This tag is used for topics relating to application security and attacks against software.

learn more… | top users | synonyms

4
votes
0answers
19 views

Encrypting a string using AES/CBC/PKCS5PADDING

The code below takes a String and encrypts it using AES/CBC/PKCS5PADDING as transformation. I am learning as I go and I have a few questions about my code. Is ...
2
votes
1answer
25 views

PHP CSRF eliminator

There are three functions involved. The first Init is run before the content is parsed. The second is parseContent where the ...
7
votes
3answers
309 views

A Simple, One-Page PHP Admin Login (with prepared SQL statements)

First off, I want mention that this code works well. This is more of a request for suggestions... We're attempting to program a one-page, recursive, token-based admin shell that is safe from ...
14
votes
2answers
500 views

Python-like C string library

Most of the C code I have written has never been seen by anybody else, and I wonder if my code follows normal practices, especially how my code performs security-wise. The code is for a library that I ...
0
votes
0answers
12 views

IPtables for a secure nginx webserver

Based on my reading online and a few tutorials I have produced a set of iptables rules: ...
2
votes
1answer
55 views

PHP include page index.php?page=GET safety preg_replace

I found a lot of working codes to include page in page on Internet but I could not find a safe code. So I decided to create one myself. The pages will be only stored in folder /pages/ and whitelist ...
3
votes
2answers
63 views

Getting a local file with file_get_contents

my url is like page.php?path=content/x/y/z/aaa.md. Is the following php code secure? ...
5
votes
3answers
88 views

My lost password function

I'm trying to create a lost password function on my site. When a user enter their email it updates 2 columns in the users table with that email called: ...
2
votes
1answer
198 views

PHP user account login with salt

I'm creating a user account login with PHP and Mysql which will be used by school teachers. To login there are 3 items required : school, username and password. This will allow for 2 of "MRSMITH" in ...
3
votes
2answers
84 views

PHP contact form

I recently had my site hacked, with the main index file being overwritten (nothing else was touched). I'm assuming they hijacked my form input. Are there any vulnerabilities in the code or does this ...
1
vote
0answers
15 views

Persisting database row ID between controller actions on a multi-step “create item” form

I have a form on an anonymous site which has 3 steps. A user submits each step individually, in sequence (1-2-3). BUT, step 1 creates a new table row, while steps 2 and 3 only update the existing row ...
3
votes
3answers
119 views

PDO class and security

I have started a project in PHP with PDO and I'm almost done, but I've read somewhere that PDO escape alone is not secure and we have to consider some settings of PDP. I am a little confused about my ...
2
votes
2answers
52 views

Contact Form Sanitized Inputs

I have the following as my Ajax / PHP contact form on a site I am building. I have sanitized the inputs but just wanted to make sure I havent missed anything... ...
7
votes
2answers
672 views

Preventing SQL injection by converting all characters to their ASCII values

Scenario In order to prevent SQL injection, I'm converting every character of a string to be inserted in the database into its ASCII value before performing the query; in order to read the value of ...
4
votes
3answers
41 views

Security feedback sought on Perl code running command on unsafe filename in Unix env

I'm looking for security feedback on the following fully functional code. The code is trying to safely use the Unix 'file' command to give details about the file. A hard link is used to create a ...
4
votes
2answers
230 views

Simple calculator using eval

The following code is for a calculator made in ruby, I find that this way saves much time than having to build this calculator from scratch, especially that I want it to support BEMDAS operations. ...
7
votes
1answer
47 views

Restrictive stupid shell

I'm attempting to create a replacement shell for /bin/bash, that only permits commands defined by a read only config file. These commands will be run by absolute paths, and take no arguments. I'm not ...
2
votes
1answer
20 views

Formmailer safety

I am currently working on a PHP-Formmailer. I`m completely new to PHP but I do have knowledge about HTML, CSS and Javascript. I would learn PHP starting with the basics and everything but I´ll be ...
3
votes
1answer
51 views

Immunity of login/signup class to all types of attacks

I am going to use the following class which is very simple to use and get user info in pages: ...
3
votes
0answers
146 views

PHP login script security check

I made an admin login script for my own CMS website that I'm making in Code Igniter 2.2.1 and I'd like to know what are the potential threats or some holes that I might have left open. This is how it ...
3
votes
1answer
56 views

Check secure image upload

I want to upload images to server from browser window. I'm using this function for image upload. Images are uploaded by GD library. What is your opinion of this code? Is there still a way to upload a ...
4
votes
1answer
510 views

Prepared Statements / MySQLi / PHP Registration/Login Form

I'm just looking for some feedback here. I'm fairly new to MySQLi & PHP, but I've been working at it for a bit now, and reading up on how to make secure login forms, avoid SQL injection etc. I'm a ...
6
votes
2answers
433 views

C# AES Encryption

I've been researching AES encryption a bit over the past several days. The official (MSDN) examples I've seen are encrypting and decrypting using the same AES instance. They don't go in to what to do ...
3
votes
1answer
65 views

