1. Unvalidated Parameters

Most importantly, turn off register_globals. This configuration setting defaults to off in PHP 4.2.0 and later. Access values from URLs, forms, and cookies through the superglobal arrays $_GET, $_POST, and $_COOKIE.

Before you use values from the superglobal arrays, validate them to make sure they don’t contain unexpected input. If you know what type of value you are expecting, make sure what you’ve got conforms to an expected format. For example, if you’re expecting a US ZIP Code, make sure your value is either five digits or five digits, a hyphen, and four more digits (ZIP+4). Often, regular expressions are the easiest way to validate data:

if (preg_match('/^\d{5}(-\d{4})?$/',$_GET['zip'])) {
    $zip = $_GET['zip'];
} else {
    die('Invalid ZIP Code format.');
}

If you’re expecting to receive data in a cookie or a hidden form field that you’ve previously sent to a client, make sure it hasn’t been tampered with by sending a hash of the data and a secret word along with the data. Put the hash in a hidden form field (or in the cookie) along with the data. When you receive the data and the hash, re-hash the data and make sure the new hash matches the old one:

// sending the cookie
$secret_word = 'gargamel';
$id = 123745323;
$hash = md5($secret_word.$id);
setcookie('id',$id.'-'.$hash);

// receiving and verifying the cookie
list($cookie_id,$cookie_hash) = explode('-',$_COOKIE['id']);
if (md5($secret_word.$cookie_id) == $cookie_hash) {
    $id = $cookie_id;
} else {
    die('Invalid cookie.');
}

If a user has changed the ID value in the cookie, the hashes won’t match. The success of this method obviously depends on keeping $secret_word secret, so put it in a file that can’t be read by just anybody and change it periodically. (But remember, when you change it, old hashes that might be lying around in cookies will no longer be valid.)

See Also:

• PHP Manual: Using Register Globals
• PHP Cookbook: Recipe 9.7 (”Securing PHP’s Form Processing”), Recipe 14.3 (”Verifying Data with Hashes”)

2. Broken Access Control

Instead of rolling your own access control solution, use PEAR modules. Auth does cookie-based authentication for you and Auth_HTTP does browser-based authentication.

See Also:

• PEAR Packages: Auth, Auth_HTTP.

3. Broken Account and Session Management

Use PHP’s built-in session management functions for secure, standardized session management. However, be careful how your server is configured to store session information. For example, if session contents are stored as world-readable files in /tmp, then any user that logs into the server can see the contents of all the sessions. Store the sessions in a database or in a part of the file system that only trusted users can access.

To prevent network sniffers from scooping up session IDs, session-specific traffic should be sent over SSL. You don’t need to do anything special to PHP when you’re using an SSL connection, but you do need to specially configure your webserver.

See Also:

• PHP Manual: Session handling functions
• PHP Cookbook: Recipe 8.5 (”Using Session Tracking”), Recipe 8.6 (”Storing Sessions in a Database”)

4. Cross-Site Scripting (XSS) Flaws

Never display any information coming from outside your program without filtering it first. Filter variables before including them in hidden form fields, in query strings, or just plain page output.

PHP gives you plenty of tools to filter untrusted data:

• htmlspecialchars() turns & > " < into their HTML-entity equivalents and can also convert single quotes by passing ENT_QUOTES as a second argument.
• strtr() filters any characters you’d like. Pass strtr() an array of characters and their replacements. To change ( and ) into their entity equivalents, which is recommended to prevent XSS attacks, do:
  $safer = strtr($untrusted, array('(' => '(', ')' => ')'));
• strip_tags() removes HTML and PHP tags from a string.
• utf8_decode() converts the ISO-8859-1 characters in a string encoded with the Unicode UTF-8 encoding to single-byte ASCII characters. Sometimes cross-site scripting attackers attempt to hide their attacks in Unicode encoding. You can use utf8_decode() to peel off that encoding.

See Also:

• PHP Manual: htmlspecialchars(), strtr(), strip_tags(), utf8_decode()
• PHP Cookbook: Recipe 8.8 (”Building a GET Query String”), Recipe 9.8 (”Escaping Control Characters from User Data”)

5. Buffer Overflows

You can’t allocate memory at runtime in PHP and their are no pointers like in C so your PHP code, however sloppy it may be, won’t have any buffer overflows. What you do have to watch out for, however, are buffer overflows in PHP itself (and its extensions.) Subscribe to the php-announce mailing list to keep abreast of patches and new releases.

