Security

Question 1

When invoked as a CGI binary, PHP refuses to…

Answer 1

…interpret the command line arguments.

Question 2

What are the following runtime configuration directives: cgi.force_redirect, doc_root, user_dir?

Answer 2

cgi.force_redirect – provides security running PHP as a CGI under most web servers. Left undefined, PHP turns this on by default.

doc_root – PHP’s root directory on the server. Only used if non-empty. If PHP is configured with safe mode, no files outside this directory are served.

user_dir – the base name of a directory used on a user’s home directory for PHP files, for example public_html.

Question 3

What is –enable-force-cgi-redirect for?

Answer 3

It enables the security check for internal server redirects. You should use this if you are running the CGI version of Apache. As of PHP 5.3, this argument is enabled by default and no longer exists.

Question 4

What does cgi.force_redirect do?

Answer 4

It’s a configuration directive that prevents anyone from calling PHP directly. Instead, PHP will only parse in this mode if it has gone through a web server redirect rule.

Question 5

What are three ways to set the PHP script document root?

Answer 5

1. The configuration directive doc_root in the config file
2. Set the environment variable PHP_DOCUMENT_ROOT.
3. Set user_dir.

user_dir expansion happens regardless of the doc_root setting, so you can control the document root and user directory access separately.

Question 6

What is open_basedir for?

Answer 6

It’s a configuration directive used for limiting the files that can be accessed by PHP to the specified directory-tree, including the file itself. This directive is unaffected by safe mode.

When a script tries to access the filesystem, for example, using include or fopen, the location of the file is checked. When the file is outside the specified directory-tree, PHP will refuse to access it. All symbolic links are resolved, so it’s not possible to avoid this restriction with a symlink.

Question 7

What are 6 things you can do to prevent SQL injection?

Answer 7

1. Never connect to the database as superuser. Use a limited privileges user.
2. Use prepared statements with bound variables, such as those provided by PDO, MySQLi, and by other libraries.
3. Check if the given input has the expected data type
4. If the application takes numerical input, verify it with ctype_digit(), change its type with settype(), or use its numeric representation with sprintf().
5. If the database layer doesn’t support binding variables, then quote values with the database-specific string escape function.
6. Do not print out any database-specific information.

Question 8

What would you set error reporting to to test your code?

Answer 8

E_ALL

Question 9

How can you turn off error displays completely?

Answer 9

Either set error_reporting() to 0, or use display_errors in php.ini. You can also then define the path to your log file using the error_log ini directive, and turn log_errors on.

Question 10

What is $_REQUEST a mix of?

Answer 10

$_GET, $_POST, and $_COOKIE.

Question 11

Are magic quotes available in PHP?

Answer 11

Deprecated in 5.3 and removed in 5.4.

Question 12

What are some ways to hide PHP?

Answer 12

1. Set expose_php to ‘off’ in php.ini.
2. Use apache directives to parse non-php extension files with php (either as other suffixes, like .asp, as unknown suffixes, like .foo, or as .html).