Results 1 to 9 of 9

Thread: php security

  1. #1
    Join Date
    Mar 2004

    php security

    I am attempting to build a secure login system. Upon successful login each user (4 user levels) will be directed to the specific area of the site. I have built most of the forms these users will be working with. The information on this site is sensitive, so I have been researching MD5 encryption, sessions, and cookies. I will need to track user actions throughout the site. Basically when user add/modify/update information in the database, I want to know who did it and when they did it. I am hoping this can be accomplished using sessions with php and mysql. The system should also keep record of every time a person logs in. I have downloaded scripts, searched the web, and canít seem to understand the correct and most secure way to make this happen. Please advise me on the proper way to accomplish this, or direct me to a solid tutorial.

  2. #2
    most secure way, well there are some features you could add to make it more secure.

    Store their password with md5 encryption, and store a secondary password also. Make it so that if theyw ant to update their profile they need the secondary password.

    In the session store their IP address and amek sure it matches on each page, and if not log them out. This will stop people hijacking the sessions.

    Keep all the pages on SSL, wont help much but every little bit counts.

    Make sure the server you are on is secure to prevnt from other nasties.

    Force a password change every 30 - 90 days to keep the details fresh.

    Make sure that before you do a mysql query on any user submitted infomation that you validae it first to stop people trying to manipulate the mysql query.

    Personally myself, i use http auth for logins (like .htaccess does) but i do it through php.This helps as i dont need to store sessions as much to allow users access.

    I'm not a security expert, so there are probably more things that you can do. but what i have mentioned above will give you a good start.
    Note to self: Add something funny!
    Search is your friend!

  3. #3
    Join Date
    Jul 2003
    Well, the first thing you need to understand is that MD5 is not encryption, but a hashing algorithm.

    You also have to balance security for the application. Depending on the sensitivity of the information, you may need more or less "paranoid" security. You don't want to overdo the security.

    By default, sessions in PHP are not very secure. For example, the default location for session files is /tmp -- which is generally open on systems. Which means that anyone that has access to the system can read your session files (or delete them).

    What you should start off with is take to take the proper security measures againts the most common types of flaws in not only PHP, but many server-side scripts (see this guide).

    Second, you should list down the different security roles (domains) that the program should have to deal with. For example, what level of security will each user role have? Plan this out on paper first.

    In addition, write your own session handlers, or at a minimum, move the session store location to somewhere secure.

    Also -- this is a very common problem that I see in 99% of the scripts -- only give the minimum permissions required to your database user that is being accessed by the script. For example, there is no need for the database user that PHP is using to have DROP permissions if all you are doing is printing a report from a table. If you give the minimum permissions, then if the script is compromised, there is some limit to the damage that a hacker can do using that script (atleast to your database).

    There are other measures that you can take, but like I mentioned earlier, it all depends on the value of security vs. data. Start with the guide I posted, and come back if you have other questions
    In order to understand recursion, one must first understand recursion.
    If you feel like it, you can read my blog
    Signal > Noise

  4. #4
    Join Date
    Nov 2003
    what i doing a lot is writing critical codes (database login infos) in a seperate php file, place it outside the webserver directory .. and then include it from the called php script.

    is this completely secure?

  5. #5
    easy answer no, because if they can still get to one script, they can still include everything.

    I dont belive that its possiable to make anything 100% secure. I think you have to think about rasing it, for example make sure folder permissions are set correctly. If its set at 777 does it NEED to be 777 or would say 755 do the job for you?

    To have it outside your web directory helps a little, but make sure that your scripts are the only ones that can access it.
    Note to self: Add something funny!
    Search is your friend!

  6. #6
    Join Date
    Jul 2002
    Manchester, UK
    If it is in a shared environment, it is almost impossible to make things 100% secure from other people who have access to that server. However things like phpsuexec and open_basedir go a long way to helping security.

  7. #7
    Join Date
    Jun 2004
    also, if it's a shared environment, watch out when setting permissions.
    use umask() with chmod()

  8. #8
    Join Date
    Oct 2002
    York, United Kingdom
    You can try connecting to the database via SSH Tunneling or using the SSL rather than just using standard HTTP Tunneling / Connection.

  9. #9



    Our Lampshade framework handles most of this for you. (If I had to code it for each project I've done, I'd be a wreck.) It uses SHA-1 instead of MD5 for a more secure hash, as well. There's a free version on our site for non-commercial use:

    Aaron Greenspan
    President & CEO, Think Computer Corporation

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts