This tag is used for topics relating to application security and attacks against software.

learn more… | top users | synonyms

0
votes
1answer
41 views

PHP login redirect security? [on hold]

I wish to redirect users to the login page if they attempt to visit a page which requires them to be logged in. After logging in, however, I want to redirect the user back to their original ...
1
vote
0answers
24 views

AES encryption class

I am new to encryption and recently wanted to learn more about it. I researched how to do AES Encryption in java and assembled my own Java AES encryption class. I don't know if there are any major ...
1
vote
2answers
38 views

Preventing XSS attacks with proper escaping

The following page simulates XSS attacks and successfully (?) prevents them. I want to know if I've missed any other major attack vectors (or small ones) and/or if anyone has suggestions as to ...
3
votes
0answers
41 views

Security of login and register system

I need some help with my register/login functions. I'm not sure if I understood bcrypt correctly either. Is this good or do I have to do any changes? Did I miss ...
2
votes
1answer
41 views

PHP application configuration

I've started looking at Heroku for application hosting and deployment and it appears that my configuration constants need to be stored in environment variables. I can do this in Heroku, but my ...
3
votes
2answers
103 views

PHP secure random number generator

I just wrote this function and I was curious if anyone could find any flaws in it? It look pretty secure to me but I just want to make sure since I'm no cryptography expert. ...
2
votes
2answers
49 views

Social network message board website security

I have a script that contains functions from login in to posting status to friend request send and receive. Pretty much a social network script. Anyways i think my security is not up to date so if ...
0
votes
1answer
55 views

Including a page specified in query string

This is how I include a page depending by name. Example URL: http://www.page.com/index.php?page=admin where ...
1
vote
2answers
45 views

Safety of globalizing config data

I have some framework in PHP/MySQL for developing web services. Finally my code works on two servers - production and developer. My idea is to create one code without differences, which will work ...
1
vote
0answers
59 views

Security of blog system

I just want to know if my PHP code is secure and if it's as clean as it can be. I'm trying to make a blog system and I want to make sure all my users information is safe and secure, although this is ...
1
vote
0answers
30 views

Safely include requested pages without a whitelist

Is this pretty safe from breakout attempts? I'd rather not make a whitelist and check if the requested page is in the array since theres a ton of pages. And I wanna keep it clean. So I'm looking for a ...
2
votes
1answer
88 views

Script for a multi-user webapp database connection

I have the following working script which I use for my database connection for a multi-user webapp. I use a different database for the login, this script is called only after the user is successfully ...
4
votes
1answer
96 views

Encrypting data on client side and passing it to server side

I'm passing the data to PHP server side which will use the information later as this: ...
3
votes
1answer
56 views

Secure INSERTs with Mysqli

Is this code well protected, and if not, could you tell me how it might be exploited and how to secure it? I'm using mysqli. ...
1
vote
1answer
62 views

Security of ProtectedObject

Is ProtectedObject really secure? Otherwise, do you have any advice? ...
19
votes
4answers
758 views
+100

Memory with a twist

Description This is the good old game Memory with a twist: Every time you pick a wrong pair, the two tiles you chose will switch their location. So sometimes you might think that a tile is at one ...
1
vote
1answer
57 views

Automatic password security test for WordPress

I was bored the other day and wrote the following little script to attempt to find insecure passwords for WordPress blog owners so they could be notified of how easy it would be to crack their WP ...
3
votes
1answer
116 views

Security flaws in smartphone application

And could you give me any security and optimization recommendations? ...
5
votes
2answers
89 views

Secure password hashing implementation

I'm implementing a password hashing method for a website. The code below is part of the User class. Any pointers on what I could do better? ...
3
votes
1answer
70 views

Form validation evaluation to avoid exploits

Please advise if the form validation script below is secure enough to avoid most types (all types?) of contact form exploits? I ahve found this script online, added some extra php finctions in hope to ...
4
votes
2answers
74 views

Iteration of password hashing in PHP - follow-up

This is a follow-up question to Iteration of password hashing in PHP I've gone trough a lot of documentations and stuff to get a feel for this hashing jungle, and done some adjustments to my code ...
5
votes
1answer
396 views

Prompt for Windows Credentials via Dialog [closed]

I have some code that requires the user (an admin) elevate to a system admin account to perform a task. I wish to prompt the user for the admin credentials to use. I believe returning a ...
6
votes
4answers
125 views

Iteration of password hashing in PHP

I'm trying to improve the security for my backend: ...
2
votes
1answer
32 views

Controller web interface security

I'm designing a web interface to a controller for my school's bell. Are there any security flaws in this code? The source code is available here. Front End: ...
5
votes
1answer
73 views

Updating an Nginx config file for SSL

This script updates a settings in ssl config file for Nginx. I generate DHEC key and then update the Nginx SSL file to that location. I also give an option for the user through arguments if they want ...
4
votes
2answers
150 views