See Also:

• PHP Mailing Lists: http://www.php.net/mailing-lists.php

6. Command Injection Flaws

Cross-site scripting flaws happen when you display unfiltered, unescaped malicious content to a user’s browser. Command injection flaws happen when you pass unfiltered, unescaped malicious commands to an external process or database. To prevent command injection flaws, in addition to validating input, always escape user input before passing it to an external process or database.

If you’re passing user input to a shell (via a command like exec(), system(), or the backtick operator), first, ask yourself if you really need to. Most file operations can be performed with native PHP functions. If you absolutely, positively need to run an external program whose name or arguments come from untrusted input, escape program names with escapeshellcmd() and arguments with escapeshellarg().

Before executing an external program or opening an external file, you should also canonicalize its pathname with realpath(). This expands all symbolic links, translates . (current directory) .. (parent directory), and removes duplicate directory separators. Once a pathname is canonicalized you can test it to make sure it meets certain criteria, like being beneath the web server document root or in a user’s home directory.

If you’re passing user input to a SQL query, escape the input with addslashes() before putting it into the query. If you’re using MySQL, escape strings with mysql_real_escape_string() (or mysql_escape_string() for PHP versions before 4.3.0). If you’re using the PEAR DB database abstraction layer, you can use the DB::quote() method or use a query placeholder like ?, which automatically escapes the value that replaces the placeholder.

See Also:

• PHP Manual: escapeshellcmd(), escapeshellarg(), realpath(), addslashes(), mysql_real_escape_string(), mysql_escape_string()
• PEAR Package: DB, DB Documentation
• PHP Cookbook: Recipe 18.20 (”Escaping Shell Metacharacters”), Recipe 10.9 (”Escaping Quotes”)

7. Error Handling Problems

If users (and attackers) can see the raw error messages returned from PHP, your database, or external programs, they can make educated guesses about how your system is organized and what software you use. These educated guesses make it easier for attackers to break into your system. Error messages shouldn’t contain any descriptive system information. Tell PHP to put error messages in your server’s error log instead of displaying them to a user with these configuration directives:

log_errors = On
display_errors = Off

See Also:

• PHP Manual: Error Handling and Logging Functions
• PHP Cookbook: Recipe 8.14 (”Hiding Error Messages from Users”)

8. Insecure Use of Cryptography

The mcrypt extension provides a standardized interface to many popular cryptographic algorithms. Use mcrypt instead of rolling your own encryption scheme. Also, be careful about where (if anywhere) you store encryption keys. The strongest algorithm in the world is pointless if an attacker can easily obtain a key for decryption. If you need to store keys at all, store them apart from encrypted data. Better yet, don’t store the keys and prompt users to enter them when something needs to be decrypted. (Of course, if you’re prompting a user over the web for sensitive information like an encryption key, that prompt and the user’s reply should be passed over SSL.)

See Also:

• PHP Manual: Mcrypt Encryption Functions
• PHP Cookbook: Recipe 14.7 (”Encrypting and Decrypting Data”)

9. Remote Administration Flaws

When possible, run remote administration tools over an SSL connection to prevent sniffing of passwords and content. If you’ve installed third-party software that has a remote administration component, change the default administrative user names and passwords. Change the default administrative URL as well, if possible. Running administrative tools on a different web server than the public web server that the administrative tool administrates can be a good idea as well.

10. Web and Application Server Misconfiguration

Keep on top of PHP patches and security problems by subscribing to the php-announce mailing list. Stay away from the automatic PHP source display handler (AddType application/x-httpd-php-source .phps), since it lets attackers look at your code. Of the two sample php.ini files distributed with PHP ( php.ini-dist and php.ini-recommended), use php.ini-recommended as a base for your site configuration.

The TIOBE Programming Community index gives an indication of the popularity of programming languages. The index is updated once a month. The ratings are based on the world-wide availability of skilled engineers, courses and third party vendors. The popular search engines Google, MSN, Yahoo!, and YouTube are used to calculate the ratings. Observe that the TIOBE index is not about the best programming language or the language in which most lines of code have been written.

The index can be used to check whether your programming skills are still up to date or to make a strategic decision about what programming language should be adopted when starting to build a new software system. The definition of the TIOBE index can be found here.

