PHP Security

PHP is a very flexible language. But sometimes this flexibility creates security flaws because of improper use of it. I had just read an article “Top 7 PHP Security Blunders” by Pax Dickinson. It shows top 7 mistakes or flaws that may break site security.

“Security is a process, not a product, and adopting a sound approach to security during the process of application development will allow you to produce tighter, more robust code.” – Pax Dickinson

In this article the author has shown how PHP application be infected and how to protect it. He has described the followings with reference to different articles:

• Unvalidated Input Errors
• Access Control Flaws
• Session ID Protection
• Cross Site Scripting (XSS) Flaws
• SQL Injection Vulnerabilities
• Error Reporting
• Data Handling Errors
• Configuring PHP For Security

I found this article knowledgeable. Hope you will like it. You may read it from here http://www.sitepoint.com/article/php-security-blunders.

I want to conclude with lines from this article…

“…there are many things to be aware of when programming secure PHP applications, though this is true with any language, and any server platform. PHP is no less secure than many other common development languages. The most important thing is to develop a proper security mindset and to know your tools well…”

No related posts.

1. Download the zipped file.
2. Unzip the file. This file contains the class file and an example file.
3. Open the class file and change these variables -
   • $currentTheme – Your cPanel theme
   • $userName – Your cPanel user name
   • $password – Your cPanel password
   • $domain – Your cPanel domain
   • $cPanelPort – Your cPanel port [optional]
4. Include the class in the file where you want to use it.

Example:

// include the class file
include('class.cpmailmanager.php');
 
// create an instanse of the class
$cp = new CPMailManager();
 
// create an email account
$cp->createEmail('sadat', 'sadat123', 10);
 
if($cp->status) //account created successfully
{
     echo 'Mail created successfully';
}
else
{
     echo $cp->message;
}
 
// create mail forwarder
$cp->createForwarder('sadat', 'msh@example.com');
echo '' . $cp->message;
 
// delete mail forwarder
$cp->deleteForwarder('sadat', 'msh@example.com');
echo '' . $cp->message;
 
// delete email account
$cp->deleteEmail('sadat');
echo '' . $cp->message;

Related posts:

1. Paging Class using PHP and MySQL

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

<?php if (!defined('BASEPATH')) exit('No direct script access allowed');
 
    function pdf_create($html, $filename, $stream=true, $papersize = 'letter', $orientation = 'portrait')
    {
        require_once("dompdf/dompdf_config.inc.php");
 
        $dompdf = new DOMPDF();
        $dompdf->load_html($html);
        $dompdf->set_paper($papersize, $orientation);
        $dompdf->render();
 
        if ($stream)
        {
            $options['Attachment'] = 1;
            $options['Accept-Ranges'] = 0;
            $options['compress'] = 1;
            $dompdf->stream($filename.".pdf", $options);
        }
        else
        {
            write_file("$filename.pdf", $dompdf->output());
        }
    }
?>

Related posts:

1. DOMPDF without PDFLib as back-end PDF support
2. DOMPDF Attachment issue in IE (Internet Explorer)

“…Edit dompdf_config.inc.php to fit your installation. If you leave the DOMPDF_PDF_BACKEND setting at ‘auto’ dompdf will use PDFLib if it is installed, otherwise it will use the bundled R&OS CPDF class…”

I was very much happy to read this. I might have missed this while installing DOMPDF for the first time. Thanks DOMPDF for a nice interface and output. Really DOMPDF made our coding not just easy, but saved our times .

Related posts:

1. DOMPDF Attachment issue in IE (Internet Explorer)
2. CodeIgniter – Plugin for DOMPDF

I searched the web and found no suitable solution. I followed the instruction given in http://www.corenettech.com/blog/ but it didn’t work . But I got an idea from this post. I started digging the code and have done following changes to PDFLib_Adapter class (available in DOMPDF_DiRECTORY/include/pdflib_adapter.cls.php).

I have removed the following line (line 829):

header("Cache-Control: private");

and added

if (strstr($_SERVER['HTTP_USER_AGENT'], "MSIE"))
{
     header('Expires: 0');
     header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
     header("Content-Transfer-Encoding: binary");
     header('Pragma: public');
     header("Content-Length: ".strlen($data));
}
else
{
     header("Cache-Control: private");
     header("Content-Transfer-Encoding: binary");
     header('Expires: 0');
     header('Pragma: no-cache');
     header("Content-Length: ".strlen($data));
}

After

header("Content-type: application/pdf");
header("Content-Disposition: $attach; filename=\"$filename\"");

That’s it! My code started working .

Hope this will save your time of surfing the net .

Related posts:

1. DOMPDF without PDFLib as back-end PDF support
2. CodeIgniter – Plugin for DOMPDF
3. Internet Explorer Developer Toolbar

//include the class file
include('Pager.php');
 
//making connection to the database
mysql_connect('localhost', 'root', '');
mysql_select_db('test');
 
//prepare SQL
$sql = 'SELECT * FROM books';
 
//create an object of Pager passing the SQL
$pager = new Pager($sql);
 
//set the url. this is the current page
$pager->url = 'index.php';
 
//set number of rows. by default it is 10
$pager->rowPerPage = 5;
 
//build the pager
$pager->build();
 
//get paged data
$rows = $pager->getPagedData();

Click the download link given below for a copy of the class. It also includes an working example.

Related posts:

1. Paging using PHP and MySQL
2. cPanel: Class for creating email account and mail forwarder

1. Start Mercury Mail from XAMPP control panel.
2. Navigate to Mercury Mail folder in XAMPP installation (Most probably C:\Program Files\xampp\MercuryMail)
3. Double click on mercury.exe and Mercury window will be opened.
4. Go to Configuration -> Local Users
5. Add a user with password (Suppose sajjad)
6. Close this window.

That’s it.

Now you can send mail to sajjad@localhost or sajjad@localhost.com (Mecury Mail should be started).

To receive mail configure outlook express with localhost as pop3 and SMTP server.

Hope these information will be helpful.

Related posts:

1. XAMPP – My favorite PHP environment
2. Enabling cURL in XAMPP

When I started coding in PHP, the main hassle was preparing the development environment. Installing Apache, PHP, MySQL was not so easy. Then I came across PHPTried and after that WAMPP. But finally I got what I wanted – XAMPP. To me XAMPP is a total PHP development environment.

XAMPP is an easy to install Apache distribution containing MySQL, PHP and Perl. XAMPP is really very easy to install and to use – just download, extract and start.

To get a copy of XAMPP, visit http://www.apachefriends.org/.

Related posts:

1. XAMPP – Sending test mails with MercuryMail