This tag is used for topics relating to application security and attacks against software.

learn more… | top users | synonyms

0
votes
0answers
21 views

SecureString as SqlParameter value without GC concerns

The purpose here is to make it easy to use sensitive data that is already in the form of a SecureString (example) without converting it to a ...
5
votes
1answer
55 views

One way encoding a password

I wrote a script that one way encrypts a user's password by generating a key, and multiplies by the ASCII value of the character and the ASCII value of the key character at (the position that the ...
2
votes
3answers
57 views

A very secure procedural MySQLI login script against injections

I know there are other ways to create a login script like Object Oriented, Prepared Statements and PDO, but how about those old MySQL PHP users like me trying to change from old style to the new ways? ...
2
votes
1answer
46 views

Approach to MVC 4 windows group security to enable/disable controls in view

There are 3 window groups to add users and the application uses MVC 4. Here's my approach to add security attributes to my controllers and pass user's role to the view in order to enable/disable ...
3
votes
1answer
33 views

MySQL class that handles sanitization

I've written a MySQL class that handles sanitization of different data types. The reason I used this (and not prepared statements) is because this can be more dynamic. Prepared statmenets only ...
2
votes
1answer
42 views

Sanitizing function

This is a sanitizing function. Is this function secure enough? ...
5
votes
1answer
54 views

For a login portal, what security measures are needed to prevent unauthorized access?

I'm designing a login portal that has one angularjs page that displays/processes data queried from a database. I'm relying on a few php pages (a loginpage.php [verifies credentials/loads session ...
2
votes
1answer
68 views

PHP login system security using a database, cookies and sessions

I created a simple login system using just sessions but having to login every time gets annoying. That is why I'm no trying to save the sessions to my database linked to the user's account. I will ...
5
votes
1answer
91 views

Passing a password to a viewmodel

I've got a project I've been working on that connect to a file server and writes some data to a text file. In order to do this I added a textbox for the user to type their username and a passwordbox ...
5
votes
2answers
97 views

Encrypting a string using AES/CBC/PKCS5PADDING

The code below takes a String and encrypts it using AES/CBC/PKCS5PADDING as transformation. I am learning as I go and I have a few questions about my code. Is ...
2
votes
1answer
34 views

PHP CSRF eliminator

There are three functions involved. The first Init is run before the content is parsed. The second is parseContent where the ...
7
votes
3answers
391 views

A Simple, One-Page PHP Admin Login (with prepared SQL statements)

First off, I want mention that this code works well. This is more of a request for suggestions... We're attempting to program a one-page, recursive, token-based admin shell that is safe from ...
14
votes
2answers
510 views

Python-like C string library

Most of the C code I have written has never been seen by anybody else, and I wonder if my code follows normal practices, especially how my code performs security-wise. The code is for a library that I ...
2
votes
1answer
63 views

PHP include page index.php?page=GET safety preg_replace

I found a lot of working codes to include page in page on Internet but I could not find a safe code. So I decided to create one myself. The pages will be only stored in folder /pages/ and whitelist ...
3
votes
2answers
82 views

Getting a local file with file_get_contents

my url is like page.php?path=content/x/y/z/aaa.md. Is the following php code secure? ...
5
votes
3answers
90 views

My lost password function

I'm trying to create a lost password function on my site. When a user enter their email it updates 2 columns in the users table with that email called: ...
2
votes
1answer
220 views

PHP user account login with salt

I'm creating a user account login with PHP and Mysql which will be used by school teachers. To login there are 3 items required : school, username and password. This will allow for 2 of "MRSMITH" in ...
3
votes
2answers
92 views

PHP contact form

I recently had my site hacked, with the main index file being overwritten (nothing else was touched). I'm assuming they hijacked my form input. Are there any vulnerabilities in the code or does this ...
1
vote
0answers
19 views

Persisting database row ID between controller actions on a multi-step “create item” form

I have a form on an anonymous site which has 3 steps. A user submits each step individually, in sequence (1-2-3). BUT, step 1 creates a new table row, while steps 2 and 3 only update the existing row ...
3
votes
3answers
141 views

PDO class and security

I have started a project in PHP with PDO and I'm almost done, but I've read somewhere that PDO escape alone is not secure and we have to consider some settings of PDP. I am a little confused about my ...
2
votes
2answers
76 views

Contact Form Sanitized Inputs

I have the following as my Ajax / PHP contact form on a site I am building. I have sanitized the inputs but just wanted to make sure I havent missed anything... ...
7
votes
2answers
683 views

Preventing SQL injection by converting all characters to their ASCII values

Scenario In order to prevent SQL injection, I'm converting every character of a string to be inserted in the database into its ASCII value before performing the query; in order to read the value of ...
4
votes
3answers
43 views

