Re: Writing Secure PHP Scripts

> For example I was told that looping to $HTTP_POST_VARS was unsecure but > was unable to obtain extensive information about why it is so. > I'm using such loops as follows : I think that statement should be expressed as: Contrary to "newbie" opinion, $HTTP_POST_VARS is not much more secure than $HTTP_GET_VARS: Forging a POST event is almost, though not quite, as trivial as forging a URL with different GET values. I believe that the "scare" about HTTP_POST_VARS is that so many beginners see POST vars as unconquerably tricky to spoof compared to GET, and use POST vars as a high-level security measure. In reality, POST vars only raise the bar a little -- Joe Sixpack and Betsy Buick can play with GET vars to see what happens, while POST vars requires that you be a Script-Kiddie. Not exactly a "big" step up in security classification. Looping through HTTP_POST_VARS itself is not dangerous -- Assuming the data you get that way is safe is dangerous. If you are filtering your POST vars, and are aware that *ANY* variable/value combination can be inserted, you should be okay. Specifically, depending on the security level you require, you should probably: 1a. Explicitly code for the variables you expect to see, and 1b. Unset everything else, and possibly halt execution on unexpected inputs. 2. Check the possible values/ranges for the values of 1a. variables and halt execution for any unexpected inputs. 3. Log anything suspicious about 1b or 2 along with any info you consider useful to trace back to origins. It *would* be nice to see a page/section somewhere on the Net to address Internet Security in plain English, with a PHP-perspective. I dunno who's got the time to do it though.