Securing file uploading

I'm working on this snippet of code within a PHP file. The upload function is working but I suspect it is not secure. I move all the files into an upload folder within the site folder. I think that ...
1
vote
2answers
81 views

Safety of contact form

I have made slight edits to a simple PHP contact form that I have found online. Can you see anything else that I could do to ensure that I am protected from email injections and spam? I have used ...
4
votes
2answers
97 views

Password generator

I am playing around with CSS/HTML/PHP and created a password generator: ...
2
votes
1answer
108 views

Uploading images via MySQL in Blob

Is it safe to upload images via MySQL in Blob? I've constructed my code like the following: ...
2
votes
1answer
116 views

Securing a form with image uploads

I am using PDO prepared statements to store user entered input and store that input to the database. The code will store a text input and 5 uploaded images. Will this code protect from data SQL ...
2
votes
1answer
127 views

Uploading multiple images using PHP

I literally spend all day working on PHP and I think I figured it out, but I need some reviews in order to make my code secure & okay. I am asking you about functionality here. The code below ...
4
votes
2answers
238 views

Protect from people bruteforcing the PHPSESSID

The PHPSESSID is stored in the clients cookie so I don't consider it as secure. Someone might bruteforce it and perform some action (like a Facebook status post) whenever a session was successfully ...
4
votes
2answers
91 views

Allow certain IP addresses to run a C++ program

I coded an executable program (.exe) that I only want run either from my home computer, our main server, or people in our development team. I have coded logic that will only allow the program to be ...
3
votes
1answer
76 views

Making user login system secure with $_SESSION [closed]

I am hoping that someone can help me out here. I am creating a PHP web app that requires a user to login to view their data in the MySQL database. I just want to know if this is a good approach and ...
2
votes
1answer
98 views

PHP login redirect security

I wish to redirect users to the login page if they attempt to visit a page which requires them to be logged in. After logging in, however, I want to redirect the user back to their original ...
1
vote
0answers
91 views

AES encryption class

I am new to encryption and recently wanted to learn more about it. I researched how to do AES Encryption in java and assembled my own Java AES encryption class. I don't know if there are any major ...
2
votes
2answers
136 views

Preventing XSS attacks with proper escaping

The following page simulates XSS attacks and successfully (?) prevents them. I want to know if I've missed any other major attack vectors (or small ones) and/or if anyone has suggestions as to ...
5
votes
0answers
90 views

Security of login and register system

I need some help with my register and log in functions. I'm not sure if I have understood bcrypt correctly either. I'm doubting the security of it, what do you ...
3
votes
2answers
80 views

PHP application configuration

I've started looking at Heroku for application hosting and deployment and it appears that my configuration constants need to be stored in environment variables. I can do this in Heroku, but my ...
3
votes
1answer
180 views

Secure random number generator

I just wrote this function and I was curious if anyone could find any flaws in it. It look pretty secure to me but I just want to make sure since I'm no cryptography expert. ...
2
votes
2answers
65 views

Social network message board website security

I have a script that contains functions from login in to posting status to friend request send and receive. Pretty much a social network script. Anyways i think my security is not up to date so if ...
0
votes
1answer
64 views

Including a page specified in query string

This is how I include a page depending by name. Example URL: http://www.page.com/index.php?page=admin where ...
1
vote
2answers
51 views

Safety of globalizing config data

I have some framework in PHP/MySQL for developing web services. Finally my code works on two servers - production and developer. My idea is to create one code without differences, which will work ...
1
vote
0answers
67 views

Security of blog system

I just want to know if my PHP code is secure and if it's as clean as it can be. I'm trying to make a blog system and I want to make sure all my users information is safe and secure, although this is ...
1
vote
0answers
33 views

Safely include requested pages without a whitelist

Is this pretty safe from breakout attempts? I'd rather not make a whitelist and check if the requested page is in the array since theres a ton of pages. And I wanna keep it clean. So I'm looking for a ...
2
votes
1answer
120 views

Script for a multi-user webapp database connection

I have the following working script which I use for my database connection for a multi-user webapp. I use a different database for the login, this script is called only after the user is successfully ...
4
votes
1answer
328 views

Encrypting data on client side and passing it to server side

I'm passing the data to PHP server side which will use the information later as this: ...
3
votes
1answer
125 views

Secure INSERTs with Mysqli

Is this code well protected, and if not, could you tell me how it might be exploited and how to secure it? I'm using mysqli. ...
1
vote
1answer
69 views

Security of ProtectedObject

Is ProtectedObject really secure? Otherwise, do you have any advice? ...
23
votes
4answers
845 views

Memory with a twist

Description This is the good old game Memory with a twist: Every time you pick a wrong pair, the two tiles you chose will switch their location. So sometimes you might think that a tile is at one ...
1
vote
1answer
83 views

Automatic password security test for WordPress

I was bored the other day and wrote the following little script to attempt to find insecure passwords for WordPress blog owners so they could be notified of how easy it would be to crack their WP ...
3
votes
1answer
118 views

Security flaws in smartphone application

And could you give me any security and optimization recommendations? ...