PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

378 Chapter 16 Web Application Security
// names and phone nums are separated by , char
$namenum = split($lines, ',');
echo "Name: {$namenum[0]}, Phone #: {$namenum[1]}\n";
}
?>
If you ever allow user input to the command placed in back quotes, you are opening
yourselves to all sorts of security problems and will need to filter the input heavily to
ensure the safety of your system. At the very least, the escapeshellcmd function should
be used.To be certain, however, you might want to restrict the possible input even more.
Even worse, given that we normally want to run our web server and PHP in a context
with lower permissions (we will see more about this in following sections), we
might find ourselves having to grant it more permissions to execute some of these commands,
which could further compromise our security. Use of this operator in a production
environment is something to be approached with a great amount of caution.
The exec and system functions are very similar to the execution quotes operator,
except that they execute the command directly instead of executing it within a shell
environment and do not always return the full set of output that the execution quotes
return.They do share many of the same security concerns, and thus also come with the
same warnings.
Securing Your Web Server and PHP
In addition to worrying about code security, the installation and configuration of our
web server with PHP is also a large security concern. Much software that we install on
our computers and servers comes with configuration files and default feature sets
designed to show off the power and usefulness of the software. It assumes that we will
work on disabling those portions that are not needed and/or that are less secure than
may be needed.Tragically, many people do not think to do this, or do not take the time
to do it properly.
As part of our approach to dealing with security “holistically,” we want to be sure that
our web servers and PHP are indeed properly configured. Although we cannot give a
full presentation of how to secure each and every web server or extension in PHP you
might use, we can at least provide some key points to investigate and point you in the
correct direction for more advice and suggestions.
Keep Software Up-to-Date
One of the easiest ways to help the security of your system is to ensure that you are
always running the latest and most secure version of the software you are using. For