ICT 5 Web Development - Chapter 10: Web Techniques and Security

End; $double = htmlentities($input); //"Stop pulling my hair!" Jane's eyes flashed.<p> $both = htmlentities($input, ENT_QUOTES); //"Stop pulling my hair!" Jane's eyes flashed.<p> $neither = htmlentities($input, ENT_NOQUOTES); // "Stop pulling my hair!" Jane's eyes flashed.<p> 27 function clean_for_mysql($string,$max_length) { $in_string g = ltrim($string); g $in_string = rtrim($in_string); if (round($max_length) < 1) { $max_length = 131072; // 128K } if (strlen($in_string) > $max_length) { $new_string = substr($in_string,0,$max_length); } $new_string = mysql_real_escape_string($new_string); return $new_string; } 28 7 3.1.3. Removing HTML tags 3.1.2. EntityEntity-quoting only HTML syntax characters ‹ htmlspecialchars( ) function ‹ – converts the smallest set of entities possible to generate valid HTML. – htmlspecialchars(input htmlspecialchars(input,, [quote_style [quote_style,, [charset]] [charset]]); ); – The following entities are converted: ‹ ‹ ‹ ‹ ‹ ‹ Ampersands (&) are converted to &. Double quotes (") are converted to ". Single quotes (') are converted to ' (if ENT_QUOTES is on, as described for htmlentities( )). Less--than signs (<) are converted to <. Less Greater--than signs (>) are converted to >. Greater The strip_tags( ) function removes HTML tags from a string: – $input = '

Howdy, "Cowboy"

'; $output = strip_tags($input, ''); // $output is 'The bold tags will stay' E.g. – "angle < 30" or "sturm & drang" 29 30 3.2. URL encoding 3.2.1. RFC 1738 encoding and decoding Convert to and from URL encoding, which allows you to build and decode URLs. URLs ‹ Two types of URL encoding ‹ ‹ – Specified by RFC 1738: treats a space as just another illegal character in a URL and encodes it as %20. – Implementing p g the application/xapplication/x pp / -wwwwww-formformurlencoded system: encodes a space as a + and is used in building query strings. rawurlencode( ): encode a string according to the URL conventions $name = "Programming PHP"; $output = rawurlencode($name); echo "http://localhost/$output"; Æ Result: http://localhost/Programming%20PHP ‹ rawurldecode(): decodes URL URL--encoded strings $encoded = 'Programming%20PHP'; echo rawurldecode($encoded); Æ Result: Programming PHP 31 32 8 Content 3.2.2. QueryQuery-string encoding and decoding urlencode( ) and urldecode( ): ): encode and decode spaces as plus signs (+) instead of as the sequence %20. Æ useful for generating query strings: ‹ E.g. ‹ $base_url = 'http://www.google.com/q='; $query = 'PHP sessions -cookies'; $url = $base $base_url url . urlencode($query); echo $url; 1. Environment variables 2. Setting Response Header 3. Encoding and escaping 4. Cross site scripting ÆResult: http://www.google.com/q=PHP+sessions+--cookies http://www.google.com/q=PHP+sessions+ 33 34 Three top web site vulnerabilites Three top web site vulnerabilites ‹ XSS – CrossCross-site scripting ‹ – Bad web site sends innocent victim a script that steals information from an honest web site ‹ CSRF – CrossCross-site request forgery – Bad web site sends innocent contextvictim a script that steals information from an honest web site ‹ SQL Injection – Browser sends malicious input p to server – Bad input checking leads to malicious SQL query CSRF – CrossCross-site request forgery Leverages user’s session at sever – Bad web site sends request to good web site, using credentials of an innocent victim who “visits” site – Bad web site sends browser request to good web site, using credentials of an innocent victim ‹ XSS – CrossCross-site Injectsscripting malicious script into trusted ‹ SQL Injection – Browser sends malicious input p to server U SQL Uses – Bad input checking leads to malicious SQL query 9 4. Cross site scripting ‹ 4. Cross site scripting (2) Cross--site scripting (XSS) Cross ‹ – most common web application security vulnerability – with the rising popularity of Ajax technologies, XSS attacks are likely to become more advanced and to occur more frequently – malicious user embeds HTML or other clientclient-side script into your Web site Example – – If value of username parameter is: What will happen? ‹2 types – Reflected XSS – Stored XSS 37 38 4.1. Reflected XSS Javascript URL jjavascript: p alert(document.cookie) ( ) ‹ ‹ ‹ ‹ ‹ Most common type of XSS and the easiest The attacker uses social engineering techniques to get a user to click on a link to your site. The link has malicious code embedded in it. Can be used to deliver a virus or malformed cookie or grab data from the user’s system E.g. The malicious code would be tacked onto the end of a search link of Google’s search. search Solution: Validate the input before displaying any user--generated data user Displays all cookies for current document 40 10