script security help

Use includes for all vital / global information, use ip validation for user logins, restrict all form inputs to numbers and characters, restrict errors server / database errors to not return identifying information such as table names.

on any login screens .. make sure the user can only type in letters or numbers into the textfields. A simple apostraphe ' will break the code string your using and past that you can guess what is possible.

If your working with a database, escape all of the database characters that could cause problems. For example, say you have a user log in accepting a username and password to get access to a special client area:

'

Since "" does indeed equal "" (blank string equals blank string), the query would return with rows and the "hax0r" would have access. A solution to this would be to escape your data you stick into your query. For example, using the addslashes() function for PHP. This would make the query
[INDENT]SELECT * FROM users WHERE user='hax0r\' or \'\'=\'' AND pass='hax0r\' or \'\'=\''[/INDENT]
Which would not return any rows.

Another thing would be to double check where you're values are coming from. There are a couple of places that data could come from, amongst them are: sessions, cookies, get, post. So if you have something like this:

The user could simply go
[INDENT]script.php?access=yes[/INDENT]
So if you make sure your getting the data from where you want to be getting it from, you should be alrignt.

In that example, the access variable is set at the start of the script, so the same exploitation could not be used.

http://www.sitepoint.com/article/write-secure-scripts-php-4-2

Simply put, filter your data. Before you use a variable from get/post/cookie/etc, check to make sure there are no invalid (or only valid) characters (im assuming strings).

Examples:

Any variables used in file paths for include() or require() calls should never contain dot dot slash (../ or ..\).

Variables printed to the html source should first be cleansed of any Cross Site Scripting (ex: javascript code).

Any variables inserted into a database should be escaped (to prevent breaking the sql code).

Any variables put through an eval() call should be *very* closely scrutinized.

I was wondering that too. "dot dot slash" simply means "up one directory"...

Ah, I didn't know you were talking about variable includes. I see what you mean now.

Whenever possible I include files only in the same directory, or secure files in a non-browsable web directory accessed through a path, not a variable.

i.e. include('this/is/the/actual/path/to/the/file.php');

Where the browser viewable files are somewhere else like 'this/is/the/actual/path/to/www/files/'.

That way the important information isn't browsable (in case of php failure, errors, et cetera).