Security PHP Code  Hot PDF Print E-mail
Tag it:
Delicious
Furl it!
Digg
NewsVine
Reddit
YahooMyWeb
Technorati
Articles Reviews PHP
Written by Phil Harrison   
Friday, 02 February 2007

{mos_sb_discuss:37}

With the eval( ) function, PHP allows a script to execute arbitrary PHP code. Although it can be useful in a few limited cases, allowing any user-supplied data to go into an eval( ) call is asking to be hacked. For instance, the following code is a security nightmare:


<html>
<head>
<title>Here are the keys...</title>
</head>
<body>
<?php if ($code) {
echo "Executing code...";
eval(stripslashes($code)); // BAD!
} ?>
<form>
<input type="text" name="code" />
<input type="submit" name="Execute Code" />
</form>
</body>
</html>

This page takes some arbitrary PHP code from a form and runs it as part of the script. The running code has access to all of the global variables for the script and runs with the same privileges as the script running the code. It's not hard to see why this is a problemtype this into the form:

include('/etc/passwd');

Unfortunately, there's no easy way to ensure that a script like this can ever be secure.

You can globally disable particular function calls by listing them, separated by commas, in the disable_functions configuration option in php.ini. For example, you may never have need for the system( ) function, so you can disable it entirely with:

disable_functions = system

This doesn't make eval( ) any safer, though, as there's no way to prevent important variables from being changed or built-in constructs such as echo( ) from being called.Note that the preg_replace( ) function with the /e option also calls eval( ) on PHP code, so don't use user-supplied data in the replacement string.In the case of include, require, include_once, and require_once, your best bet is to turn off remote file access using allow_url_fopen.

Any use of eval( ) and the /e option with preg_replace( ) is dangerous, especially if you use any user-entered data in the calls. Consider the following:

eval("2 + $user_input");

It seems pretty innocuous. However, suppose the user enters the following value:

2; mail(" This e-mail address is being protected from spam bots, you need JavaScript enabled to view it ", "Some passwords", '/bin/cat /etc/passwd'); In this case, both the command you expected and one you'd rather wasn't will beexecuted. The only viable solution is to never give user-supplied data to eval( ).

User reviews

There are no user reviews for this item.

Add new review




Powered by jReviews
Last Updated ( Sunday, 08 July 2007 )
 
< Prev   Next >
[ Back ]