This tag is used for topics relating to application security and attacks against software.

learn more… | top users | synonyms

4
votes
1answer
32 views

Prepared Statements / MySQLi / PHP Registration/Login Form

I'm just looking for some feedback here. I'm fairly new to MySQLi & PHP, but I've been working at it for a bit now, and reading up on how to make secure login forms, avoid SQL injection etc. I'm a ...
4
votes
2answers
121 views

C# AES Encryption

I've been researching AES encryption a bit over the past several days. The official (MSDN) examples I've seen are encrypting and decrypting using the same AES instance. They don't go in to what to do ...
3
votes
1answer
33 views

Securing file uploading

I'm working on this snippet of code within a PHP file. The upload function is working but I suspect it is not secure. I move all the files into an upload folder within the site folder. I think that ...
-1
votes
0answers
20 views

Checking Spring Security Role in FreeMarker Template [closed]

I have been struggling with integrating Spring Security and FreeMarker template in Spring MVC application. I used a very simple login form to submit the username and password to ...
1
vote
2answers
65 views

Safety of contact form

I have made slight edits to a simple PHP contact form that I have found online. Can you see anything else that I could do to ensure that I am protected from email injections and spam? I have used ...
4
votes
2answers
71 views

Password generator

I am playing around with CCS/HTML/PHP and created a password generator: ...
2
votes
1answer
44 views

Uploading images via MySQL in Blob

Is it safe to upload images via MySQL in Blob? I've constructed my code like the following: ...
2
votes
1answer
75 views

Securing a form with image uploads

I am using PDO prepared statements to store user entered input and store that input to the database. The code will store a text input and 5 uploaded images. Will this code protect from data SQL ...
2
votes
1answer
48 views

Uploading multiple images using PHP

I literally spend all day working on PHP and I think I figured it out, but I need some reviews in order to make my code secure & okay. I am asking you about functionality here. The code below ...
4
votes
2answers
105 views

Protect from people bruteforcing the PHPSESSID

The PHPSESSID is stored in the clients cookie so I don't consider it as secure. Someone might bruteforce it and perform some action (like a Facebook status post) whenever a session was successfully ...
4
votes
2answers
83 views

Allow certain IP addresses to run a C++ program

I coded an executable program (.exe) that I only want run either from my home computer, our main server, or people in our development team. I have coded logic that will only allow the program to be ...
3
votes
1answer
57 views

Making user login system secure with $_SESSION [closed]

I am hoping that someone can help me out here. I am creating a PHP web app that requires a user to login to view their data in the MySQL database. I just want to know if this is a good approach and ...
2
votes
1answer
79 views

PHP login redirect security

I wish to redirect users to the login page if they attempt to visit a page which requires them to be logged in. After logging in, however, I want to redirect the user back to their original ...
1
vote
0answers
45 views

AES encryption class

I am new to encryption and recently wanted to learn more about it. I researched how to do AES Encryption in java and assembled my own Java AES encryption class. I don't know if there are any major ...
2
votes
2answers
72 views

Preventing XSS attacks with proper escaping

The following page simulates XSS attacks and successfully (?) prevents them. I want to know if I've missed any other major attack vectors (or small ones) and/or if anyone has suggestions as to ...
5
votes
0answers
64 views

Security of login and register system

I need some help with my register and log in functions. I'm not sure if I have understood bcrypt correctly either. I'm doubting the security of it, what do you ...
3
votes
2answers
75 views

PHP application configuration

I've started looking at Heroku for application hosting and deployment and it appears that my configuration constants need to be stored in environment variables. I can do this in Heroku, but my ...
3
votes
2answers
113 views

PHP secure random number generator

I just wrote this function and I was curious if anyone could find any flaws in it? It look pretty secure to me but I just want to make sure since I'm no cryptography expert. ...
2
votes
2answers
56 views

Social network message board website security

I have a script that contains functions from login in to posting status to friend request send and receive. Pretty much a social network script. Anyways i think my security is not up to date so if ...
0
votes
1answer
62 views

Including a page specified in query string

This is how I include a page depending by name. Example URL: http://www.page.com/index.php?page=admin where ...
1
vote
2answers
47 views

Safety of globalizing config data

I have some framework in PHP/MySQL for developing web services. Finally my code works on two servers - production and developer. My idea is to create one code without differences, which will work ...
1
vote
0answers
64 views

Security of blog system

I just want to know if my PHP code is secure and if it's as clean as it can be. I'm trying to make a blog system and I want to make sure all my users information is safe and secure, although this is ...
1
vote
0answers
32 views

Safely include requested pages without a whitelist

Is this pretty safe from breakout attempts? I'd rather not make a whitelist and check if the requested page is in the array since theres a ton of pages. And I wanna keep it clean. So I'm looking for a ...
2
votes
1answer
94 views

