Re: Security Issues

From: Date: Wed, 25 Jul 2001 03:27:21 +0000
Subject: Re: Security Issues
References: 1  Groups: php.dev 
Request: Send a blank email to php-dev+get-60923@lists.php.net to get a copy of this message 
Setting register_globals to off (which is highly recommended) would prevent PHP from defining form variables as global variables.  For quite a while, since the PHP 3.0 times, PHP provided an alternative way of accessing variables - using special designated arrays - $HTTP_POST_VARS, $HTTP_GET_VARS, and so forth.  As of PHP 4.0.3 (IIRC), these variables are always defined, and are protected (to a degree) by PHP.  Setting register_globals to off effectively prevents any outer access to your namespace, outside $HTTP_*_VARS[].

Zeev

At 12:28 24/07/2001, PHP wrote:


Hey all,


        I am new to this list so if this topic has already been beaten to death let me know.



        I assume that many of you have already read this article



        http://lwn.net/2001/0704/a/study-in-scarlet.php3 



        about many of the basic security risks you need to be aware of when developing in PHP.  I was curious what ideas have already been covered in the areas of stopping this.  I also wanted to offer up my own suggestion.



        It seems that all the issues arise from the feature that sets PHP variable to be form variables.  The cleanest solution I can think of (albeit it breaks backward compatibility) would be to split the names-pace of form variables.  If normal or session variable stayed as $foo and $bar then form variables would be %foo and %bar, or something similar.   Breaking backward compatibility is bad but it would allow future applications to be free of these dangers and could be something set in the php.ini or rather a directive in the php script to allow old an new style scripts on the same server.



        If there is work already being done in this area please point me to where I can read more about it.  PHP is far and away the best web development language and is really only hindered by security issues like this.



        Orion




--
PHP Development Mailing List <http://www.php.net/>
To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net
For additional commands, e-mail: php-dev-help@lists.php.net
To contact the list administrators, e-mail: php-list-admin@lists.php.net


--
Zeev Suraski <zeev@zend.com>
CTO &  co-founder, Zend Technologies Ltd. http://www.zend.com/

Thread (133 messages)

« previous php.dev (#60923) next »