PHP Session Wrapper Class

I recently worked on a system for the company I work for and would love some feedback on the following class for managing sessions. I don't claim to be a PHP guru but I like to think I gave it a try! ...
1
vote
1answer
30 views

Loop through post and use in query

so i'm using a foreach loop to loop through a form i've send with javascript. In this loop I use the keys(input fields names) and values(input values) and use them to build my query, I still check for ...
-1
votes
1answer
69 views
2
votes
3answers
73 views

Including file based on user input: Efficiency and Security

Currently I'm using this code: ...
7
votes
4answers
137 views

Simple compression algorithm

An implementation of a simple compression algorithm that's featured in a programming practice book. My goals: Robust: All error conditions must be handled properly. The specification indicated in ...
3
votes
1answer
42 views

Escaping photo caption to avoid cross site script attack

I am a PHP newbie and this is part of a gallery code. I recently read about SQL injection and cross site scripting attack, I am trying to avoid that by html escaping on dynamically produced data. I am ...
3
votes
2answers
410 views

Encryption-decryption method

My encryption algorithm I'm using this algorithm in order to encrypt notes users save on my site: ...
5
votes
1answer
208 views

PDO Login/Register system I've been working on

I'm relatively new to PHP and programming as whole. I'm sure my code could be better in a lot of ways, most of which I can't fully grasp at the moment. As it stands I'm trying to avoid the general ...
2
votes
2answers
129 views

Shopping Cart Handler Class - PHP

I've written an eCommerce shopping cart handler class in PHP. Please review the code and inform me of any errors and/or badly written code and/or badly handled logics. ...
4
votes
1answer
364 views

BouncyCastle Rijndael 256 Implementation

I modified the implementation from this website to include a salt: ...
5
votes
2answers
239 views

Database Handler Class

I've written this DB Handler class. Please review it and suggest any code edits or point out mistakes and security loop holes. Please also suggest a better way to handle things, if there is a security ...
0
votes
1answer
155 views

Decrease file size of encrypted file

I am making a Cryptography application and I noticed that the encrypted file is approximately 2 times bigger because I am encoding the files in base64. Are there any file encodings that take less ...
3
votes
1answer
35 views

CLI Command Search Tool - XML Framework

I'm working on the OSCP, and Information Security certificate based around penetration testing. CLI-based tools seem to be the core of most pen-testing assignments, so I'd like to build a tool aiding ...
11
votes
2answers
996 views

Is this safe against major XSS attacks?

I am building a classifieds website here in Portugal, and I'm now in the security phase. So until now, I already made what I think is a good measure against SQL injection: ...
6
votes
1answer
79 views

Secure way to store passwords

Here I'm trying to develop a simple framework for my own purpose. I'm using PHP and PDO. But, I'm still worried about my password security codes. Below I have posted my codes. it stored like these in ...
12
votes
3answers
575 views

Security issues in a SQL query and possible function?

By adding more and more features to my websites, I am now up to 7 different hard coded queries. I have read a lot about SQL injections and possible flaws and security issues, and wanted to make ...
0
votes
1answer
432 views

256 bit AES encryption in Android

I am using the following code to encrypt a file in an SD card in Android: I want the code to be reviewed for: Security (prioritize this) Coding Style Performance ...
4
votes
6answers
370 views

Login function in PHP

I've been working on a simple login script. The registration part is still to be coded, but I'm done the login part. Are there any security holes in my code? I'm using SHA-512 right now but I think ...
12
votes
5answers
2k views

PHP mail form is being abused

I'm nowhere near a PHP expert, but I have dabbled a bit. I can make things work just fine, but I am terrible at figuring out what is wrong. I was informed by our server admin that we have a mail ...
4
votes
2answers
431 views

PHP and MySQLi login script - is it secure / am I doing something wrong?

Below is the code for my login page. I haven't really used MySQL (especially OOP) before, so I'd like to know if I'm doing something inherently wrong. The code is working as expected, but I don't ...
12
votes
1answer
178 views

Cryptographically-secure super-secret government message transaction machine

-Hello Agent. Are you on a secure line? -Yes, secured. -Good, in 30 seconds the launch codes will be in your e-mail's inbox. You now have the go. Are you ready for the package? ...
5
votes
1answer
128 views

Java secured cookie - security issues?

I tested the play framework the last days and had mixed feelings about it. In the end, I don't use play for my new REST project. I use http://www.sparkjava.com as minimal server setup. But I really ...
17
votes
3answers
1k views

How is my CMS design? Any security, design, or other issues?

I am trying to learn PHP in depth by creating this personal CMS. I try to utilize OOP concepts and do best I can... The way I am trying to design this CMS is to keep including 'modules' within a page ...
5
votes
1answer
58 views

Clarity of encryption class

I have recently gotten back into development and I am wondering if the script I have just created is clearly documented and easily understandable throughout each step. Is it easy to understand? ...
3
votes
1answer
89 views

Login system, PDO and me - Part 2

This is a follow up question to: Login system, PDO and me Is this considered secure for a login script? ...