PHP and SQL Security

An anonymous reader writes "PHP and SQL Security are being proven more weak every day. Uberhacker.Com is running a PHP and SQL security research project to raise awareness of secure scripting. The site hosts guides to secure PHP programming, forums, and scripting challenges to see who can create the most secure scripts."

Here come the jokes...

[caluml]

When the site falls over, cue the jokes about PHP and MySQL, from the battle-hardened Perl and Postgres veterans.

"more weak"?

[Junks Jerzey]

How about "weaker" :P

Re:Here come the jokes...

[tcopeland]

When/if it does, here's the first challenge:

PHP GAUNTLET CHALLENGE 1
Challenge : Create Article Submition, Display, and Approval System
Submitted by : April 10th, 2004 (Date may be changed, number of submitions pending)
Requirements: See Below

Welcome to the first of many PHP GAUNTLET CHALLEGES. The concept behind these challenges is to have a user create an article submition, display, and approval system. This system has to utilize an SQL database, have email functions, and be portable. When I say "portable" I mean that it should be easily transferable from different template desigins. A good example of an article submition system is the one at Slashdot.org.

Specific Requirements:

1. The PHP scripts must be universally executable, meaning, they should be able to be moved to any directory (structure intact) and work properly.
2. The PHP scripts must have a include file called "connect.php", in this file, you should be able to specify the database server, passoword, and userid. An Example of this can be seen below :

$dbuser = '';
$dbpass = '';
$dbhost = '';
$dbdatabase = '';
$db = mysql_connect("$dbhost");
mysql_select_db("$dbdat abase",$db);

3. The PHP script must be able to be included into an area of a page, allowing for ease of portability.
4. Register Globals will be on.
5. You will be given 1 database, and unlimited tables.
6. The PHP script must have an article display, submition, and approval system.
7. The submition system must work in conjunction with the approval system. Once something is submitted, it should be able to be emailed to the site webmaster, and then approved by a URL in the email.

I know that most of this seems complicated, and very specific. However, I am attempting to make everything as such to give everyone a fair chance. If you wish to add any features, please do so. I will hopefully be submitting an example script for everyone to look off of soon.

Should I submit this one?

[blcamp]

This one is pretty secure...

<?php

// Try to break into this script!
echo "Hello World!";

?>

magic_quotes

[ftzdomino]

You could also enable magic_quotes in your php.ini. However, if you\'re too dumb to know the basics of sql, chances are your program won\'t work quite right.

I can't take a security sight seriously that...

[bbzzdd]

uses MS Comic font for their articles. Sorry.

Re:I can't take a security sight seriously that...

[daeley]

Never mind that, they're using a <font> tag to achieve it! The horror! ;)

404d!

[michael path]

Maybe someone can write a PHP script to take care of the 404 error that occurs when you click on the "home [uberhacker.com]" link on Uberhacker.com [uberhacker.com].

Bad Design Überalles.

SQL injection 101 ...

[zonix]

People! Remember the quotes! Do:

delete from table where id = '$var'

Not:

delete from table where id = $var

Try for $var = "10 and id = 11 and id = 12 ...".

z

Re:Should I submit this one?

[horza]

You sound like a security expert. I'm told one of my scripts might be insecure, do you think you could tighten up the following:

<a href="$PHP_SELF?command=date">Click here to see the date</a>
<?php // Try to break into this script!
if ($command) echo system($command);
?>

Thanks,

Phillip.

Security?

[natefanaro]

Why worry about security when your site's been slashdotted? No one can get to it so no one can hack it!!!

Re:A bad workman blames his tools

[Wakkow]

*clears throat* .. I'd like to take a minute to talk about shop safety. Be sure to read, understand, and follow, all the safety rules that come with your powertools. Knowing how to use your power tools properly will greatly reduce the risk of personal injury. And remember this, there is no more important safety rule than to wear these.. safety glasses.

I wonder if anyone else watches Norm that reads /.

Re:No.

[eril]

I sent my insecure scripts to counseling and they feel much better about themselves now.

Re:Should I submit this one?

[Finuvir]

Obviously you've been on slashdot too long to understand humour any more...