7
votes
1answer
129 views

Securely sending data from shared hosted PHP script to local MSSQL

I'm trying to add data from a webhook (from a web cart) to a local Microsoft SQL Server. It seems like the best route for me is to use a PHP script to listen for new data (POST as json), parse it, ...
0
votes
1answer
115 views

What is the proper way to extract and pass parameters to call javascript functionality from my PHP page?

This is my situation: I have a search results page in PHP where most of the logic resides in a javascript file in order to avoid refreshing the page every time an action is performed. The first thing ...
-1
votes
1answer
110 views

Prevent 3D model from being copied [closed]

So I have been messing around with thingiview since I wanted to have a 3D viewer for the models on my site. It works great and everything except one problem. It's nothing wrong with thingiview, it is ...
-2
votes
2answers
188 views

Securing PHP source code from illegal copy [closed]

my IT boss asks what is the best way to secure the PHP source code against illegal copy of the code once it is deployed to clients. Is there a PHP compiler that will make the final codes unreadable? ...
13
votes
4answers
813 views

What to do when your company doesn't encrypt passwords

Background I'm been contracted to help a company maintain their server. I work on some minor PHP projects but also look over performance issues and recently, scan logs for hackers. These guys have ...
3
votes
3answers
377 views

Shared hosting for a PHP application

I was reading Essential PHP Security and chapter 8 talks about problems with hosting your PHP app in a shared hosting environment. Some of the problems he mentions are: - Exposed source code and ...
4
votes
1answer
396 views

Is a PHP file secure enough on a GoDaddy Server to hard code an AES salt into the file?

So I am creating a web api for an app I am making. The data is sanitized before it is sent to my web api and then encrypted before it is stored in my MySql server. The phone app sanitizes then ...
1
vote
5answers
1k views

Building a web app with encrypted MySQL database entries?

I have some experience in building PHP based websites with MySQL access, storing encrypted user details, but all other fields being plain text. My most recent project will require sensitive data to be ...
6
votes
3answers
230 views

How will writing the transaction part in Java benefit the security of the application, when all other parts are being written in PHP?

A friend of mine while working on a PHP application asked me to write one part of the application in Java. The part that involved transactions. He said it will be better to write this portion in Java. ...
0
votes
1answer
115 views

Storing escaped mysqli characters in database but outputting them correctly with htmlspecialchars()

I have a database sanitizing function that I use when the user enters some data into my website. I escaping the mysqli characters with mysqli_real_escape_string(), but I wish to also output the ...
106
votes
7answers
8k views

You're hired to fix a small bug for a security-intensive site. Looking at the code, it's filled with security holes. What do you do?

I've been hired by someone to do some small work on a site. It's a site for a large company. It contains very sensitive data, so security is very important. Upon analyzing the code, I've noticed it's ...
3
votes
2answers
942 views

I need advice developing a sensitive data transfer/storage/encryption system

I got closed on SO and told to post this here as it's about general application design as opposed to specific code. Intro I'm currently working on a project which involves the daily extraction of ...
3
votes
1answer
202 views

Building dedicated codepad in PHP

I am author of growing framework, which is focused around User Interface building in PHP. Essential requirements for the up-coming website redesign is ability to run code examples. I am willing to ...
2
votes
2answers
292 views

Is having sensitive data in a PHP script secure?

I've heard that PHP is somewhat secure because Apache won't allow the download of raw PHP. Is this reliable, though? For example, if you wanted to password protect something, but didn't want to create ...
0
votes
2answers
692 views

Is using dirname(__FILE__) a good practice?

Looking at the code of Joomla I see that in the first line of the index, it defines the base path of installation with dirname(__FILE__). Is this a possible risk for the site? If a non controlled ...
2
votes
1answer
214 views

Does the deprecation of mysql_* functions in PHP carry over to other Databases(MSSQL)?

I'm not talking about MySQL, I'm talking about Microsoft SQL Server I've been aware of PDO for quite some time now, standard mysql functions are dangerous and should be avoided. ...
4
votes
1answer
314 views

CSRF Protection with codeigniter

I have very little knowledge in application security. I have often seen to protect your application from csrf attacks developers use tokens and pass these tokens with request to validate. I want to ...
0
votes
5answers
631 views

Standards & compliances for secure web application development?

I am working with developers right now that write code the way they want and when i tell them to do it other way they respond that its just matter of preference how to do it and they have their way ...
2
votes
2answers
537 views

Provide a URL to a CouchDB document attachment without giving the username/password?

I posted this question on DBA, but it got closed and was never reopened even after I rewrote the whole thing to be more specific. I think its more appropriate for programmers anyway :) Background ...
0
votes
3answers
334 views

API access question

FIRST, THE SCENARIO We have an internal system that is effectively split into 2 very separate parts across 2 sub-domains, our back-end administrative system for internal access only we will call this ...
1
vote
1answer
260 views

Is there somewhere I can post code used to hack my site? [closed]

I left a bit of a door open recently on my site. Someone tried to post PHP code to a CMS page editing module, but it wasn't executed. I have this code and was wondering if there is somewhere I should ...
1
vote
2answers
534 views

How to do a login page for third party service without letting them sign on?

We have a unique situation (at least for me, first time seeing this). We have a web form where accountants can fill in requests and that part is taken care of. But after their login we redirect them ...
2
votes
4answers
762 views

Advice on making sure e-commerce site is secure using PHP and MySQL

Like the title says, I would like some advice from knowledgable web developers on figuring out security issues for my e-commerce site. I am designing the database as well as the code that ...
1
vote
2answers
918 views

Are sessions secure for captcha on failed login?

I don't like writing open-ended questions but I have a quick security question. I have a PHP login script that shows a CAPTCHA on the third failed login attempts. The way I'm counting failed logins is ...
2
votes
2answers
551 views

which input sanitization function is better?

apparently, some of our websites have been hacked by a hack bot. The reason: bad input sanitzation. Our boss is giving us this file to put on all our servers to secure them: ...
2
votes
2answers
620 views

multi-language system and security with php

Firstly sorry for my English. I'm coding new site. İt's like StackExchange, a social site and a blog. Whatever, I try to create multilanguage, however I can't decide how to do it. I have to use ...
17
votes
5answers
6k views

What best practices should be employed in a PHP login script?

I am wanting to re-write my login scripts for clients websites to make them more secure. I want to know what best practices I can implement into this. Password protected control panels are in their ...
14
votes
10answers
3k views

What attributes of PHP make it insecure? [closed]

It's well known and discussed that PHP has a poor history with relation to security. Is it not a secure language, or are there other reasons for this (such as developer error)? If PHP is truly ...
13
votes
7answers
1k views

stackoverflow induced passivity - how to cope?

After not really working on my pet project for a while, I discovered Stackoverflow and upon perusing it more intensely I was quite amazed. I'm a bit of a perfectionist, so when I found eye-openers ...