PHP Security Pt 1

[MIDIS0NG]

Is there any difference between doing like you do:

"require_once("../connect.php"­)" and "include("../connect.php")"

and if so, what is the difference?

[derekbanas]

@MIDIS0NG require_once checks if the file has already been included, and if so, won't include it again

[yesanded]

This is very helpful. Thanks. I'm going to have to go over it a few hundred times as a noob, but I like your pacing. A lot of online tuts are painfully slow and repetitive.

[derekbanas]

@yesanded Thank you. That's why I make all of my videos quick. The slow tutorials always drove me mad as well :)

[ZagreosTheUndead]

@derekbanas Derek at 4:33 you said something was unsafe. What did you mean? I don't recall you saying anything about it in later videos. Were you referring to checking if the form was submitted and doing that way was unsafe? if so what's the safe way?

[derekbanas]

@ZagreosTheUndead Basing a submissions safety off of values in hidden fields isn't safe. I cover how to eliminate the need to do this in later tutorials. I create a unique token key that changes each time a user changes the page.

[ZagreosTheUndead]

@derekbanas I see, I must have over looked it. Thank you.

[therealnod]

This is complete and utter shit

[lordzzcabe]

Did you said this is not safe ? Why is not ?

[derekbanas]

@lordzzcabe I point out a bunch of security holes in PHP in this tutorial series. I then show you how to close them

[MikeEBrady]

Why can't you just hard code the host, username, and password into the mysql_connect function, instead of using constants? If you write mysql_connect('host','username­','password') how would a hacker be able to change the values?

[derekbanas]

@MikeEBrady You could and that is what I do whenever I don't plan to have many databases. Good point :)

[jakaradee]

hi again. sorry to ask again but seems like you are the best person to ask regarding security questions!

basically at a moment, im having trouble storing dangerous user input into my mysql tables before i make it pass the exit function. so for example. if (not pass) {insert into errortable error(worderror) values($worderror)} however, since i want to see the raw data , its dangerous to do that right? since its now prone to all the hacking method? so howdo i stor dangeruser input data safely

[derekbanas]

@jakaradee If you need to use data in anyway just use it in you php code on the server. It's safe to do anything on the server as long as their is no way to access that information using JavaScript.

[jakaradee]

hi again. sorry to ask again but seems like you are the best person to ask regarding security questions!

basically at a moment, im having trouble storing dangerous user input into my mysql tables before i make it pass the exit function. so for example. if (not pass) {insert into errortable error(worderror) values($worderror)} however, since i want to see the raw data , its dangerous to do that right? since its now prone to all the hacking method? so howdo i stor dangeruser input data safely?

[ethanmaher2010]

hi derek.great video.just wondering where should I store the regular expression cod e in the config file or in my index.php file? Thanks

[derekbanas]

@ethanmaher2010 You should always store security related functions in a hidden configuration file if you can. Sometimes I'm forced to cram functions into one file for these tutorials, but it's definitely best to break up the content.

[jakaradee]

1.is it still safe and possible to include those preg_ match functions in another function in configdb? so for example you have

function preg (_POST['value'],min,max,type) where min is minimum character max is maximum character and type is the type (e.g. email,address,general). if ok , it will go to escape_data otherwise it will exit

2. in GET,is using the above function and str_replace to replace dangerous regular expressions with a space instead ok?

[derekbanas]

@jakaradee Yes that is actually how I do it. I always separate my code into outside utility files. I just find it hard to work with numerous files in tutorials. You should definitely set everything up in the way you described

[Remi1115]

*Presses the Like button*

[derekbanas]

@Remi1115 I'm glad you liked it

[janebbdou06]

nice tutorial keep it up

[derekbanas]

@janebbdou06 I'm glad you liked it. I did many more as I dove deeper into the hacker underground

[AtrianArk]

Hmm, just curious couldn't you use a .ini file outside the main directory of the website and then using a class parse that file to get your important information, especially if you do need to change the data further down the lines? If this makes sense at all.

[derekbanas]

@AtrianArk Yes you could hard wire the database and then eliminate the need to have the database access file all together. That would actually be best for security and it is what I normally do in the real world.

[sie85]

The best short explanation of regex if have seen so far. Just watched this first part. I'm developing my own CMS in PHP and am particularly interested in session security since there's an admin panel which allows users to maintain there website.

Sorry for possible bad English (I'm dutch)

[derekbanas]

@sie85 I cover session security in my web design and programmin tutorial pt 20 - 24. Glad you like the videos. Your English is great. Mine isn't perfect either because I'm from the u.s. ;)

[pioneerx01]

I can not wait for more PHP / MySQL security tutorials. Thank you for all your work

[derekbanas]

@pioneerx01 More is coming. I'll start with the basics being SQL injection and move on to all of the other nasty techniques and how to stop them.