Re: [PHP] Up to date book on PHP security?

2011-11-11 Thread Alain Williams
On Fri, Nov 11, 2011 at 05:01:19PM -0600, Keith Purtell wrote: > As a PHP newbie, I was advised to get a book by Chris Shiflett titled > "Essential PHP Security." I looked at Amazon.com but the book appears to > be more than five years old. Should I get something more up to

[PHP] Up to date book on PHP security?

2011-11-11 Thread Keith Purtell
As a PHP newbie, I was advised to get a book by Chris Shiflett titled "Essential PHP Security." I looked at Amazon.com but the book appears to be more than five years old. Should I get something more up to date? - Keith -- PHP General Mailing List (http://www.php.net/) To unsubscr

Re: [PHP] PHP Security: Best Practices

2011-08-08 Thread Richard Quadling
On 8 August 2011 15:08, Jen Rasmussen wrote: > Hello all, > > > > I am currently researching security best practices/methods. Can anyone offer > any current resources/recommendations? > > My research thus far has included password hashing with salting/stretching, > session hash defaults, session m

Re: [PHP] PHP Security: Best Practices

2011-08-08 Thread Fredric L. Rice
> I am currently researching security best > practices/methods. Can anyone offer > any current resources/recommendations? That is a huge arena and the question can not be answered very well without describing what you are needing to protect. Security in debth depends upon what you are protecting a

RE: [PHP] PHP Security: Best Practices

2011-08-08 Thread Jen Rasmussen
Thanks, Andrew! I am unfortunately not even running 5.2..so that helps. Jen -Original Message- From: Andrew Ballard [mailto:aball...@gmail.com] Sent: Monday, August 08, 2011 9:57 AM To: j...@cetaceasound.com Cc: php-general@lists.php.net Subject: Re: [PHP] PHP Security: Best Practices

Re: [PHP] PHP Security: Best Practices

2011-08-08 Thread Andrew Ballard
On Mon, Aug 8, 2011 at 10:08 AM, Jen Rasmussen wrote: [snip] > > On a side note, PHP versions prior to 5.3+ do not allow to set the httponly > flag as a cookie parameter, is there any acceptable alternative for this? I believe that has been supported since 5.2.0. As for a workaround for versions

[PHP] PHP Security: Best Practices

2011-08-08 Thread Jen Rasmussen
Hello all, I am currently researching security best practices/methods. Can anyone offer any current resources/recommendations? My research thus far has included password hashing with salting/stretching, session hash defaults, session management & authentication, and prepared statements via PDO

RE: [PHP] Security Question

2011-04-09 Thread tedd
At 2:53 PM -0500 4/8/11, Jay Blanchard wrote: [snip] whats the best way to learn about security in php? [/snip] Study, study, study! Chris Shiflett is a recognized expert on PHP security - http://shiflett.org/ He has a great book on PHP Security - http://www.amazon.com/exec/obidos/ASIN

Re: [PHP] Security Question

2011-04-08 Thread Adam Richardson
On Fri, Apr 8, 2011 at 3:24 PM, nighthawk1256 wrote: > hey guys/girls, > > whats the best way to learn about security in php? Here are some relevant topics to consider: - Validate input (only accept what you're expecting, via GET, POST, and COOKIE, and don't try to fix an invalid value,

RE: [PHP] Security Question

2011-04-08 Thread Alex Nikitin
Best way to learn about security of something is to learn how to break it... On Apr 8, 2011 3:55 PM, "Jay Blanchard" wrote: > > [snip] > whats the best way to learn about security in php? > [/snip] > > Study, study, study! > > Chris Shiflett is a recogniz

RE: [PHP] Security Question

2011-04-08 Thread Jay Blanchard
[snip] whats the best way to learn about security in php? [/snip] Study, study, study! Chris Shiflett is a recognized expert on PHP security - http://shiflett.org/ He has a great book on PHP Security - http://www.amazon.com/exec/obidos/ASIN/059600656X/ref=nosim/chrisshiflet t-20 -- PHP

[PHP] Security Question

2011-04-08 Thread nighthawk1256
hey guys/girls, whats the best way to learn about security in php? -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP] [security] PHP has DoS vuln with large decimal points

2011-01-25 Thread Pierre Joye
hi, On Mon, Jan 17, 2011 at 5:21 AM, Tommy Pham wrote: > Thanks Dan.  I'll keep it in mind for the future.  For interested parties, > that's found in the official Windows 5.3.3 NTS VC9 build.  Works fine with > the current official 5.3.5 NTS VC9. 5.3.5 was released only to fix this exact bug :-