Position Jan 2008	Position Jan 2007	Delta in Position	Programming Language	Ratings Jan 2008	Delta Jan 2007	Status
1	1		Java	20.849%	+1.69%	A
2	2		C	13.916%	-1.89%	A
3	4		(Visual) Basic	10.963%	+1.84%	A
4	5		PHP	9.195%	+1.25%	A
5	3		C++	8.730%	-1.70%	A
6	8		Python	5.538%	+2.04%	A
7	6		Perl	5.247%	-0.99%	A
8	7		C#	4.856%	+1.34%	A
9	12		Delphi	3.335%	+1.00%	A
10	9		JavaScript	3.203%	+0.36%	A
11	10		Ruby	2.345%	-0.17%	A
12	13		PL/SQL	1.230%	-0.34%	A
13	11		SAS	1.204%	-1.14%	A
14	14		D	1.172%	-0.16%	A
15	18		COBOL	0.932%	+0.30%	A
16	46		Lua	0.579%	+0.48%	A–
17	22		FoxPro/xBase	0.506%	+0.05%	B
18	19		Pascal	0.456%	-0.11%	B
19	16		Lisp/Scheme	0.413%	-0.26%	A–
20	27		Logo	0.386%	+0.07%	B

• Python has been declared as programming language of 2007. It was a close finish, but in the end Python appeared to have the largest increase in ratings in one year time (2.04%). There is no clear reason why Python made this huge jump in 2007. Last month Python surpassed Perl for the first time in history, which is an indication that Python has become the “de facto” glue language at system level. It is especially beloved by system administrators and build managers. Chances are high that Python’s star will rise further in 2008, thanks to the upcoming release of Python 3.
• A couple of interesting trends can be derived from the 2007 data. First of all, languages without automated garbage collection are losing ground rapidly. The most prominent examples of languages with explicit memory management, C and C++, both lost about 2% in one year. Another trend is that the battle between scripting languages seems to be going on in the background. There is a continuous flow of new scripting languages. In 2006, Ruby entered the main scene, followed this year by Lua. In the top 50, Groovy and Factor are new kids on the block. None of these new scripting languages seem to stay permanently, they are just replaced by successors.
• What were the big movers and shakers in 2007? The big winners are Lua (from 46 to 16), Groovy (from 66 to 31), Focus (from 78 to 41), and Factor (new at 45). The most prominent shakers are ABAP (from 15 to 29) and IDL (from 23 to 48).
• What is to be expected in 2008? And, what became of the forecasts for 2007? At the beginning of 2007, I thought C# and D would become the winners and Perl and Delphi the losers. C# was indeed one of the big winners, and Perl one of the big losers. But the forecasts for D and Delphi were completely wrong. There has been no breakthrough for D. On the other hand, Delphi reclaimed a top 10 position… What about 2008? C, C++ and Perl will continue to fall. C and C++ because they have no automated garbage collection. C++ will get an extra push down because Microsoft is not actively supporting the language anymore. Perl is just dead. Java and C# will eventually be the 2 most popular languages. So I expect them to rise further in 2008. What new languages will enter the top 20 in 2008 is a wild guess, but I think ActionScript and Groovy are really serious candidates.
• Nguyen Quang Chien suggested to rename the OCaml entry to Caml. This has been done. Thanks Nguyen!
• In the tables below some long term trends are listed about categories of languages. The tables show that dynamically typed object-oriented languages are still becoming more popular.
  

  Category	Ratings January 2008	Delta January 2007
  Object-Oriented Languages	56.1%	+4.0%
  Procedural Languages	40.9%	-3.6%
  Functional Languages	1.9%	+0.2%
  Logical Languages	1.1%	-0.6%

  Category	Ratings January 2008	Delta January 2007
  Statically Typed Languages	56.2%	-1.5%
  Dynamically Typed Languages	43.8%	+1.5%

The IBM developer works website has posted the first part of a series they’ve created to help PHP developers become more informed about what regular expressions are and how they can harness their power for their applications.

Pattern matching is such a common chore for software that a special shorthand — regular expressions — has evolved to make light work of the task. Learn how to use this shorthand in your code here in Part 1 of this “Mastering regular expressions in PHP” series.

In this first part of the series, they look at the basics – the idea behind regular expressions, some of the common operators, the PHP functions to use them and example of how to use them to match/split out strings and capture just the data you need from the given input.

As Chris Hartjes points out there’s a new release of the popular PHP framework CakePHP (as well as a new web site design).

You can grab the latest download directly from the homepage or look into the manual to find out more about the framework and how it can be used.

Mike Naberezny has start up a new resource to try to bridge some of the gap between PHP and Ruby and to help developers of either to get a bit more insight into the others’ side – Rails for PHP Developers (based on the book published by the Pragmatic Programmers).

Rails for PHP Developers is a new site for PHP developers who are also interested in Rails and Ruby. PHP and Ruby are great complementary tools that are sometimes seen as adversarial, which is really unfortunate. We use both and we’ll be writing regular articles to help cross-pollinate ideas and promote collaboration between the communities.

There’s already some good content there – useful perlisms in ruby, a look at PHP object attributes and some information about the release of the site itself.

