Security and $_POST Q's

Beginner in need of answers

[BigDogUK]

Hey all. I'm new here (and pretty new to PHP) I've been working on writing my own little blogging engine for myself as a challenge. It's been going really well but I need to consider security a bit. (Any good tutorials, articles you can link me too would be great)

I've got three main questions:

1) Can $_POST be sent from domains other than the one the site is hosted on? I'm guessing "YES" so I'll need to make sure the person posting is a valid user by getting them to send a username and pwrd with the post? Because otherwise my PHP reads:

$title=$_POST['title'];
$cat=$_POST['cat'];
$content=$_POST['content'];

Which is sent from a form only accessible by admin but if anyone could create a similar form which posts to the correct url they could bypass this correct?

So something like this would be needed?

$user=$_POST['user'];
$pwrd=$_POST['pwrd'];
$title=$_POST['title'];
$cat=$_POST['cat'];
$content=$_POST['content'];
//Pseudo
if user == dbuser and pwrd==dbpwrd
THEN
Continue

2) My logging in system is gonna be using md5 hashed cookies.

Basically, there's a mysql table of users and passwords(md5) and the user logs in, this is checked against the table, if they exist, logs them in and creates a cookie containing the user/pwrd(md5). This cookie is then used to check if they're logged in when navigating the site. The cookie expires after a set time.

Anything majorly wrong there? Obviously nothing is 100% secure.

3) I'm correct in thinking that variables not associated with GET or POST cannot be changed externally in any way?

-------

I've made sure to filter all foreign data etc. to make sure people can't enter crazy javascript or anything.

Anything else I need to consider? Any pointers are very welcome.

Thanks

[edited by: coopster at 12:23 am (utc) on Oct. 17, 2005]
[edit reason] removed url per TOS [webmasterworld.com] [/edit]

[mcibor]

1. POST and GET can be modified externally, so always do validation
2. Be very careful with executing statements (exec, shell, etc)
3. Better than sending usr and pass via POST is validating the user
4. Use SESSION [php.net] - it's easier and better than using cookies
5. I try to store not simple md5($pass), but md5($user.".".$pass) - it will rarely be the same, even with identical passwords
6. All of the variables can be changed. The easiest is GET, then POST, then SERVER and the hardest to change is SESSION
7. Never use register_globals = on! - it's the most dangerous function!
8. Allow fopen may also pose danger
9. Use mysql_real_escape_string when putting data to database

There was a great post of jatar after he came from the security conference
[webmasterworld.com...]

There should be a security related issue in library [webmasterworld.com]
[webmasterworld.com...]

Hope this gets you started!
But remember, all code can be comprimised. It depends only on you how much work does it require

Best regards
Michal Cibor