RE: [PHP] [security] PHP has DoS vuln with large decimal points

2011-01-16 Thread Tommy Pham
> -Original Message- > From: paras...@gmail.com [mailto:paras...@gmail.com] On Behalf Of > Daniel Brown > Sent: Sunday, January 16, 2011 7:00 PM > To: Tommy Pham > Cc: PHP General; PHP Internals List; secur...@php.net > Subject: Re: [PHP] [security] PHP has DoS vu

[PHP] Re: [PHP-DEV] Re: [PHP] [security] PHP has DoS vuln with large decimal points

2011-01-16 Thread Mike Robinson
On 2011-01-16, at 9:59 PM, Daniel Brown wrote: > On Sun, Jan 16, 2011 at 21:00, Tommy Pham wrote: >> >> Here are the results after some further tests for the same platform: >> >> * max float value: 1.7976931348623E+308 >> * min float value: 9.8813129168249E-324 << >> floatval('1.

RE: [PHP] [security] PHP has DoS vuln with large decimal points

2011-01-16 Thread Tommy Pham
> -Original Message- > From: Jim Lucas [mailto:li...@cmsws.com] > Sent: Sunday, January 16, 2011 6:54 PM > To: Tommy Pham > Cc: php-general@lists.php.net > Subject: Re: [PHP] [security] PHP has DoS vuln with large decimal points > > On 1/16/2011 4

Re: [PHP] [security] PHP has DoS vuln with large decimal points

2011-01-16 Thread Daniel Brown
On Sun, Jan 16, 2011 at 21:00, Tommy Pham wrote: > > Here are the results after some further tests for the same platform: > > * max float value: 1.7976931348623E+308 > * min float value:  9.8813129168249E-324  << > floatval('1.00e-323') weird ... > > PHP wil hang when the value

Re: [PHP] [security] PHP has DoS vuln with large decimal points

2011-01-16 Thread Jim Lucas
On 1/16/2011 4:18 PM, Tommy Pham wrote: >> -Original Message- >> From: Tommy Pham [mailto:tommy...@gmail.com] >> Sent: Thursday, January 06, 2011 5:49 PM >> To: 'Daevid Vincent' >> Cc: 'php-general@lists.php.net' >> Subject: RE: [PH

RE: [PHP] [security] PHP has DoS vuln with large decimal points

2011-01-16 Thread Tommy Pham
> -Original Message- > From: Tommy Pham [mailto:tommy...@gmail.com] > Sent: Sunday, January 16, 2011 4:18 PM > To: 'php-general@lists.php.net' > Subject: RE: [PHP] [security] PHP has DoS vuln with large decimal points > > > I found something really

RE: [PHP] [security] PHP has DoS vuln with large decimal points

2011-01-16 Thread Tommy Pham
> -Original Message- > From: Tommy Pham [mailto:tommy...@gmail.com] > Sent: Thursday, January 06, 2011 5:49 PM > To: 'Daevid Vincent' > Cc: 'php-general@lists.php.net' > Subject: RE: [PHP] [security] PHP has DoS vuln with large decimal points >

RE: [PHP] [security] PHP has DoS vuln with large decimal points

2011-01-06 Thread Tommy Pham
> -Original Message- > From: Daevid Vincent [mailto:dae...@daevid.com] > Sent: Wednesday, January 05, 2011 11:36 AM > To: php-general@lists.php.net > Subject: [PHP] [security] PHP has DoS vuln with large decimal points > > The error in the way floating-point and dou

[PHP] [security] PHP has DoS vuln with large decimal points

2011-01-05 Thread Daevid Vincent
The error in the way floating-point and double-precision numbers are handled sends 32-bit systems running Linux, Windows, and FreeBSD into an infinite loop that consumes 100 percent of their CPU's resources. Developers are still investigating, but they say the bug appears to affect versions 5.2 and

Re: [PHP] Security Issue

2010-06-08 Thread Michael Shadle
one good reason to ever enable this, it would be a security issue no matter how you slice it... -Original Message- From: Igor Escobar [mailto:titiolin...@gmail.com] Sent: Tuesday, June 08, 2010 10:11 AM To: richg...@gmail.com Cc: Subject: Re: [PHP] Security Issue Hey Richard, I'll

RE: [PHP] Security Issue

2010-06-08 Thread David Stoltz
Igor Escobar [mailto:titiolin...@gmail.com] Sent: Tuesday, June 08, 2010 10:11 AM To: richg...@gmail.com Cc: Subject: Re: [PHP] Security Issue Hey Richard, I'll find more about this parameter allow_url_include, thank you! Regards, Igor Escobar Systems Analyst & Interface De

