I just spent the last two weeks learning php and uploaded a script today onto a website that gets 15,000 UVs daily.
The inputs are only checkboxes on the form. (The script allows people to filter our pages based on the boxes they tick). There aren’t any fields in the form that allow people to type and submit what they’ve typed.
The MySQL password is in the php file that the form sends its data to. Is that safe? I read somewhere that you should put password in separate file outside root directory? Do you guys do this?
Since i’m new to php (and my site gets huge amounts of traffic) i have no idea if i’ve left a gapping hole in the settings or something that would allow someone to pwn my site. Or whether PHP is generally relatively secure as is even when coded/set up by a noob.
Are there any basic things to do to make the script more secure? Such as turning OFF error messages? Or anything?
BTW, i set the user up on MySQL so the user login the script is using has permission to run SELECT queries only, with all other permissions disabled. So thats been taken care of.
The inputs are only checkboxes on the form. (The script allows people to filter our pages based on the boxes they tick). There aren’t any fields in the form that allow people to type and submit what they’ve typed.
That’s half true. Scripts can send any POST data they want to your script. Consider the form you provide as being a “suggestion” as to what will get returned.
Even with a browser I can right click on your checkbox, Inspect Element, change the value to whatever string I want and submit the form in <10 seconds.
With checkboxes you only need to know if something was checked or not. So you can use isset($_POST[‘my_chk_name’]) and act on that (true or false value). The $_POST[‘my_chk_name’] value is irrelevant.
Putting passwords outside the web root can be more secure in the case of a server mis configuration where the PHP source is served to users instead of being executed by the server. Quite unlikely though.
You should not display raw PHP or SQL errors to users. Log them and display a more generic message to your visitors.
Thanks for those tips, and thinking of it as a “suggestion” is a good way to think of it and to prepare the script to handle things sent to it be a hacker. I am doing it as you mentioned using isset, but i don’t see how that is more secure? Is it just because any value they send will be irrelevant because true and false are all the script accepts?
I have several books on PHP. Is there a general section that covers error handling in most books? How do you log errors: is there an easy way? Ill do what you said and log them and display no specifics to the user. Thanks
If anyone else has anything else to add feel free…
Unchecked checkboxes send no value back to your script handler at all – they are absent from the $_POST (0r GET) arrays.
Therefore that existence of any value at all means they were checked.
if(isset($_POST['checkbox_1'])){
// checkbox_1 was set
}
This is way simpler to Filter against expectations than say, an email address - which not only has to be set, it has to contain a minimum/max amount of certain chars in a certain order.
Become familiar with the acronym FIEO (Filter Input, Escape Output) put some work into understanding the importance of it.