client-Side Restrictions:
  • maxlength

Resources:

PHP Security Consortium

Essential PHP Security

From BrainBulb (now bought out by OmniTI). Direct link to the screencast movie.

By Chris Shiflett.