This tag is used for topics relating to application security and attacks against software.

learn more… | top users | synonyms

3
votes
0answers
35 views

Security of login and register system

I need some help with my register/login functions. I'm not sure if I understood bcrypt correctly either. Is this good or do I have to do any changes? Did I miss ...
2
votes
1answer
33 views

PHP application configuration

I've started looking at Heroku for application hosting and deployment and it appears that my configuration constants need to be stored in environment variables. I can do this in Heroku, but my ...
2
votes
2answers
99 views

PHP secure random number generator

I just wrote this function and I was curious if anyone could find any flaws in it? It look pretty secure to me but I just want to make sure since I'm no cryptography expert. ...
2
votes
2answers
45 views

Social network message board website security

I have a script that contains functions from login in to posting status to friend request send and receive. Pretty much a social network script. Anyways i think my security is not up to date so if ...
0
votes
1answer
52 views

Including a page specified in query string

This is how I include a page depending by name. Example URL: http://www.page.com/index.php?page=admin where ...
1
vote
2answers
41 views

Safety of globalizing config data

I have some framework in PHP/MySQL for developing web services. Finally my code works on two servers - production and developer. My idea is to create one code without differences, which will work ...
1
vote
0answers
57 views

Security of blog system

I just want to know if my PHP code is secure and if it's as clean as it can be. I'm trying to make a blog system and I want to make sure all my users information is safe and secure, although this is ...
1
vote
0answers
29 views

Safely include requested pages without a whitelist

Is this pretty safe from breakout attempts? I'd rather not make a whitelist and check if the requested page is in the array since theres a ton of pages. And I wanna keep it clean. So I'm looking for a ...
2
votes
1answer
84 views

Script for a multi-user webapp database connection

I have the following working script which I use for my database connection for a multi-user webapp. I use a different database for the login, this script is called only after the user is successfully ...
4
votes
1answer
88 views

Encrypting data on client side and passing it to server side

I'm passing the data to PHP server side which will use the information later as this: ...
3
votes
1answer
45 views

Secure INSERTs with Mysqli

Is this code well protected, and if not, could you tell me how it might be exploited and how to secure it? I'm using mysqli. ...
1
vote
1answer
62 views

Security of ProtectedObject

Is ProtectedObject really secure? Otherwise, do you have any advice? ...
11
votes
2answers
634 views

Memory with a twist

Description This is the good old game Memory with a twist: Every time you pick a wrong pair, the two tiles you chose will switch their location. So sometimes you might think that a tile is at one ...
1
vote
1answer
56 views

Automatic password security test for WordPress

I was bored the other day and wrote the following little script to attempt to find insecure passwords for WordPress blog owners so they could be notified of how easy it would be to crack their WP ...
3
votes
1answer
113 views

Security flaws in smartphone application

And could you give me any security and optimization recommendations? ...
5
votes
2answers
80 views

Secure password hashing implementation

I'm implementing a password hashing method for a website. The code below is part of the User class. Any pointers on what I could do better? ...
3
votes
1answer
68 views

Form validation evaluation to avoid exploits

Please advise if the form validation script below is secure enough to avoid most types (all types?) of contact form exploits? I ahve found this script online, added some extra php finctions in hope to ...
4
votes
2answers
68 views

Iteration of password hashing in PHP - follow-up

This is a follow-up question to Iteration of password hashing in PHP I've gone trough a lot of documentations and stuff to get a feel for this hashing jungle, and done some adjustments to my code ...
5
votes
1answer
257 views

Prompt for Windows Credentials via Dialog [closed]

I have some code that requires the user (an admin) elevate to a system admin account to perform a task. I wish to prompt the user for the admin credentials to use. I believe returning a ...
6
votes
4answers
125 views

Iteration of password hashing in PHP

I'm trying to improve the security for my backend: ...
2
votes
1answer
31 views

Controller web interface security

I'm designing a web interface to a controller for my school's bell. Are there any security flaws in this code? The source code is available here. Front End: ...
5
votes
1answer
71 views

Updating an Nginx config file for SSL

This script updates a settings in ssl config file for Nginx. I generate DHEC key and then update the Nginx SSL file to that location. I also give an option for the user through arguments if they want ...
4
votes
2answers
99 views

PHP Session Wrapper Class

I recently worked on a system for the company I work for and would love some feedback on the following class for managing sessions. I don't claim to be a PHP guru but I like to think I gave it a try! ...
1
vote
1answer
30 views

Loop through post and use in query

so i'm using a foreach loop to loop through a form i've send with javascript. In this loop I use the keys(input fields names) and values(input values) and use them to build my query, I still check for ...
-1
votes
1answer
59 views
2
votes
3answers
72 views

Including file based on user input: Efficiency and Security

Currently I'm using this code: ...
7
votes
4answers
137 views

Simple compression algorithm

An implementation of a simple compression algorithm that's featured in a programming practice book. My goals: Robust: All error conditions must be handled properly. The specification indicated in ...
3
votes
1answer
40 views