Re: [PHP] Security Issue

2010-06-08 Thread Igor Escobar
Hey Richard, I'll find more about this parameter allow_url_include, thank you! Regards, Igor Escobar Systems Analyst & Interface Designer + http://blog.igorescobar.com + http://www.igorescobar.com + @igorescobar (twitter) On Mon, Jun 7, 2010 at 5:26 PM, richard gray wrote: > On 07/06/201

Re: [PHP] Security Issue

2010-06-07 Thread Raymond Irving
Are you running the latest version of PHP? If not you should check for PHP vulnerabilities for the version that you have installed. You should also check your OS and web server software for security holes. On Mon, Jun 7, 2010 at 7:54 AM, Igor Escobar wrote: > Hi Folks! > > The portal for which

Re: [PHP] Security Issue

2010-06-07 Thread richard gray
On 07/06/2010 20:00, Igor Escobar wrote: PHP Injection is the technical name given to a security hole in PHP applications. When this gap there is a hacker can do with an external code that is interpreted as an inner code as if the code included was more a part of the script. // my code... // my

RE: [PHP] Security Issue

2010-06-07 Thread Bob McConnell
From: Ashley Sheridan > On Mon, 2010-06-07 at 15:00 -0300, Igor Escobar wrote: > >> PHP Injection is the technical name given to a security hole in PHP >> applications. When this gap there is a hacker can do with an external >> code that is interpreted as an inner code as if the code included was

Re: [PHP] Security Issue

2010-06-07 Thread Ashley Sheridan
On Mon, 2010-06-07 at 15:00 -0300, Igor Escobar wrote: > PHP Injection is the technical name given to a security hole in PHP > applications. When this gap there is a hacker can do with an external > code that is interpreted as an inner code as if the code included was > more a part of the script.

Re: [PHP] Security Issue

2010-06-07 Thread Michael Shadle
I disagree and this kind of approach could be appropriate if you walk your input globals and apply some sanity checks and appropriate filtering you could fix the issue. On Jun 7, 2010, at 10:52 AM, Igor Escobar wrote: I think we're getting off topic here folks... Regards, Igor Escobar S

Re: [PHP] Security Issue

2010-06-07 Thread Igor Escobar
I'm totally agree with you Ash, I came up here to ask you guys some for light. Anything to well me to track that M%$#% F#$CK#$# and discover from where he's attacking. Regards, Igor Escobar Systems Analyst & Interface Designer + http://blog.igorescobar.com + http://www.igorescobar.com + @igores

Re: [PHP] Security Issue

2010-06-07 Thread Igor Escobar
PHP Injection is the technical name given to a security hole in PHP applications. When this gap there is a hacker can do with an external code that is interpreted as an inner code as if the code included was more a part of the script. // my code... // my code... include ('http:///externalhacks

Re: [PHP] Security Issue

2010-06-07 Thread Michael Shadle
Because that only typecasts it. It's safe but it isn't what the user actually entered. This way I can actually determine if the user put in "123abc" and reject it, not accept it and keep the "123" silently for example. Same with floats. You may or may not consider a negative number acceptab

Re: [PHP] Security Issue

2010-06-07 Thread Michael Shadle
You could do generic things to modify the $_GET and other superglobal arrays. For example if you wanted to implement magic quote yourself have a recursive function (I'd paste one but I'm on my phone) but something akin to this: $_GET = your_function_name($_GET); An idea for you might be to

Re: [PHP] Security Issue

2010-06-07 Thread Igor Escobar
I think we're getting off topic here folks... Regards, Igor Escobar Systems Analyst & Interface Designer + http://blog.igorescobar.com + http://www.igorescobar.com + @igorescobar (twitter) On Mon, Jun 7, 2010 at 2:51 PM, Ashley Sheridan wrote: > On Mon, 2010-06-07 at 10:48 -0700, Michael

Re: [PHP] Security Issue

2010-06-07 Thread Ashley Sheridan
On Mon, 2010-06-07 at 10:48 -0700, Michael Shadle wrote: > Oh yeah. I do more than just intval() I make sure they didn't feed me > anything BUT numeric text first. I do sanity check before type > forcing :) > > I use garbage in garbage out. So I take what is given to me and yes I > escape i

Re: [PHP] Security Issue

2010-06-07 Thread Ashley Sheridan
On Mon, 2010-06-07 at 14:42 -0300, Igor Escobar wrote: > It's not a SQL Injection or XSS problem, Michael. > > It's a PHP Injection problem. I know how fix that but the web site is very > very huge, have lots and lots of partners and i'm have a bug difficult do > identify the focus of the problem

