Programming PHP

Chapter 12 CHAPTER 12
Security
PHP is a flexible language that has hooks into just about every API offered on the
machines on which it runs.Because it was designed to be a forms-processing language
for HTML pages, PHP makes it easy to use form data sent to a script.Convenience
is a double-edged sword, however.The very features that let you quickly write
programs in PHP can open doors for those who would break into your systems.
It’s important to understand that PHP itself is neither secure nor insecure.The security
of your web applications is entirely determined by the code you write.For example,
take a script that opens a file whose name was passed as a form parameter.If
you don’t check the filename, the user can give a URL, an absolute pathname, or
even a relative path to back out of the application data directory and into a personal
or system directory.
This chapter looks at several common issues that can lead to insecure scripts, such as
filenames, file uploads, and the eval( ) function.Some problems are solved through
code (e.g., checking filenames before opening them), while others are solved through
changing PHP’s configuration (e.g., to permit access only to files in a particular
directory).
Global Variables and Form Data
One of the most fundamental things to consider when creating a secure system is
that any information you didn’t generate within the system should be regarded as
tainted.You should either untaint this data before using it—that is, ensure that
there’s nothing malicious in it—or limit what you do with it.
In PHP, however, it’s not always easy to tell whether a variable is tainted.When
register_globals is enabled in the php.ini file, PHP automatically creates variables
from form parameters and cookies.Poorly written programs assume that their variables
have values only when the variables are explicitly assigned values in the program
code. With register_globals, this assumption is false.
This is the Title of the Book, eMatter Edition
Copyright © 2002 O’Reilly & Associates, Inc. All rights reserved.
285