Script for a multi-user webapp database connection

I have the following working script which I use for my database connection for a multi-user webapp. I use a different database for the login, this script is called only after the user is successfully ...
4
votes
1answer
138 views

Encrypting data on client side and passing it to server side

I'm passing the data to PHP server side which will use the information later as this: ...
3
votes
1answer
80 views

Secure INSERTs with Mysqli

Is this code well protected, and if not, could you tell me how it might be exploited and how to secure it? I'm using mysqli. ...
1
vote
1answer
64 views

Security of ProtectedObject

Is ProtectedObject really secure? Otherwise, do you have any advice? ...
22
votes
4answers
808 views

Memory with a twist

Description This is the good old game Memory with a twist: Every time you pick a wrong pair, the two tiles you chose will switch their location. So sometimes you might think that a tile is at one ...
1
vote
1answer
69 views

Automatic password security test for WordPress

I was bored the other day and wrote the following little script to attempt to find insecure passwords for WordPress blog owners so they could be notified of how easy it would be to crack their WP ...
3
votes
1answer
118 views

Security flaws in smartphone application

And could you give me any security and optimization recommendations? ...
5
votes
2answers
97 views

Secure password hashing implementation

I'm implementing a password hashing method for a website. The code below is part of the User class. Any pointers on what I could do better? ...
3
votes
1answer
80 views

Form validation evaluation to avoid exploits

Please advise if the form validation script below is secure enough to avoid most types (all types?) of contact form exploits? I ahve found this script online, added some extra php finctions in hope to ...
4
votes
2answers
75 views

Iteration of password hashing in PHP - follow-up

This is a follow-up question to Iteration of password hashing in PHP I've gone trough a lot of documentations and stuff to get a feel for this hashing jungle, and done some adjustments to my code ...
5
votes
1answer
540 views

Prompt for Windows Credentials via Dialog [closed]

I have some code that requires the user (an admin) elevate to a system admin account to perform a task. I wish to prompt the user for the admin credentials to use. I believe returning a ...
6
votes
4answers
126 views

Iteration of password hashing in PHP

I'm trying to improve the security for my backend: ...
2
votes
1answer
32 views

Controller web interface security

I'm designing a web interface to a controller for my school's bell. Are there any security flaws in this code? The source code is available here. Front End: ...
5
votes
1answer
75 views

Updating an Nginx config file for SSL

This script updates a settings in ssl config file for Nginx. I generate DHEC key and then update the Nginx SSL file to that location. I also give an option for the user through arguments if they want ...
4
votes
2answers
195 views

PHP Session Wrapper Class

I recently worked on a system for the company I work for and would love some feedback on the following class for managing sessions. I don't claim to be a PHP guru but I like to think I gave it a try! ...
1
vote
1answer
33 views

Loop through post and use in query

so i'm using a foreach loop to loop through a form i've send with javascript. In this loop I use the keys(input fields names) and values(input values) and use them to build my query, I still check for ...
-1
votes
1answer
96 views
2
votes
3answers
74 views

Including file based on user input: Efficiency and Security

Currently I'm using this code: ...
7
votes
4answers
141 views

Simple compression algorithm

An implementation of a simple compression algorithm that's featured in a programming practice book. My goals: Robust: All error conditions must be handled properly. The specification indicated in ...
3
votes
1answer
42 views

Escaping photo caption to avoid cross site script attack

I am a PHP newbie and this is part of a gallery code. I recently read about SQL injection and cross site scripting attack, I am trying to avoid that by html escaping on dynamically produced data. I am ...
3
votes
2answers
789 views

Encryption-decryption method

My encryption algorithm I'm using this algorithm in order to encrypt notes users save on my site: ...
5
votes
1answer
316 views

PDO Login/Register system I've been working on

I'm relatively new to PHP and programming as whole. I'm sure my code could be better in a lot of ways, most of which I can't fully grasp at the moment. As it stands I'm trying to avoid the general ...
2
votes
2answers
168 views

Shopping Cart Handler Class - PHP

I've written an eCommerce shopping cart handler class in PHP. Please review the code and inform me of any errors and/or badly written code and/or badly handled logics. ...
4
votes
1answer
478 views

BouncyCastle Rijndael 256 Implementation

I modified the implementation from this website to include a salt: ...
5
votes
2answers
256 views

Database Handler Class

I've written this DB Handler class. Please review it and suggest any code edits or point out mistakes and security loop holes. Please also suggest a better way to handle things, if there is a security ...
0
votes
1answer
230 views

Decrease file size of encrypted file

I am making a Cryptography application and I noticed that the encrypted file is approximately 2 times bigger because I am encoding the files in base64. Are there any file encodings that take less ...
3
votes
1answer
36 views

CLI Command Search Tool - XML Framework

I'm working on the OSCP, and Information Security certificate based around penetration testing. CLI-based tools seem to be the core of most pen-testing assignments, so I'd like to build a tool aiding ...