Re: [PHP] Security Issue

2010-06-07 Thread Michael Shadle
Oh yeah. I do more than just intval() I make sure they didn't feed me anything BUT numeric text first. I do sanity check before type forcing :) I use garbage in garbage out. So I take what is given to me and yes I escape if before the db of course as well, and then encode on output. On Ju

Re: [PHP] Security Issue

2010-06-07 Thread Ashley Sheridan
On Mon, 2010-06-07 at 10:38 -0700, Michael Shadle wrote: > It's not that bad. > > Use filter functions and sanity checks for input. > > Use htmlspecialchars() basically on output. > > That should take care of basically everything. > > On Jun 7, 2010, at 6:16 AM, Igor Escobar wrote: > > > Thi

Re: [PHP] Security Issue

2010-06-07 Thread Igor Escobar
It's not a SQL Injection or XSS problem, Michael. It's a PHP Injection problem. I know how fix that but the web site is very very huge, have lots and lots of partners and i'm have a bug difficult do identify the focus of the problem. Got it? Regards, Igor Escobar Systems Analyst & Interface Des

Re: [PHP] Security Issue

2010-06-07 Thread Michael Shadle
It's not that bad. Use filter functions and sanity checks for input. Use htmlspecialchars() basically on output. That should take care of basically everything. On Jun 7, 2010, at 6:16 AM, Igor Escobar wrote: This was my fear. Regards, Igor Escobar Systems Analyst & Interface Designer + ht

RE: [PHP] Security Issue

2010-06-07 Thread Bob McConnell
-Original Message- From: Igor Escobar [mailto:titiolin...@gmail.com] Sent: Monday, June 07, 2010 9:21 AM To: Phpster Cc: Subject: Re: [PHP] Security Issue I do not believe he is doing so through forms but PHP Injection. We have already met one of the files that he used to make the concatenation of

Re: [PHP] Security Issue

2010-06-07 Thread Igor Escobar
I do not believe he is doing so through forms but PHP Injection. We have already met one of the files that he used to make the concatenation of the cache files. Need to know if there is a tool, anything, that we can install on the server and identify the hacker more easily because the manual labor

Re: [PHP] Security Issue

2010-06-07 Thread Igor Escobar
This was my fear. Regards, Igor Escobar Systems Analyst & Interface Designer + http://blog.igorescobar.com + http://www.igorescobar.com + @igorescobar (twitter) On Mon, Jun 7, 2010 at 10:05 AM, Peter Lind wrote: > On 7 June 2010 14:54, Igor Escobar wrote: > > Hi Folks! > > > > The portal

Re: [PHP] Security Issue

2010-06-07 Thread Igor Escobar
Hi Ashley! Thanks for helping us! OK, first thing, check all the file access logs, i.e. FTP logs, etc, just to make sure that it's not a case of a compromised password. There's a well-known issue with people who use FileZilla on Windows systems that allows passwords to be easily stolen. * * *We'v

Re: [PHP] Security Issue

2010-06-07 Thread Phpster
On Jun 7, 2010, at 8:54 AM, Igor Escobar wrote: Hi Folks! The portal for which I work is suffering constant attacks that I feel that is PHP Injection. Somehow the hacker is getting to change the cache files that our system generates. Concatenating the HTML file with another that have a

Re: [PHP] Security Issue

2010-06-07 Thread Peter Lind
On 7 June 2010 14:54, Igor Escobar wrote: > Hi Folks! > > The portal for which I work is suffering constant attacks that I feel that > is PHP Injection. Somehow the hacker is getting to change the cache files > that our system generates. Concatenating the HTML file with another that > have an ifra

Re: [PHP] Security Issue

2010-06-07 Thread Ashley Sheridan
On Mon, 2010-06-07 at 09:54 -0300, Igor Escobar wrote: > Hi Folks! > > The portal for which I work is suffering constant attacks that I feel that > is PHP Injection. Somehow the hacker is getting to change the cache files > that our system generates. Concatenating the HTML file with another that

[PHP] Security Issue

2010-06-07 Thread Igor Escobar
Hi Folks! The portal for which I work is suffering constant attacks that I feel that is PHP Injection. Somehow the hacker is getting to change the cache files that our system generates. Concatenating the HTML file with another that have an iframe to a malicious JAR file. Do you have any suggestion

RE: [PHP] Automatic PHP Security tool

2010-05-20 Thread Bob McConnell
From: Juan Rodriguez Monti > I would like to know if there´s some App that run automatic test > against a PHP Application to detect security issues, potential bugs > and so on. > > I know this kind of applications exists for other fields of IT, but I > don´t know if there are some application or

Re: [PHP] Security/Development Question

2010-04-29 Thread tedd
At 4:54 PM -0400 4/28/10, David Stoltz wrote: My concern is passing SQL queries in this way is not best practice - am I wrong? Please let me know how you would react to this? David : First, you are not wrong. Second, that's exactly the type of security risk you want to protect yourself from.

