Forum Moderators: coopster
When the login page filters out invalid entries, I need to protect against malicious scripts but I dont know what sort of things I should be protecting against. Can anyone suggest some security measures, I have already protected against blank fields.
PHP User Authentication and Passwords [webmasterworld.com]
SQL Injection - What measures Should be Taken Against [webmasterworld.com]
PHP Security [webmasterworld.com]
I still do have a lot of questions and will probably want to have people check my scripts just to make sure im covering every possibility.
Should the form, filter and validator be all on the one page? Or should the form be on one page with the filter and validator on another? I ask this because in one of your posts you noted:
remember I could grab the action from your form, view source to get the form element names and throw together a quick curl script to submit the form.I could probably figure out what is and isn't validated in a few hundred iterations, shouldn't take more than a minute or two.
>> Or should the form be on one page with the filter and validator on another
this is the way it should be
I dont like things that submit to self, bad idea, lots of issues, just doesnt work
>> still do have a lot of questions
and well you should. I still have lots of questions, I think that's what makes us better and better.
the moment we are convinced we know everything is the moment we know nothing ;)
// initialize a session
session_start();// validate form data
if (isset($_POST['submit']) and $_POST['submit'] == 'Login') {
$_SESSION['submit'] = $_POST['submit'];
}
else if {isset($_POST['submit']) and $_POST['submit']!= 'Login')
$_SESSION['submit'] = $_POST['submit'];
header('Location: login.htm');
}
$_POST['user'] = trim($_POST['user']);
if (isset($_POST['user']) and!empty($_POST['user'])) {
$_SESSION['user'] = $_POST['user'];
}
$_POST['pass'] = trim($_POST['pass']);
if (isset($_POST['pass']) and!empty($_POST['pass'])) {
$_SESSION['pass'] = $_POST['pass'];
}
if (!isset($_SESSION['submit']) or!isset($_SESSION['user']) or!isset($_SESSION['pass'])) {
header('Location: login.htm');
}
<%
<?
<script
http:
hta
ftp:
file:
<meta
<link
<!--#
yes you do, I dont know of any free certs
You don't necessarily need https, it all depends on what you are protecting
What I am concerned about is the fact that I can execute scripts in the value attributes of my form input fields. If I can do that, someone else can enter scripts directly into the input field its self. When I was making that message board, it got quite complicated. I was being told that I had to html encode the data and enclose it in pre tags, remove spaces, convert tags. Is that all really necessary or is there a simpler way of taking care of malicious scripts and still allowing users to apply basic html styles and use symbols to make their name look better?
let them use b, colour and a few others
ban the rest
this way you create "expected input" and can disallow anything else
I believe Any scripts entered into a form are executed first and then the resulting values are stored in the variables. I think this happens on the server side, so javascript could be used to police what they type in on the users side but it would be a waste of time because they can just turn off javascript.
I only need to filter their input when I use it as output. Since I am just going to compair the input against the database values, there is no risk there.
Would addslashes be sufficient when outputting their input to a database? Or is there filtering to be done first?
Filtering is >>>>>ALWAYS<<<<< needed! Never assume that the only person that is going to use your scripts is the owner.
If the info submitted by the user is only to contain letters, confirm it only contains letters and if not, show them an error and let them fix it. I use somethig along the lines of:
if(($username!= "") && (!LettersAndNumbersOnly($username)))NOTE: the above function is for letters, numbers and spaces.
{
echo "ERROR: Username contains invalid characters.";
}function LettersAndNumbersOnly($string)
{
$eregi = eregi_replace("([A-Za-z0-9 ]+)","",$string);
if(empty($eregi))
{
return true;
}
else
{
return false;
}
}
Like I said, it is my opinion and seems to be the opinion of the majority of coders.
Hope it helps.
Regards,
IamStang
How can it really be exploited?
eg:
$username = addslashes($_POST['username']);
$userpass = addslashes($_POST['password']);
$userpass = md5($password); $query = "select * from usertable where username='$username' and password='$password'";
$result = mysqli_query($connection, $query);
if (mysqli_num_rows($result)!= 1) {
$error = "Login failed";
}