The PHP documentation team is pleased to announce the initial release of the new build system that generates the PHP Manual. Written in PHP, PhD ([PH]P based [D]ocBook renderer) builds are now available for viewing at docs.php.net. Everyone is encouraged to test and use this system so that bugs will be found and squashed.

Once the new build system is stable, expect additional changes to the PHP manual that will include an improved navigation system and styling for OOP documentation.

Feel free to set this developmental mirror as your default by using my.php.

New Eclipse-Based PHP IDE, New Version of Zend Core, and Announcements by IBM, Microsoft and Oracle Highlight Start of World’s Largest PHP Conference

CUPERTINO, CALIFORNIA – October 9, 2007 – Today at ZendCon, the third annual Zend/PHP Conference, Zend took significant steps to further advance PHP’s capabilities as the premier platform for business-critical web applications. In a series of announcements, the company shared details about deeper integration with products from IBM, Microsoft and Oracle, enhancements to the Zend version of PHP, and an all-new offering for developers who want to create PHP applications using Eclipse.

ZendCon is the largest gathering of its kind for the PHP community and for companies using PHP to build and deploy business-critical web applications. It is an important meeting place for an ecosystem that includes the world’s largest software companies, innovative web start-ups and leading-edge developers from more than 30 countries. Business application modernization, state-of-the-art graphical web applications, web service development, Web 2.0, mash-ups and user identity management are some of the over 50 sessions being led by an elite corps of business and software experts.

Today’s announcements underscore Zend’s commitment to creating the world’s best products that support commercial use of PHP, as well as its ongoing contribution to the open source PHP project and community of over 4.5 million PHP developers. The announcements include:

• Zend Studio for Eclipse – The all-new commercial PHP IDE for Eclipse with immediate availability of a downloadable beta version
• Zend Core 2.5 – Immediate availability of the new version of Zend’s production grade PHP
• IBM releases the IBM Mashup Starter Kit, based on Zend Core, Zend Framework and DB2
• Single source support from Zend for DB2 and Zend Core
• Delivery by Microsoft of a new FastCGI module to improve PHP performance on Windows
• Microsoft announces a new SQL Server 2005 Driver for PHP
• Zend announces support for the Server Core option in Microsoft Windows Server 2008
• Collaboration between Zend and Microsoft to deliver support for the identity management (Information Card) in Zend Framework
• Oracle Announces PHP support for Connection Pooling in Oracle® Database 11g

“PHP’s momentum and its rapid pace of innovation are driving high growth opportunities for everyone in the community, from individual developers to large corporate IT departments modernizing their business applications,” said Harold Goldberg, Zend CEO. “I’m proud to see the diversity of talent gathered at ZendCon, and to be able to showcase the results of all the hard work done by the community, by our partner companies and by Zend.”

