Phoenix Network Forums

I have created I membership system in php, but I dont know anything about web security. So how do I secure my scripts? What are the main things I should think about to be safe from hackers?

If it uses MySQL (or any other database really), the main danger would be SQL-injections

Yeah, i'm using mysql, but my host automatically turns all ' and " into \' and \" . So 'im not worried about sql injections. Or should I?

how do you store passwords? it's vital not store passwords in your database...

in the signup section, use something like this:

Code: Select all

$hashedpassword = md5($password);
mysql_query("insert into users(name, password, ...) values ("$name", "$hashedpassword", "...");


in the login, test if md5(entered_password) is equal that hash you stored in your database... so if someone breaks into your account or database (s)he cannot take all the passwords of your users...

another tip: the cookies. when you use something like this:

Code: Select all

setcookie("user", "$userid"....);


you can expose your users to a cookie-stealing vulnerability... I use to send together an md5 hash of the ip address of the user, and compare the hash with the ip everytime the cookie is used...

other thing you can look is about gd-generated pictures for validation... this makes a lot harder to bruteforce your application... there's lots of samples out there, just make a search...

Use SHA1 instead of MD5.

Magic Quotes were intended to make scripts safer for beginners. However, the name ‘Magic Quotes’ is mystifying to beginners. Its existence also helps prevent beginners from learning why strings must be escaped in SQL.

Watch out for different types of "magic Quotes"
http://www.php.net/manual/en/security.magicquotes.php

Take a look at php secure pages.. this will give you an idea for the basics of user authentication, group membership and denial of access via php inclusions..

http://www.phpsecurepages.com/

I do'nt bother with addslashes etc, I use singlequotes in my PHP instead of normal double quotes so I break all possible injections

funman wrote:I do'nt bother with addslashes etc, I use singlequotes in my PHP instead of normal double quotes so I break all possible injections

And you break everything else you possibly can as well and we all give you shit about it

that was one time! Sheesh, you're so mean

I was just re-writing a script Tim had made, to fit with a site I made, and I of course made his doublequotes into my single quotes, and forgot to change them in 2 spots...and I kept whining afterwards about it not workign and he kept laughing and poking me

Depending on your site and transmission of sensitive information, ssl will add an extra layer of security. All a malicious person would have to do is use some type of sniffer to grab unencrypted info sent from a form and they could get the info that is passed from a user to your site. Using ssl will encrypt the information and make the transmission much more secure. You will have to get a valid certificate so that browsers using OCSP, Online Certificate Status Protocol, can validate your site. Otherwise users will be warned that your site is possibly stealing info.

safety wrote:You will have to get a valid certificate so that browsers using OCSP, Online Certificate Status Protocol, can validate your site. Otherwise users will be warned that your site is possibly stealing info.

You can use self-signed certificates for SSL, but that's bad. Unfortunately this is what many sites do. SSL is nonsense until you have a certificate signed by a certificate authority. Otherwise even the encryption is worthless, because in internet, if the attacker is able to sniff your traffic, he's usually also able to manipulate it. He can use the man in the middle attack then.

I protect password this way: i store passwords into a file, which is crypted by md5 etc, the file is in directory, which is protected by using htaccess.

I don't know lots of about mysql, because my host doesn't offer it.

EDIT: oh, sorry, i just wrote about protecting information. i am talking no-sense

Extreme_ wrote:I protect password this way: i store passwords into a file, which is crypted by md5 etc, the file is in directory, which is protected by using htaccess.

Either you didn't express yourself correctly, or you're talking non-sense. MD5 is not a cipher. Anyway, why do you store such files in directories accessible from the web at all? Remember, you're talking about password protection.

i made a membeship system, well, users mst login to my online game. just store the encypted password in a cookie.

when a user logs into a page, store their usename in the cookie

so then on the protected pages, you can use

Code: Select all

<?

if ($Username=="") { Header ("location: loggedoutpage.php"): }



so if the username is blank (or they have never logged in in the 1st place) they will be redirected to a none logged in page.

oops, i for got to close php!

Code: Select all


?>



hehe, its small errors like that that cause you awful problems(unless your server reveals the line where the error is)