Tagged Questions

This tag is used for topics relating to application security and attacks against software.

learn more… | top users | synonyms

3
votes
1answer
27 views

Secure INSERTs with Mysqli

Is this code well protected, and if not, could you tell me how it might be exploited and how to secure it? I'm using mysqli. ...
1
vote
1answer
57 views

Security of ProtectedObject

Is ProtectedObject really secure? Otherwise, do you have any advice? ...
11
votes
2answers
616 views

Memory with a twist

Description This is the good old game Memory with a twist: Every time you pick a wrong pair, the two tiles you chose will switch their location. So sometimes you might think that a tile is at one ...
1
vote
1answer
50 views

Automatic password security test for WordPress

I was bored the other day and wrote the following little script to attempt to find insecure passwords for WordPress blog owners so they could be notified of how easy it would be to crack their WP ...
6
votes
0answers
41 views

Unlock codes for a mobile app [migrated]

This is for an Android (via Cordova/Phonegap) game project. My goal is to be able to provide a "promo code" that will allow anyone to unlock the game for free, but I want to limit each code to only ...
3
votes
1answer
108 views

Security flaws in smartphone application

And could you give me any security and optimization recommendations? ...
5
votes
2answers
73 views

Secure password hashing implementation

I'm implementing a password hashing method for a website. The code below is part of the User class. Any pointers on what I could do better? ...
3
votes
1answer
54 views

Form validation evaluation to avoid exploits

Please advise if the form validation script below is secure enough to avoid most types (all types?) of contact form exploits? I ahve found this script online, added some extra php finctions in hope to ...
4
votes
2answers
62 views

Iteration of password hashing in PHP - follow-up

This is a follow-up question to Iteration of password hashing in PHP I've gone trough a lot of documentations and stuff to get a feel for this hashing jungle, and done some adjustments to my code ...
5
votes
1answer
126 views

Prompt for Windows Credentials via Dialog [closed]

I have some code that requires the user (an admin) elevate to a system admin account to perform a task. I wish to prompt the user for the admin credentials to use. I believe returning a ...
6
votes
4answers
121 views

Iteration of password hashing in PHP

I'm trying to improve the security for my backend: ...
2
votes
1answer
30 views

Controller web interface security

I'm designing a web interface to a controller for my school's bell. Are there any security flaws in this code? The source code is available here. Front End: ...
5
votes
1answer
68 views

Updating an Nginx config file for SSL

This script updates a settings in ssl config file for Nginx. I generate DHEC key and then update the Nginx SSL file to that location. I also give an option for the user through arguments if they want ...
4
votes
2answers
75 views

PHP Session Wrapper Class

I recently worked on a system for the company I work for and would love some feedback on the following class for managing sessions. I don't claim to be a PHP guru but I like to think I gave it a try! ...
1
vote
1answer
29 views

Loop through post and use in query

so i'm using a foreach loop to loop through a form i've send with javascript. In this loop I use the keys(input fields names) and values(input values) and use them to build my query, I still check for ...
-1
votes
1answer
51 views
2
votes
3answers
71 views

Including file based on user input: Efficiency and Security

Currently I'm using this code: ...
7
votes
4answers
129 views

Simple compression algorithm

An implementation of a simple compression algorithm that's featured in a programming practice book. My goals: Robust: All error conditions must be handled properly. The specification indicated in ...
3
votes
1answer
40 views

Escaping photo caption to avoid cross site script attack

I am a PHP newbie and this is part of a gallery code. I recently read about SQL injection and cross site scripting attack, I am trying to avoid that by html escaping on dynamically produced data. I am ...
3
votes
2answers
148 views

Encryption-decryption method

My encryption algorithm I'm using this algorithm in order to encrypt notes users save on my site: ...
5
votes
1answer
129 views

PDO Login/Register system I've been working on

I'm relatively new to PHP and programming as whole. I'm sure my code could be better in a lot of ways, most of which I can't fully grasp at the moment. As it stands I'm trying to avoid the general ...
2
votes
2answers
102 views

Shopping Cart Handler Class - PHP

I've written an eCommerce shopping cart handler class in PHP. Please review the code and inform me of any errors and/or badly written code and/or badly handled logics. ...
3
votes
1answer
148 views

BouncyCastle Rijndael 256 Implementation

I modified the implementation from this website to include a salt: ...
5
votes
2answers
231 views

Database Handler Class

I've written this DB Handler class. Please review it and suggest any code edits or point out mistakes and security loop holes. Please also suggest a better way to handle things, if there is a security ...
0
votes
1answer
101 views

Decrease file size of encrypted file

I am making a Cryptography application and I noticed that the encrypted file is approximately 2 times bigger because I am encoding the files in base64. Are there any file encodings that take less ...
3
votes
1answer
33 views

CLI Command Search Tool - XML Framework

I'm working on the OSCP, and Information Security certificate based around penetration testing. CLI-based tools seem to be the core of most pen-testing assignments, so I'd like to build a tool aiding ...
11
votes
2answers
992 views

Is this safe against major XSS attacks?

