Table Of ContentBOOKS FOR PROFESSIONALS BY PROFESSIONALS® THE EXPERT’S VOICE® IN OPEN SOURCE
Companion
eBook Available
Chris Snyder, Author of
Pro PHP Security
Pro PHP Security, First edition
Pro
If you've been a web developer for even a short time, you know that security
is at once one of the most misunderstood and most important parts of your P
Thomas Myer, Author of job. You need only experience the anguish of having a web site or application
No Nonsense XML Web “hacked” by someone several continents away to understand that. By provid- H
Development with PHP ing the most current information available, this title will help you understand
Mac Basics in Simple Steps and avoid web security challenges while providing solutions for common real-
world problems. P
Pro
This book begins by taking you through what can be done to secure your
code by providing a rock solid grounding in the fundamentals of PHP security.
Next, the book expands on that topic by what you can do to help protect your S
Michael Southwell,
users and environment by covering such topics as encryption, SSL and SSH,
Coauthor of UNIX security, CAPTCHAs, and more. Finally, the book delves into often forgot- e PHP Security
Pro PHP Security, First edition ten (but incredibly important) topics such as keeping software up-to-date and
maintaining separate production and development environments. c
Security is a big deal, and this book has been updated so today’s PHP devel-
oper can successfully meet all of the security challenges of the future. u
r
i
THE APRESS ROADMAP
t From Application Security Principles
Beginning PHP Objects Pro y
PHP & MySQL, Patterns & Practice, PHP Security,
4th Edition 3rd Edition 2nd Edition
to the Implementation of XSS Defenses
Beginning Zend Enterprise Pro
PHP and Oracle PHP Patterns PHP Refactoring
Use PHP 5.3 to solve classic and modern day security
concerns, from SQL injection to mobile security
Companion eBook
SECOND
SECOND EDITION
EDITION
S
o
uthMSn Chris Snyder, Thomas Myer,
w y
SOURCE CODE ONLINE yd
www.apress.com ellerer and Michael Southwell
Shelve in:
Web Development / PHP
Programming
User level:
Intermediate–Advanced
www.it-ebooks.info
www.it-ebooks.info
Pro PHP Security
From Application Security Principles to the
Implementation of XSS Defenses
Second Edition
■ ■ ■
Chris Snyder
Thomas Myer
Michael Southwell
i
www.it-ebooks.info
Pro PHP Security: From Application Security Principles to the Implementation of XSS Defenses,
Second Edition
Copyright © 2010 by Chris Snyder, Thomas Myer, and Michael Southwell
All rights reserved. No part of this work may be reproduced or transmitted in any form or by any
means, electronic or mechanical, including photocopying, recording, or by any information
storage or retrieval system, without the prior written permission of the copyright owner and the
publisher.
ISBN-13 (pbk): 978-1-4302-3318-3
ISBN-13 (electronic): 978-1-4302-3319-0
Printed and bound in the United States of America 9 8 7 6 5 4 3 2 1
Trademarked names, logos, and images may appear in this book. Rather than use a trademark
symbol with every occurrence of a trademarked name, logo, or image we use the names, logos, and
images only in an editorial fashion and to the benefit of the trademark owner, with no intention of
infringement of the trademark.
The use in this publication of trade names, trademarks, service marks, and similar terms, even if
they are not identified as such, is not to be taken as an expression of opinion as to whether or not
they are subject to proprietary rights.
President and Publisher: Paul Manning
Lead Editor: Frank Polhmann
Technical Reviewer: Chris Snyder
Editorial Board: Steve Anglin, Mark Beckner, Ewan Buckingham, Gary Cornell, Jonathan
Gennick, Jonathan Hassell, Michelle Lowman, Matthew Moodie, Duncan Parkes, Jeffrey
Pepper, Frank Pohlmann, Douglas Pundick, Ben Renow-Clarke, Dominic Shakeshaft, Matt
Wade, Tom Welsh
Coordinating Editor: Adam Heath
Copy Editor: Jim Compton
Compositor: MacPS, LLC
Indexer: BIM Indexing & Proofreading Services
Artist: April Milne
Cover Designer: Anna Ishchenko
Distributed to the book trade worldwide by Springer Science+Business Media, LLC., 233
Spring Street, 6th Floor, New York, NY 10013. Phone 1-800-SPRINGER, fax (201) 348-4505,
e-mail [email protected], or visit www.springeronline.com.
For information on translations, please e-mail [email protected], or visit www.apress.com.
Apress and friends of ED books may be purchased in bulk for academic, corporate, or promotional
use. eBook versions and licenses are also available for most titles. For more information, reference
our Special Bulk Sales–eBook Licensing web page at www.apress.com/info/bulksales.