Re: [PHP] Security/Development Question

2010-04-28 Thread Karl DeSaulniers
rg Yahoo! messenger: andre.polykanine; ICQ: 191749952 Twitter: m_elensule - Original message - From: David Stoltz To: php-general@lists.php.net Date: Wednesday, April 28, 2010, 11:54:56 PM Subject: [PHP] Security/Development Question Hi folks, This isn't really a PHP question pe

Re: [PHP] Security/Development Question

2010-04-28 Thread Programming Guides
t; Andre > Skype: Francophile; Wlm&MSN: arthaelon @ yandex.ru; Jabber: arthaelon @ > jabber.org > Yahoo! messenger: andre.polykanine; ICQ: 191749952 > Twitter: m_elensule > > - Original message - > From: David Stoltz > To: php-general@lists.php.net > Date:

Re: [PHP] Security/Development Question

2010-04-28 Thread Robert Cummings
David Stoltz wrote: Hi folks, This isn't really a PHP question per se, but could apply to any language... I have a public facing web server, which we have a software component that helps protect us from SQL Injection, and the like. We recently have added a very small web application that is ve

Re: [PHP] Security/Development Question

2010-04-28 Thread Paul M Foster
On Wed, Apr 28, 2010 at 04:54:56PM -0400, David Stoltz wrote: > Hi folks, > > > > This isn't really a PHP question per se, but could apply to any > language... > > > > I have a public facing web server, which we have a software component > that helps protect us from SQL Injection, and the

Re: [PHP] Security/Development Question

2010-04-28 Thread Andre Polykanine
hoo! messenger: andre.polykanine; ICQ: 191749952 Twitter: m_elensule - Original message - From: David Stoltz To: php-general@lists.php.net Date: Wednesday, April 28, 2010, 11:54:56 PM Subject: [PHP] Security/Development Question Hi folks, This isn't really a PHP question per se,

[PHP] Security/Development Question

2010-04-28 Thread David Stoltz
Hi folks, This isn't really a PHP question per se, but could apply to any language... I have a public facing web server, which we have a software component that helps protect us from SQL Injection, and the like. We recently have added a very small web application that is vendor supporte

[PHP] REMINDER: Month of PHP Security 2010 - CALL FOR PAPERS - Only 3 weeks left

2010-03-21 Thread Stefan Esser
Month of PHP Security 2010 - CALL FOR PAPERS Three years ago, in March 2007, the Hardened-PHP project had organized the Month of PHP Bugs. During one month more than 40 vulnerabilities in the PHP interpreter were disclosed in order to improve the

Re: [PHP] security/deployment issue

2009-10-16 Thread hessiess
> Humm.. thanks for the replies. But i have another problem about rsync > again. > > > > When i deploy a project using the rsync the permissions of all home > directory is changed. i tried to use the parameter -p -o -g (preserve > permissions, owner and group): > > > I dont know but the rsync doesn

Re: [PHP] security/deployment issue

2009-10-16 Thread Adam Randall
Rsync preserves the UID and GID, not the visible username or visible group name. This means that if the UIDs and GIDs do not match your expected users and groups on the destination server they will match whatever is setup there according to the /etc/passwd or /etc/group files. If there's no match f

Re: [PHP] security/deployment issue

2009-10-16 Thread Augusto Flavio
Humm.. thanks for the replies. But i have another problem about rsync again. When i deploy a project using the rsync the permissions of all home directory is changed. i tried to use the parameter -p -o -g (preserve permissions, owner and group): I dont know but the rsync doesnt preserve the pe

Re: [PHP] security/deployment issue

2009-10-16 Thread hessiess
>> Rsync should work fine, but personally I like to see exactly which >> changes are being deployed especially when deploying to production. >> While I realise this recommendation is not Open Source software, I >> have found it to be an excellent piece of software for this task. I >> use Beyond Com

Re: [PHP] security/deployment issue

2009-10-15 Thread xfedex
> Rsync should work fine, but personally I like to see exactly which > changes are being deployed especially when deploying to production. > While I realise this recommendation is not Open Source software, I > have found it to be an excellent piece of software for this task. I > use Beyond Compare

Re: [PHP] security/deployment issue

2009-10-11 Thread James McLean
On Mon, Oct 12, 2009 at 4:06 PM, Augusto Flavio wrote: > i have a doubt about my security and deployment methods. Today i manage > several projects and these projects are versioned with subversion. My > environment is something like this: > > 1. The developer make some update in the source code of