I am building a classifieds website here in Portugal, and I'm now in the security phase. So until now, I already made what I think is a good measure against SQL injection: ...
6
votes
1answer
74 views

Secure way to store passwords

Here I'm trying to develop a simple framework for my own purpose. I'm using PHP and PDO. But, I'm still worried about my password security codes. Below I have posted my codes. it stored like these in ...
12
votes
3answers
546 views

Security issues in a SQL query and possible function?

By adding more and more features to my websites, I am now up to 7 different hard coded queries. I have read a lot about SQL injections and possible flaws and security issues, and wanted to make ...
0
votes
1answer
159 views

256 bit AES encryption in Android

I am using the following code to encrypt a file in an SD card in Android: I want the code to be reviewed for: Security (prioritize this) Coding Style Performance ...
4
votes
6answers
304 views

Login function in PHP

I've been working on a simple login script. The registration part is still to be coded, but I'm done the login part. Are there any security holes in my code? I'm using SHA-512 right now but I think ...
12
votes
5answers
2k views

PHP mail form is being abused

I'm nowhere near a PHP expert, but I have dabbled a bit. I can make things work just fine, but I am terrible at figuring out what is wrong. I was informed by our server admin that we have a mail ...
4
votes
2answers
268 views

PHP and MySQLi login script - is it secure / am I doing something wrong?

Below is the code for my login page. I haven't really used MySQL (especially OOP) before, so I'd like to know if I'm doing something inherently wrong. The code is working as expected, but I don't ...
12
votes
1answer
171 views

Cryptographically-secure super-secret government message transaction machine

-Hello Agent. Are you on a secure line? -Yes, secured. -Good, in 30 seconds the launch codes will be in your e-mail's inbox. You now have the go. Are you ready for the package? ...
5
votes
1answer
107 views

Java secured cookie - security issues?

I tested the play framework the last days and had mixed feelings about it. In the end, I don't use play for my new REST project. I use http://www.sparkjava.com as minimal server setup. But I really ...
17
votes
3answers
1k views

How is my CMS design? Any security, design, or other issues?

I am trying to learn PHP in depth by creating this personal CMS. I try to utilize OOP concepts and do best I can... The way I am trying to design this CMS is to keep including 'modules' within a page ...
5
votes
1answer
55 views

Clarity of encryption class

I have recently gotten back into development and I am wondering if the script I have just created is clearly documented and easily understandable throughout each step. Is it easy to understand? ...
3
votes
1answer
70 views

Login system, PDO and me - Part 2

This is a follow up question to: Login system, PDO and me Is this considered secure for a login script? ...
6
votes
1answer
110 views

Secure password-hashing in Java

Here is an article on password hashing, along with an implementation. Is this code secure with number of iterations 10000, key length 256 and salt bytes 32? Is there a rule-of-thumb for key ...
7
votes
2answers
628 views

Protect database from SQL Injection and similar attacks - PHP

I am doubtful about the security of my PHP code. I am new to programming, but want to learn how to secure things, protect my databases from SQL injection, and other best practices. I'd like to know if ...
2
votes
0answers
34 views

Application Class Security

Is my Application.php class secure for continuing development? The Application.php acts as a registry for the whole application. I tried not to rewrite already working code that is being pulled from ...
4
votes
0answers
104 views

Password-hashing method in Java [closed]

There is an article on Crackstation where they show you how to hash a password correctly. I've implemented the Java version of it which is working fine, but is the method they use secure? ...
7
votes
3answers
322 views

Functions to escape CSS rules in PHP

Some context I've been tasked with supplying an escaping function to arbitrary CSS values that are entered through a form. The goals and caveats are: I know it's bad practice to let users input ...
4
votes
1answer
172 views

Preventing session hijacking

I'm implementing a login script and I want it to be more secure: ...
4
votes
2answers
195 views

Updating necessary data using just one function

My objective is to update necessary data using one function instead of having different functions to update different fields. So, I've created one and I think this is not really elegant, efficient or ...
1
vote
3answers
138 views

Security of code snippets

Last time I made a website using PHP, I didn't know of PDO, so someone dropped all my tables. I think I've made an improvement now. I'm sorry if there's a lot to go through, but I want to make sure ...
4
votes
1answer
48 views

Simple file downloader

On my website I want to offer some PDFs, ZIP files and images for download. They are all in the same folder and I could simply link to them like ...
2
votes
1answer
75 views

Login System Security Part 2

Old code: Login system security This is an update on the code and suggestions I received from generous users on the old thread. So same rules apply, just check it out, tell me what you think. Is ...
7
votes
4answers
503 views

Is this PHP code snippet safe?

Mostly asking for critiques of vulnerability. Am I using any functions or methods that are unsafe? ...
2
votes
1answer
104 views

Preg_match pattern for user input filtering

My users may need to supply a 'disease category' to my site. I need to let them use all alphanumeric characters, hyphens and single quotes. Would someone review this to see if they feel it's ...