Table of Contents for
Essential PHP Security
Close
Version ebook
/
Retour
Essential PHP Security
by Chris Shiflett
Published by O'Reilly Media, Inc., 2005
Cover
Essential PHP Security
Essential PHP Security
Foreword
Preface
1. Introduction
2. Forms and URLs
3. Databases and SQL
4. Sessions and Cookies
5. Includes
6. Files and Commands
7. Authentication and Authorization
8. Shared Hosting
A. Configuration Directives
B. Functions
C. Cryptography
About the Author
Index
About the Author
Colophon
Copyright
Essential PHP Security
Table of Contents
Foreword
Preface
What’s Inside
Style Conventions
Comments and Questions
Safari Enabled
Acknowledgments
1. Introduction
1.1. PHP Features
1.1.1. Register Globals
1.1.2. Error Reporting
1.2. Principles
1.2.1. Defense in Depth
1.2.2. Least Privilege
1.2.3. Simple Is Beautiful
1.2.4. Minimize Exposure
1.3. Practices
1.3.1. Balance Risk and Usability
1.3.2. Track Data
1.3.3. Filter Input
1.3.4. Escape Output
2. Forms and URLs
2.1. Forms and Data
2.2. Semantic URL Attacks
2.3. File Upload Attacks
2.4. Cross-Site Scripting
2.5. Cross-Site Request Forgeries
2.6. Spoofed Form Submissions
2.7. Spoofed HTTP Requests
3. Databases and SQL
3.1. Exposed Access Credentials
3.2. SQL Injection
3.3. Exposed Data
4. Sessions and Cookies
4.1. Cookie Theft
4.2. Exposed Session Data
4.3. Session Fixation
4.4. Session Hijacking
5. Includes
5.1. Exposed Source Code
5.2. Backdoor URLs
5.3. Filename Manipulation
5.4. Code Injection
6. Files and Commands
6.1. Traversing the Filesystem
6.2. Remote File Risks
6.3. Command Injection
7. Authentication and Authorization
7.1. Brute Force Attacks
7.2. Password Sniffing
7.3. Replay Attacks
7.4. Persistent Logins
8. Shared Hosting
8.1. Exposed Source Code
8.2. Exposed Session Data
8.3. Session Injection
8.4. Filesystem Browsing
8.5. Safe Mode
A. Configuration Directives
A.1. allow_url_fopen
A.2. disable_functions
A.3. display_errors
A.4. enable_dl
A.5. error_reporting
A.6. file_uploads
A.7. log_errors
A.8. magic_quotes_gpc
A.9. memory_limit
A.10. open_basedir
A.11. register_globals
A.12. safe_mode
B. Functions
B.1. eval()
B.2. exec()
B.3. file()
B.4. file_get_contents()
B.5. fopen()
B.6. include
B.7. passthru()
B.8. phpinfo()
B.9. popen()
B.10. preg_replace()
B.11. proc_open()
B.12. readfile()
B.13. require
B.14. shell_exec()
B.15. system()
C. Cryptography
C.1. Storing Passwords
C.2. Using mcrypt
C.3. Storing Credit Card Numbers
C.4. Encrypting Session Data
About the Author
Index
About the Author
Colophon
Copyright