Part IV. Security

Table of Contents

1. Introduction

2. General considerations

3. Installed as CGI binary

Possible attacks

Case 1: only public files served

Case 2: using --enable-force-cgi-redirect

Case 3: setting doc_root or user_dir

Case 4: PHP parser outside of web tree

4. Installed as an Apache module

5. Filesystem Security

Null bytes related issues

6. Database Security

Designing Databases

Connecting to Database

Encrypted Storage Model

SQL Injection

Avoiding techniques

7. Error Reporting

8. Using Register Globals

9. User Submitted Data

10. Magic Quotes

What are Magic Quotes

Why use Magic Quotes

Why not to use Magic Quotes

Disabling Magic Quotes

11. Hiding PHP

12. Keeping Current