PHP MySQL - Stilson.net

CHAPTER 13• WORKING WITH HTML FORMSwww.it-ebooks.info$sku = "50XCH67YU";$inventory = "50";exec("/usr/bin/inventory_manager ".$sku." ".$inventory);Now suppose the pastry chef has become deranged from an overabundance of oven fumes andattempts to destroy the web site by passing the following string in as the recommended quantity toreorder:50; rm -rf *This results in the following command being executed in exec():exec("/usr/bin/inventory_manager 50XCH67YU 50; rm -rf *");The inventory_manager application would indeed execute as intended but would be immediatelyfollowed by an attempt to recursively delete every file residing in the directory where the executing PHPscript resides.Cross-Site ScriptingThe previous scenario demonstrates just how easily valuable site files could be deleted should user datanot be filtered; however, it’s possible that damage from such an attack could be minimized by restoring arecent backup of the site and corresponding data. There’s another type of attack that is considerablymore difficult to recover from—because it involves the betrayal of users who have placed trust in thesecurity of your web site. Known as cross-site scripting, this attack involves the insertion of maliciouscode into a page frequented by other users (e.g., an online bulletin board). Merely visiting this page canresult in the transmission of data to a third party’s site, which could allow the attacker to later return andimpersonate the unwitting visitor. To demonstrate the severity of this situation, let’s configure anenvironment that welcomes such an attack.Suppose that an online clothing retailer offers registered customers the opportunity to discuss thelatest fashion trends in an electronic forum. In the company’s haste to bring the custom-built forumonline, it decided to skip sanitization of user input, figuring it could take care of such matters at a laterpoint in time. One unscrupulous customer attempts to retrieve the session keys (stored in cookies) ofother customers in order to subsequently enter their accounts. Believe it or not, this is done with just abit of HTML and JavaScript that can forward all forum visitors’ cookie data to a script residing on a thirdpartyserver. To see just how easy it is to retrieve cookie data, navigate to a popular web site such asYahoo! or Google and enter the following into the browser address bar:javascript:void(alert(document.cookie))You should see all of your cookie information for that site posted to a JavaScript alert windowsimilar to that shown in Figure 13-1.290