[PHP] security/deployment issue

2009-10-11 Thread Augusto Flavio
Hi everybody, i have a doubt about my security and deployment methods. Today i manage several projects and these projects are versioned with subversion. My environment is something like this: 1. The developer make some update in the source code of a project. (from your IDE, generally netbeans)

Re: [PHP] security question of ZCE exam

2009-08-25 Thread Daniel Brown
On Tue, Aug 25, 2009 at 00:07, Augusto Flavio wrote: > > Answers: (choose 2) >    Error messages will contain sensitive session information >    Error messages can contain cross site scripting attacks >    Security risks involved in logging are handled by PHP > X    Error messages give the percepti

[PHP] security question of ZCE exam

2009-08-24 Thread Augusto Flavio
Hi all, i'm discutting with my friend about this question for 30 min and i do not agree with he. Here is the question: Why is it important from a security perspective to never display PHP error messages directly to the end user, yet always log them? Answers: (choose 2) Error messages wil

Re: [PHP] Re: PHP Security

2009-06-03 Thread Andrew Ballard
On Tue, Jun 2, 2009 at 7:39 PM, Shawn McKenzie wrote: > Grant Peel wrote: >> Hi all, >> >> I am currently setting up the next generation web server for our company and >> am in need of general consulting/advice on php set up security issues. >> >> Any one with knowledge and expierience please fee

Re: [PHP] Re: PHP Security

2009-06-02 Thread b
Grant Peel wrote: ??? I think you can safely assume that was a joke. -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP] Re: PHP Security

2009-06-02 Thread Grant Peel
??? - Original Message - From: "Shawn McKenzie" To: Sent: Tuesday, June 02, 2009 7:39 PM Subject: [PHP] Re: PHP Security Grant Peel wrote: Hi all, I am currently setting up the next generation web server for our company and am in need of general consulting/advice on

[PHP] Re: PHP Security

2009-06-02 Thread Shawn McKenzie
Grant Peel wrote: > Hi all, > > I am currently setting up the next generation web server for our company and > am in need of general consulting/advice on php set up security issues. > > Any one with knowledge and expierience please feel free to reply :-). > > -Grant Do not under any circumstan

Re: [PHP] PHP Security

2009-06-02 Thread Grant Peel
its -Grant - Original Message - From: "Phpster" To: "Grant Peel" Cc: Sent: Tuesday, June 02, 2009 5:53 PM Subject: Re: [PHP] PHP Security H, how about some details on OS, etc Bastien Sent from my iPod On Jun 2, 2009, at 17:26, "Grant Peel"

Re: [PHP] PHP Security

2009-06-02 Thread Kirk . Johnson
> On Jun 2, 2009, at 17:26, "Grant Peel" wrote: > > I am currently setting up the next generation web server for our > company and am in need of general consulting/advice on php set up > security issues. For "general" considerations, start here: http://www.php.net/manual/en/security.general.

Re: [PHP] PHP Security

2009-06-02 Thread Phpster
H, how about some details on OS, etc Bastien Sent from my iPod On Jun 2, 2009, at 17:26, "Grant Peel" wrote: Hi all, I am currently setting up the next generation web server for our company and am in need of general consulting/advice on php set up security issues. Any one with kno

[PHP] PHP Security

2009-06-02 Thread Grant Peel
Hi all, I am currently setting up the next generation web server for our company and am in need of general consulting/advice on php set up security issues. Any one with knowledge and expierience please feel free to reply :-). -Grant

Re: [PHP] SECURITY PRECAUTION BEFORE SUBMITTING DATA IN DATABASE

2009-05-22 Thread kranthi
not related to SQl but u may want to look at http://php-ids.org/ -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP] SECURITY PRECAUTION BEFORE SUBMITTING DATA IN DATABASE

2009-05-22 Thread Andrew Ballard
ign my project more secured than >> before. If you get >> any other idea please suggest me. >> >> >> Thanks, >>        Sumit. >> >> >> >> >> >> >> >> -- Forwarded message -- >> From: Micha

Re: [PHP] SECURITY PRECAUTION BEFORE SUBMITTING DATA IN DATABASE

2009-05-22 Thread Andrew Williams
idea please suggest me. > > > Thanks, >Sumit. > > > > > > > > -- Forwarded message ---------- > From: Michael A. Peters > Date: Fri, May 22, 2009 at 4:50 AM > Subject: Re: [PHP] SECURITY PRECAUTION BEFORE SUBMITTING DATA IN DATABASE > To: Eddie Drapkin > Cc: php-gen