Escaping photo caption to avoid cross site script attack

I am a PHP newbie and this is part of a gallery code. I recently read about SQL injection and cross site scripting attack, I am trying to avoid that by html escaping on dynamically produced data. I am ...
3
votes
2answers
250 views

Encryption-decryption method

My encryption algorithm I'm using this algorithm in order to encrypt notes users save on my site: ...
5
votes
1answer
154 views

PDO Login/Register system I've been working on

I'm relatively new to PHP and programming as whole. I'm sure my code could be better in a lot of ways, most of which I can't fully grasp at the moment. As it stands I'm trying to avoid the general ...
2
votes
2answers
117 views

Shopping Cart Handler Class - PHP

I've written an eCommerce shopping cart handler class in PHP. Please review the code and inform me of any errors and/or badly written code and/or badly handled logics. ...
3
votes
1answer
264 views

BouncyCastle Rijndael 256 Implementation

I modified the implementation from this website to include a salt: ...
5
votes
2answers
235 views

Database Handler Class

I've written this DB Handler class. Please review it and suggest any code edits or point out mistakes and security loop holes. Please also suggest a better way to handle things, if there is a security ...
0
votes
1answer
131 views

Decrease file size of encrypted file

I am making a Cryptography application and I noticed that the encrypted file is approximately 2 times bigger because I am encoding the files in base64. Are there any file encodings that take less ...
3
votes
1answer
35 views

CLI Command Search Tool - XML Framework

I'm working on the OSCP, and Information Security certificate based around penetration testing. CLI-based tools seem to be the core of most pen-testing assignments, so I'd like to build a tool aiding ...
11
votes
2answers
995 views

Is this safe against major XSS attacks?

I am building a classifieds website here in Portugal, and I'm now in the security phase. So until now, I already made what I think is a good measure against SQL injection: ...
6
votes
1answer
78 views

Secure way to store passwords

Here I'm trying to develop a simple framework for my own purpose. I'm using PHP and PDO. But, I'm still worried about my password security codes. Below I have posted my codes. it stored like these in ...
12
votes
3answers
560 views

Security issues in a SQL query and possible function?

By adding more and more features to my websites, I am now up to 7 different hard coded queries. I have read a lot about SQL injections and possible flaws and security issues, and wanted to make ...
0
votes
1answer
302 views

256 bit AES encryption in Android

I am using the following code to encrypt a file in an SD card in Android: I want the code to be reviewed for: Security (prioritize this) Coding Style Performance ...
4
votes
6answers
335 views

Login function in PHP

I've been working on a simple login script. The registration part is still to be coded, but I'm done the login part. Are there any security holes in my code? I'm using SHA-512 right now but I think ...
12
votes
5answers
2k views

PHP mail form is being abused

I'm nowhere near a PHP expert, but I have dabbled a bit. I can make things work just fine, but I am terrible at figuring out what is wrong. I was informed by our server admin that we have a mail ...
4
votes
2answers
362 views

PHP and MySQLi login script - is it secure / am I doing something wrong?

Below is the code for my login page. I haven't really used MySQL (especially OOP) before, so I'd like to know if I'm doing something inherently wrong. The code is working as expected, but I don't ...
12
votes
1answer
175 views

Cryptographically-secure super-secret government message transaction machine

-Hello Agent. Are you on a secure line? -Yes, secured. -Good, in 30 seconds the launch codes will be in your e-mail's inbox. You now have the go. Are you ready for the package? ...
5
votes
1answer
120 views

Java secured cookie - security issues?

I tested the play framework the last days and had mixed feelings about it. In the end, I don't use play for my new REST project. I use http://www.sparkjava.com as minimal server setup. But I really ...
17
votes
3answers
1k views

How is my CMS design? Any security, design, or other issues?

I am trying to learn PHP in depth by creating this personal CMS. I try to utilize OOP concepts and do best I can... The way I am trying to design this CMS is to keep including 'modules' within a page ...
5
votes
1answer
58 views

Clarity of encryption class

I have recently gotten back into development and I am wondering if the script I have just created is clearly documented and easily understandable throughout each step. Is it easy to understand? ...
3
votes
1answer
79 views

Login system, PDO and me - Part 2

This is a follow up question to: Login system, PDO and me Is this considered secure for a login script? ...
6
votes
1answer
139 views

Secure password-hashing in Java

Here is an article on password hashing, along with an implementation. Is this code secure with number of iterations 10000, key length 256 and salt bytes 32? Is there a rule-of-thumb for key ...
7
votes
2answers
746 views

Protect database from SQL Injection and similar attacks - PHP

I am doubtful about the security of my PHP code. I am new to programming, but want to learn how to secure things, protect my databases from SQL injection, and other best practices. I'd like to know if ...
2
votes
0answers
34 views

Application Class Security

Is my Application.php class secure for continuing development? The Application.php acts as a registry for the whole application. I tried not to rewrite already working code that is being pulled from ...