PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

374 Chapter 16 Web Application Security
For those situations where we would like to permit users to enter some HTML, such
as a message board where people might like to use characters to control font, color, and
style (bold or italicized), we will have to actually pick our way through the strings to
find those and not strip them out.
Code Organization
There are those who would argue that any file that is not directly accessible to the user
from the Internet should not find a place in the document root of the website. For
example, if the document root for our message board website is /home/httpd/messageboard/www,
we should place all our include files and any other files we write for the
site in some place such as /home/httpd/messageboard/code.Then, in our code, when
we want to include those files, we can write:
require_once('../code/user_object.php);
The reasons for this degree of caution come down to what happens when a malicious
user makes a request for a file that is not a .php or .html file. Many web servers will
default to dumping the contents of that file to the output stream.Thus, if we were to
keep user_object.php somewhere in the public document root, and the user were to
request it, the user might see a full dump of our code in the web browser.This would let
the user see the implementation, get at any intellectual property we might have in this
file, and potentially find exploits that we might have missed.
To fix this, we should be sure that the web server is configured to only allow the
request of .php and .html files and that requests for other types of files should return an
error from the server.
Similarly, any other files, such as password files, text files, configuration files, or special
directories, are likely best kept away from the public document root. Even if we think
we have our web server configured properly, we might have missed something, or if, in
the future, our web application is moved to a new server that is not properly configured,
we might be exposed to exploitation.
If we have allow_url_fopen enabled in our php.ini, then we could theoretically
include or require files from remote servers.This would be another possible point of
security failure in our application, and we would do well to avoid including files from
separate machines, especially those over which we do not have full control.We should
likewise not use user input when choosing which files to include or require, as bad input
here could also cause problems.
What Goes in Your Code
Many of the code snippets we have shown thus far for accessing databases have included
in the code the database name, username, and user password in plain text, as follows:
$conn = @new mysqli("localhost", "bob", "secret", "somedb");