Launch of Zend Studio for Eclipse
Zend announced Zend Studio for Eclipse, an all-new PHP Integrated Development Environment (IDE) that allows developers to take advantage of the sophisticated, feature-rich Eclipse framework. Zend Studio for Eclipse is a commercial product that builds on the recently announced open source Eclipse PDT project, and is aimed at speeding PHP development with a comprehensive set of editing, debugging, analysis, optimization and database tools. At the conference, Zend made a pre-release version available under the code name Neon. General availability is expected in early 2008.
Zend Core 2.5 released
Zend announced the immediate availability of Zend Core 2.5, strengthening PHP 5 for deployment of business critical web applications. Among the improvements in version 2.5 are simplified installation and maintenance of the full PHP application stack, including web server, databases, extensions and Zend Framework. Version 2.5 releases of Zend Core for IBM, Zend Core for i5/OS and Zend Core for Oracle will be available in the fourth quarter of 2007.
IBM releases the IBM Mashup Starter Kit
In a separate announcement made earlier today in Armonk NY, IBM introduced the IBM Mashup Starter Kit. The toolkit, available from the IBM Alphaworks website, enables non-technical business users to create sophisticated business applications by combining web services with drag-and-drop ease. The toolkit has been created with PHP 5, using Zend Core for IBM, Zend Framework and DB2 data servers.
Zend confirms availability of single source support for PHP and DB2
First announced in August, Zend is now offering a single source of support for PHP applications running on DB2 databases. This solution, which includes Zend Core for IBM and DB2 Express-C, can be extended with DB2 Connect technology to provide access to i5/OS and z/OS data servers.
Microsoft releases FastCGI for PHP
Last year at ZendCon, Microsoft and Zend announced a long-term collaboration agreement aimed at increasing the reliability and performance of PHP applications on Windows. Significant progress has been made on all of the announced projects, and many of the improvements have been accepted by the PHP open source project. Today, Microsoft announced that it has delivered on another commitment with the release of the GoLive beta of an Internet Information Services (IIS) add-on component, FastCGI. FastCGI serves as an interface between PHP and an IIS Web server delivering substantial reliability and performance benefits for PHP applications running on Windows. It is now available for free from Microsoft on http://www.iis.net/php.
Microsoft announces new SQL Server 2005 Driver for PHP
Microsoft today also announced the first Community Technology Preview (CTP) of the SQL Server 2005 Driver for PHP that gives developers an optimized way to link their PHP applications to SQL Server 2005. Microsoft and Zend are working together, and with the PHP community, to fully extend database support in PHP to SQL Server 2005 and make it part of Zend’s core PHP offering.
PHP support for Server Core option in Microsoft Windows Server 2008
Microsoft Server Core is an installation option for Microsoft Windows Server 2008 that provides a minimal environment for running specific server roles, while reducing maintenance and management requirements. Zend announced today that the company will support Microsoft Server Core in upcoming releases of Zend Core, giving PHP developers a way to optimize server reliability and performance when their PHP applications are running on Windows.
Identity management with Microsoft in Zend Framework
Support for identity management is a key objective for the upcoming releases of Zend Framework. At the conference, Zend and Microsoft announced that they are collaborating to add support for Information Cards into Zend Framework. This collaboration will enable PHP developers to create applications that support identification and authentication, including single sign-on for a broad range of website users, including those using Windows CardSpace. This commitment to interoperability will reduce development costs and make the web safer and more secure for people.
Oracle announces enhanced OCI8 driver and connection pooling for PHP
Building on more than three years of collaboration with Zend, Oracle today announced an open source contribution of an enhanced Oracle Call Interface (OCI8) database driver for PHP, supporting important Oracle Database 11g features such as connection pooling and fast application notification. This new OCI8 driver for PHP enables a single commodity server to support tens of thousands of database connections and, at the same time, provide higher availability. Oracle has posted a preview of the new OCI8 driver for PHP to the PECL repository. Zend will support the new capability in an upcoming release of Zend Core.
About Zend
Zend Technologies, Inc., the PHP Company, is the leading provider of products and services for developing, deploying and managing business-critical PHP applications. PHP is used by more than twenty million websites and has quickly become the most popular language for building dynamic web applications. Deployed at more than 15,000 companies worldwide, the Zend family of products is a comprehensive platform for supporting the entire lifecycle of PHP applications. Zend is headquartered in Cupertino, California. For more information, please visit www.zend.com, or call 1-408-253-8800.
Zend, Zend Technologies, Zend.com and Zend Studio and/or the logos and icons associated with each of these names are trademarks of Zend Technologies, Inc. and may be registered in certain jurisdictions. All other trademarks are the property of their respective owners.

The preliminary schedule for our upcoming php|tek 2008 conference, which will be held in Chicago between May 20th and 23rd, is finally up on the conference website.

Don’t miss it! The last two editions of php|tek sold out 4-6 weeks before the start date. Lock your spot today and enjoy free training, great pricing and one of the best PHP conferences in the world!

We received over 200 submissions for this year’s event, and the selection process was long and gruesome—but, in the end, we manage to pick over 45 great presentations from such well-known PHP experts as Derick Rethans, Chris Shiflett, Eli White, Jeff Moore, Jason Sweat, Ed Finkler, Ben Ramsey, Lucas Nealan, and many, many more!

Looking for a good deal? From free training to special pricing for academia, students, non-profit and php|architect conference alumni, we’ve got something that fits your budget in our attendee specials page.

The PHP development team would like to announce the immediate availability of PHP 5.2.5. This release focuses on improving the stability of the PHP 5.2.x branch with over 60 bug fixes, several of which are security related. All users of PHP are encouraged to upgrade to this release.

Further details about the PHP 5.2.5 release can be found in the release announcement for 5.2.5, the full list of changes is available in the ChangeLog for PHP 5.

Security Enhancements and Fixes in PHP 5.2.5:

• Fixed dl() to only accept filenames. Reported by Laurent Gaffie.
• Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887). Reported by Laurent Gaffie.
• Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences. Reported by Rasmus Lerdorf
• Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
• Fixed “mail.force_extra_parameters” php.ini directive not to be modifiable in .htaccess due to the security implications. Reported by SecurityReason.
• Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
• Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).

For users upgrading to PHP 5.2 from PHP 5.0 and PHP 5.1, an upgrade guide is available here, detailing the changes between those releases and PHP 5.2.5.