PHP apps: Security's Low-Hanging Fruit

PHP apps: Security's Low-Hanging Fruit
Kelly Martin, 2007-01-08

PHP has become the most popular application language on the web, but common security mistakes by developers are giving PHP a bad name. Here's how PHP coding errors have become the new low-hanging fruit for attackers, contributing to the phishing problems on the web.

Expand all | Post comment

PHP apps: Security's Low-Hanging Fruit 2007-01-09
ninjah (1 replies)

Re: PHP apps: Security's Low-Hanging Fruit 2007-01-11
rdivilbiss

PHP apps: Security's Low-Hanging Fruit 2007-01-09
Anonymous

PHP apps: Security's Low-Hanging Fruit 2007-01-09
Anonymous (2 replies)

Re: PHP apps: Security's Low-Hanging Fruit 2007-01-10
Anonymous

Re: PHP apps: Security's Low-Hanging Fruit 2007-01-11
Josef Meixner

Then why do 'include' and 'require' even take URIs? Can you think of any valid use which is not a security hole? So why not take it out, the apps which break are probably insecure in any case.

If that ability is really needed, then why not add 'remote_include' and 'remote_require'. That way the programmer can express that he really means it. Also why does the PHP help page on include (http://de3.php.net/manual/en/function.include.php) not contain a warning about the very popular include($_GET['path']); with a very clear text about why it is unsecure and how to do it properly.

To continue on your example: if a gun regularily harms its user, will the manufacturer not make sure it doesn't happen again?

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/427/34257#34257

Don't forget basic file system security 2007-01-09
Void (1 replies)

Re: Don't forget basic file system security 2007-11-03
Catalin Hulea

PHP apps: Security's Low-Hanging Fruit 2007-01-10
andyT

PHP apps: Security's Low-Hanging Fruit 2007-01-11
Anonymous (2 replies)

Re: PHP apps: Security's Low-Hanging Fruit 2007-01-11
Anonymous

Re: PHP apps: Security's Low-Hanging Fruit 2007-11-03
Catalin Hulea

PHP apps: Security's Low-Hanging Fruit 2007-01-11
Anonymous

PHP apps: Security's Low-Hanging Fruit 2007-01-12
Kevin Waterson

Don't blame PHP, it's the newbies 2007-11-03
Catalin Hulea

PHP apps: Security's Low-Hanging Fruit 2008-02-12
Anonymous