Fwd: [PHP] SECURITY PRECAUTION BEFORE SUBMITTING DATA IN DATABASE

2009-05-22 Thread Sumit Sharma
st me. Thanks, Sumit. -- Forwarded message -- From: Michael A. Peters Date: Fri, May 22, 2009 at 4:50 AM Subject: Re: [PHP] SECURITY PRECAUTION BEFORE SUBMITTING DATA IN DATABASE To: Eddie Drapkin Cc: php-general@lists.php.net Eddie Drapkin wrote: > Suhosin is completely

Re: [PHP] SECURITY PRECAUTION BEFORE SUBMITTING DATA IN DATABASE

2009-05-21 Thread Michael A. Peters
Eddie Drapkin wrote: Suhosin is completely not-related to SQL, though, I don't know why you'd bring it up... I brought it up because suhosin catches many exploits that otherwise get through, including exploits that allow inclusion of remote files that can then be used to run arbitrary command

Re: [PHP] SECURITY PRECAUTION BEFORE SUBMITTING DATA IN DATABASE

2009-05-21 Thread Shawn McKenzie
Eddie Drapkin wrote: > Suhosin is completely not-related to SQL, though, I don't know why you'd > bring it up... Well, because the post that I was replying to brought it up and I happen to agree that it's a good idea even though it has nothing to do with SQL :-) >>> Michael A. Peters wrote:

Re: [PHP] SECURITY PRECAUTION BEFORE SUBMITTING DATA IN DATABASE

2009-05-21 Thread Eddie Drapkin
Suhosin is completely not-related to SQL, though, I don't know why you'd bring it up... > > > > On Thu, May 21, 2009 at 3:42 PM, Shawn McKenzie wrote: > >> Michael A. Peters wrote: >> > Sumit Sharma wrote: >> >> Hi, >> >> >> >> I am designing a php website for my client which interact with >> datab

Re: [PHP] SECURITY PRECAUTION BEFORE SUBMITTING DATA IN DATABASE

2009-05-21 Thread Shawn McKenzie
Michael A. Peters wrote: > Sumit Sharma wrote: >> Hi, >> >> I am designing a php website for my client which interact with database. >> This is my first project for any client (I hope he is not reading this >> mail >> ;-) ). I am a bit more concerned with database security. Can somebody >> shed >>

Re: [PHP] SECURITY PRECAUTION BEFORE SUBMITTING DATA IN DATABASE

2009-05-21 Thread Michael A. Peters
Sumit Sharma wrote: Hi, I am designing a php website for my client which interact with database. This is my first project for any client (I hope he is not reading this mail ;-) ). I am a bit more concerned with database security. Can somebody shed some light on the security measurements, precau

RE: Fwd: [PHP] SECURITY PRECAUTION BEFORE SUBMITTING DATA INDATABASE

2009-05-21 Thread bruce
effectively. > > > Sumit > > -- Forwarded message -- > From: Ashley Sheridan > Date: Thu, May 21, 2009 at 6:36 PM > Subject: Re: [PHP] SECURITY PRECAUTION BEFORE SUBMITTING DATA IN DATABASE > To: Sumit Sharma > Cc: php-general@lists.php.net > > > On Thu, 2009

Re: Fwd: [PHP] SECURITY PRECAUTION BEFORE SUBMITTING DATA IN DATABASE

2009-05-21 Thread Ashley Sheridan
- > From: Ashley Sheridan > Date: Thu, May 21, 2009 at 6:36 PM > Subject: Re: [PHP] SECURITY PRECAUTION BEFORE SUBMITTING DATA IN DATABASE > To: Sumit Sharma > Cc: php-general@lists.php.net > > > On Thu, 2009-05-21 at 18:22 +0530, Sumit Sharma wrote: > > Hi, &g

Fwd: [PHP] SECURITY PRECAUTION BEFORE SUBMITTING DATA IN DATABASE

2009-05-21 Thread Sumit Sharma
One more thing, should I use @ for security purpose or not so that the use can reply me with the errors so that I can troubleshoot the problem more effectively. Sumit -- Forwarded message -- From: Ashley Sheridan Date: Thu, May 21, 2009 at 6:36 PM Subject: Re: [PHP] SECURITY

Re: [PHP] SECURITY PRECAUTION BEFORE SUBMITTING DATA IN DATABASE

2009-05-21 Thread Ashley Sheridan
On Thu, 2009-05-21 at 18:22 +0530, Sumit Sharma wrote: > Hi, > > I am designing a php website for my client which interact with database. > This is my first project for any client (I hope he is not reading this mail > ;-) ). I am a bit more concerned with database security. Can somebody shed > so

