PHP contains many levels of error reporting and it is a very useful addition in the developers tool kit. By reporting runtime errors, error reporting lets the developer know what problem has occured, the path name and file name of the script that has the error, the function name that has possibly caused the error and the line number on which the error occured. Should a malicious user succeed in causing an error on a site, all this information about the system is gained from the error output.

(more…)

This is rather basic, but still many scripts exist with file inclusion from GET. Too often scripts appear with the following type of line

Email header injection is a leading cause of SPAM on the internet and comes from a simple omission when accepting user input from forms. Failure to adequately strip out possible injection characters leaves the headers easy prey to SPAMMERS, and when a spammer uses a form to send tens of thousands of email around the world, it is that domain that will find its way onto black lists.

As an example, a simple contact form may have fields “name”, “from”, “subject” and “message”. Lets look at a simple HTML form

(more…)

The minimum checks on any variables coming from other sources is for type and length. These type of checks help to assure that the data that is being recieved is of a type and length that is expected. An example might be numeric value that is required. If the number needs to be between 1 and 10, and a user submits 999, then there is a possibility of causing an error or warning that is displayed in the browser. These warnings give information about the path of the script that caused the error and so, a malicious user, gains valuable information about the system for an attack.

(more…)

The PHP super globals array is a great tool for accessing various input globally from scripts. The $_SERVER super global array contains a very useful member $_SERVER['PHP_SELF']. This globally available, predefined variable provides the filename of the currently executing script. However, it is vulnerable to cross site scripting (XSS) attacks. On its own it works fine as this example shows.