The information in this book is distributed on an “as is” basis, without warranty. Although every
precaution has been taken in the preparation of this work, neither the author(s) nor Apress shall
have any liability to any person or entity with respect to any loss or damage caused or alleged to be
caused directly or indirectly by the information contained in this work.
ii
www.it-ebooks.info
This, like all the others, is dedicated to my wife Hope Doty.
Thanks for loving me anyway.
—T.M.
iii
www.it-ebooks.info
Contents at a Glance
■Contents................................................................................................................v(cid:1)
■About the Authors..............................................................................................xvi(cid:1)
■Acknowledgments.............................................................................................xvii(cid:1)
■Preface.............................................................................................................xviii
Part 1: The Importance of Security............................................................................1(cid:1)
■Chapter 1: Why Is Secure Programming a Concern?............................................3(cid:1)
Part 2: Practicing Secure PHP Programming........................................................13(cid:1)
■Chapter 2: Validating and Sanitizing User Input.................................................15(cid:1)
■Chapter 3: Preventing SQL Injection...................................................................33(cid:1)
■Chapter 4: Preventing Cross-Site Scripting........................................................45(cid:1)
■Chapter 5: Preventing Remote Execution............................................................59(cid:1)
■Chapter 6: Enforcing Security for Temporary Files.............................................81(cid:1)
■Chapter 7: Preventing Session Hijacking............................................................93(cid:1)
■Chapter 8: Securing REST Services...................................................................105(cid:1)
Part 3: Practicing Secure Operations...................................................................115(cid:1)
■Chapter 9: Using CAPTCHAs..............................................................................117(cid:1)
■Chapter 10: User Authentication, Authorization, and Logging..........................133(cid:1)
■Chapter 11: Preventing Data Loss.....................................................................159(cid:1)
■Chapter 12: Safe Execution of System and Remote Procedure Calls................177(cid:1)
Part 4: Creating a Safe Environment....................................................................207(cid:1)
■Chapter 13: Securing Unix.................................................................................209(cid:1)
■Chapter 14: Securing Your Database................................................................221(cid:1)
■Chapter 15: Using Encryption............................................................................229(cid:1)
■Chapter 16: Securing Network Connections: SSL and SSH...............................267(cid:1)
■Chapter 17: Final Recommendations................................................................295(cid:1)
■Index.................................................................................................................327(cid:1)
iv
www.it-ebooks.info
Contents
■Contents at a Glance............................................................................................iv(cid:1)
■About the Authors..............................................................................................xvi(cid:1)
■Acknowledgments.............................................................................................xvii(cid:1)
■Preface.............................................................................................................xviii
Part 1: The Importance of Security............................................................................1(cid:1)
■Chapter 1: Why Is Secure Programming a Concern?............................................3(cid:1)
What Is Computer Security?...........................................................................................3(cid:1)
Why Absolute Computer Security Is Impossible.............................................................4(cid:1)
What Kinds of Attacks Are Web Applications Vulnerable To?.........................................4(cid:1)
When Users Provide Information............................................................................................................4(cid:1)
When Information Is Provided to Users..................................................................................................8(cid:1)
In Other Cases........................................................................................................................................8(cid:1)
Five Good Habits of a Security-Conscious Developer.....................................................9(cid:1)
Nothing Is 100% Secure.......................................................................................................................10(cid:1)
Never Trust User Input.........................................................................................................................10(cid:1)
Defense in Depth Is the Only Defense..................................................................................................11(cid:1)
Simpler Is Easier to Secure..................................................................................................................11(cid:1)
Peer Review Is Critical to Security.......................................................................................................12(cid:1)
Summary.......................................................................................................................12(cid:1)
(cid:1)
v
www.it-ebooks.info
■ CONTENTS
Part 2: Practicing Secure PHP Programming........................................................13(cid:1)
■Chapter 2: Validating and Sanitizing User Input.................................................15(cid:1)
What to Look For...........................................................................................................15(cid:1)
Input Containing Metacharacters.........................................................................................................16(cid:1)
Input of the Wrong Type.......................................................................................................................16(cid:1)
Too Much Input....................................................................................................................................17(cid:1)
Abuse of Hidden Interfaces..................................................................................................................17(cid:1)
Input Bearing Unexpected Commands.................................................................................................18(cid:1)
Strategies for Validating User Input in PHP...................................................................18(cid:1)
Secure PHP’s Inputs by Turning Off Global Variables..........................................................................18(cid:1)
Declare Variables.................................................................................................................................20(cid:1)
Allow Only Expected Input...................................................................................................................21(cid:1)
Check Input Type, Length, and Format................................................................................................22(cid:1)
Sanitize Values Passed to Other Systems............................................................................................25(cid:1)
Testing Input Validation................................................................................................31(cid:1)
Summary.......................................................................................................................31
■Chapter 3: Preventing SQL Injection...................................................................33(cid:1)
What SQL Injection Is....................................................................................................33(cid:1)
How SQL Injection Works..............................................................................................33(cid:1)
PHP and MySQL Injection..............................................................................................35(cid:1)
Kinds of User Input...............................................................................................................................35(cid:1)
Kinds of Injection Attacks....................................................................................................................36(cid:1)