[PHP] SECURITY PRECAUTION BEFORE SUBMITTING DATA IN DATABASE

2009-05-21 Thread Sumit Sharma
Hi, I am designing a php website for my client which interact with database. This is my first project for any client (I hope he is not reading this mail ;-) ). I am a bit more concerned with database security. Can somebody shed some light on the security measurements, precautions, and functions r

RE: [PHP] Security Support

2009-03-31 Thread Bob McConnell
From: Grant Peel > From: "Michael A. Peters" >> Grant Peel wrote: >>> Good Morning / Afternoon, >>> >>> We run several of our own servers: >>> >>> - Dell Power Edge 1U, Pentium, >>> - FreeBSD (6.x soon to be 7.x) >>> - along with all the standard Web Application installation (PHP Apache >>> Exim,

Re: [PHP] Security Support

2009-03-30 Thread Chris
Grant Peel wrote: - Original Message - From: "Michael A. Peters" To: "Grant Peel" Cc: Sent: Sunday, March 29, 2009 10:00 PM Subject: Re: [PHP] Security Support Grant Peel wrote: Good Morning / Afternoon, We run several of our own servers: - Dell Power Edge 1U

Re: [PHP] Security Support

2009-03-30 Thread Grant Peel
- Original Message - From: "Michael A. Peters" To: "Grant Peel" Cc: Sent: Sunday, March 29, 2009 10:00 PM Subject: Re: [PHP] Security Support Grant Peel wrote: Good Morning / Afternoon, We run several of our own servers: - Dell Power Edge 1U, Pentium, - FreeB

Re: [PHP] Security Support

2009-03-30 Thread Igor Escobar
I agree with you Daniel Regards, Igor Escobar systems analyst & interface designer www . igorescobar . com On Mon, Mar 30, 2009 at 10:58 AM, Daniel Brown wrote: > On Sun, Mar 29, 2009 at 22:07, abdulazeez alugo > wrote: > >> Yea, dude, well me GED says I kin git it dun wit less wastid ti

Re: [PHP] Security Support

2009-03-30 Thread Daniel Brown
On Sun, Mar 29, 2009 at 22:07, abdulazeez alugo wrote: >> Yea, dude, well me GED says I kin git it dun wit less wastid time. >> >> -- > No be only una get pidgin English ooo. Me sef fit do am sharp sharp no be say > them say. Is there any particular reason you guys totally trashed this threa

RE: [PHP] Security Support

2009-03-29 Thread abdulazeez alugo
> Date: Sun, 29 Mar 2009 19:02:15 -0700 > From: mpet...@mac.com > To: m...@hallmarcwebsites.com > CC: php-general@lists.php.net > Subject: Re: [PHP] Security Support > > Marc Christopher Hall wrote: > > I is a hi skool gradjuate > > Yea, dude, well me G

Re: [PHP] Security Support

2009-03-29 Thread Michael A. Peters
Marc Christopher Hall wrote: I is a hi skool gradjuate Yea, dude, well me GED says I kin git it dun wit less wastid time. -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP] Security Support

2009-03-29 Thread Michael A. Peters
Grant Peel wrote: Good Morning / Afternoon, We run several of our own servers: - Dell Power Edge 1U, Pentium, - FreeBSD (6.x soon to be 7.x) - along with all the standard Web Application installation (PHP Apache Exim, Pop3, Proftp, MySQL etc etc). What I am asking here, is if any one in this

RE: [PHP] Security Support

2009-03-29 Thread abdulazeez alugo
> From: da...@wonderly.com > To: defati...@hotmail.com; gp...@thenetnow.com; php-general@lists.php.net > Date: Sun, 29 Mar 2009 18:16:35 -0500 > Subject: Re: [PHP] Security Support > > > - Original Message - > From: "abdulazeez alugo" > To: ;

RE: [PHP] Security Support

2009-03-29 Thread Marc Christopher Hall
I is a hi skool gradjuate -Original Message- From: abdulazeez alugo [mailto:defati...@hotmail.com] Sent: Sunday, March 29, 2009 7:10 PM To: gp...@thenetnow.com; php-general@lists.php.net Subject: RE: [PHP] Security Support > From: gp...@thenetnow.com > To: php-general@lists.p

Re: [PHP] Security Support

2009-03-29 Thread David Wonderly
- Original Message - From: "abdulazeez alugo" To: ; Sent: Sunday, March 29, 2009 6:09 PM Subject: RE: [PHP] Security Support From: gp...@thenetnow.com To: php-general@lists.php.net Date: Sun, 29 Mar 2009 17:12:32 -0400 Subject: [PHP] Security Support Good Morning /

  1   2   3   4   5   6   7   8   9   >