Multiple-Query Injection.......................................................................................................................36(cid:1)
Preventing SQL Injection...............................................................................................37(cid:1)
Demarcate Every Value in Your Queries...............................................................................................37(cid:1)
Check the Types of Users’ Submitted Values.......................................................................................38(cid:1)
Escape Every Questionable Character in Your Queries........................................................................39(cid:1)
Abstract to Improve Security...............................................................................................................39(cid:1)
Full Abstraction....................................................................................................................................42(cid:1)
vi
www.it-ebooks.info
■ CONTENTS
Test Your Protection Against Injection..........................................................................42(cid:1)
Summary.......................................................................................................................43(cid:1)
■Chapter 4: Preventing Cross-Site Scripting........................................................45(cid:1)
How XSS Works............................................................................................................45(cid:1)
Scripting...............................................................................................................................................45(cid:1)
Categorizing XSS Attacks.....................................................................................................................46(cid:1)
A Sampler of XSS Techniques.......................................................................................47(cid:1)
HTML and CSS Markup Attacks...........................................................................................................48(cid:1)
JavaScript Attacks...............................................................................................................................49(cid:1)
Forged Action URIs...............................................................................................................................49(cid:1)
Forged Image Source URIs...................................................................................................................50(cid:1)
Extra Form Baggage.............................................................................................................................50(cid:1)
Other Attacks.......................................................................................................................................51(cid:1)
Preventing XSS.............................................................................................................51(cid:1)
SSL Does Not Prevent XSS...................................................................................................................51(cid:1)
Strategies.............................................................................................................................................51(cid:1)
Test for Protection Against XSS Abuse.........................................................................57(cid:1)
Summary.......................................................................................................................57(cid:1)
■Chapter 5: Preventing Remote Execution............................................................59(cid:1)
How Remote Execution Works......................................................................................59(cid:1)
The Dangers of Remote Execution................................................................................60(cid:1)
Injection of PHP Code...........................................................................................................................60(cid:1)
Embedding of PHP Code in Uploaded Files..........................................................................................61(cid:1)
Injection of Shell Commands or Scripts...............................................................................................63(cid:1)
Strategies for Preventing Remote Execution................................................................65(cid:1)
Limit Allowable Filename Extensions for Uploads...............................................................................65(cid:1)
Store Uploads Outside the Web Document Root..................................................................................66(cid:1)
Allow Only Trusted, Human Users to Import Code...............................................................................66(cid:1)
Sanitize Untrusted Input to eval().........................................................................................................66(cid:1)
vii
www.it-ebooks.info
■ CONTENTS
Do Not Include PHP Scripts from Remote Servers...............................................................................71(cid:1)
Properly Escape All Shell Commands..................................................................................................71(cid:1)
Beware of preg_replace() Patterns with the e Modifier.......................................................................75(cid:1)
Testing for Remote Execution Vulnerabilities...............................................................78(cid:1)
Summary.......................................................................................................................78(cid:1)
■Chapter 6: Enforcing Security for Temporary Files.............................................81(cid:1)
The Functions of Temporary Files.................................................................................81(cid:1)
Characteristics of Temporary Files...............................................................................82(cid:1)
Locations..............................................................................................................................................82(cid:1)
Permanence.........................................................................................................................................82(cid:1)
Risks....................................................................................................................................................82(cid:1)
Preventing Temporary File Abuse.................................................................................84(cid:1)
Make Locations Difficult......................................................................................................................84(cid:1)
Make Permissions Restrictive..............................................................................................................87(cid:1)
Write to Known Files Only....................................................................................................................88(cid:1)
Read from Known Files Only................................................................................................................88(cid:1)
Checking Uploaded Files......................................................................................................................89(cid:1)
Test Your Protection Against Hijacking.........................................................................90(cid:1)
Summary.......................................................................................................................91(cid:1)
■Chapter 7: Preventing Session Hijacking............................................................93(cid:1)
How Persistent Sessions Work.....................................................................................93(cid:1)
PHP Sessions.......................................................................................................................................93(cid:1)
Abuse of Sessions.........................................................................................................96(cid:1)
Session Hijacking.................................................................................................................................97(cid:1)
Fixation................................................................................................................................................99(cid:1)
Preventing Session Abuse..........................................................................................100(cid:1)
Use Secure Sockets Layer.................................................................................................................100(cid:1)
Use Cookies Instead of $_GET Variables............................................................................................100(cid:1)
Use Session Timeouts........................................................................................................................101(cid:1)
viii
www.it-ebooks.info