Security feedback sought on Perl code running command on unsafe filename in Unix env

I'm looking for security feedback on the following fully functional code. The code is trying to safely use the Unix 'file' command to give details about the file. A hard link is used to create a ...
4
votes
2answers
236 views

Simple calculator using eval

The following code is for a calculator made in ruby, I find that this way saves much time than having to build this calculator from scratch, especially that I want it to support BEMDAS operations. ...
7
votes
1answer
49 views

Restrictive stupid shell

I'm attempting to create a replacement shell for /bin/bash, that only permits commands defined by a read only config file. These commands will be run by absolute paths, and take no arguments. I'm not ...
2
votes
1answer
20 views

Formmailer safety

I am currently working on a PHP-Formmailer. I`m completely new to PHP but I do have knowledge about HTML, CSS and Javascript. I would learn PHP starting with the basics and everything but I´ll be ...
3
votes
1answer
53 views

Immunity of login/signup class to all types of attacks

I am going to use the following class which is very simple to use and get user info in pages: ...
3
votes
0answers
170 views

PHP login script security check

I made an admin login script for my own CMS website that I'm making in Code Igniter 2.2.1 and I'd like to know what are the potential threats or some holes that I might have left open. This is how it ...
3
votes
1answer
59 views

Check secure image upload

I want to upload images to server from browser window. I'm using this function for image upload. Images are uploaded by GD library. What is your opinion of this code? Is there still a way to upload a ...
4
votes
1answer
719 views

Prepared Statements / MySQLi / PHP Registration/Login Form

I'm just looking for some feedback here. I'm fairly new to MySQLi & PHP, but I've been working at it for a bit now, and reading up on how to make secure login forms, avoid SQL injection etc. I'm a ...
6
votes
2answers
605 views

C# AES Encryption

I've been researching AES encryption a bit over the past several days. The official (MSDN) examples I've seen are encrypting and decrypting using the same AES instance. They don't go in to what to do ...
3
votes
1answer
72 views

Securing file uploading

I'm working on this snippet of code within a PHP file. The upload function is working but I suspect it is not secure. I move all the files into an upload folder within the site folder. I think that ...
1
vote
2answers
82 views

Safety of contact form

I have made slight edits to a simple PHP contact form that I have found online. Can you see anything else that I could do to ensure that I am protected from email injections and spam? I have used ...
4
votes
2answers
104 views

Password generator

I am playing around with CSS/HTML/PHP and created a password generator: ...
2
votes
1answer
139 views

Uploading images via MySQL in Blob

Is it safe to upload images via MySQL in Blob? I've constructed my code like the following: ...
2
votes
1answer
121 views

Securing a form with image uploads

I am using PDO prepared statements to store user entered input and store that input to the database. The code will store a text input and 5 uploaded images. Will this code protect from data SQL ...
2
votes
1answer
139 views

Uploading multiple images using PHP

I literally spend all day working on PHP and I think I figured it out, but I need some reviews in order to make my code secure & okay. I am asking you about functionality here. The code below ...
4
votes
2answers
386 views

Protect from people bruteforcing the PHPSESSID

The PHPSESSID is stored in the clients cookie so I don't consider it as secure. Someone might bruteforce it and perform some action (like a Facebook status post) whenever a session was successfully ...
4
votes
2answers
94 views

Allow certain IP addresses to run a C++ program

I coded an executable program (.exe) that I only want run either from my home computer, our main server, or people in our development team. I have coded logic that will only allow the program to be ...
3
votes
1answer
87 views

Making user login system secure with $_SESSION [closed]

I am hoping that someone can help me out here. I am creating a PHP web app that requires a user to login to view their data in the MySQL database. I just want to know if this is a good approach and ...
2
votes
1answer
100 views

PHP login redirect security

I wish to redirect users to the login page if they attempt to visit a page which requires them to be logged in. After logging in, however, I want to redirect the user back to their original ...
1
vote
0answers
110 views

AES encryption class

I am new to encryption and recently wanted to learn more about it. I researched how to do AES Encryption in java and assembled my own Java AES encryption class. I don't know if there are any major ...
2
votes
2answers
153 views

Preventing XSS attacks with proper escaping

The following page simulates XSS attacks and successfully (?) prevents them. I want to know if I've missed any other major attack vectors (or small ones) and/or if anyone has suggestions as to ...
5
votes
0answers
93 views

Security of login and register system

I need some help with my register and log in functions. I'm not sure if I have understood bcrypt correctly either. I'm doubting the security of it, what do you ...
3
votes
2answers
82 views

PHP application configuration

I've started looking at Heroku for application hosting and deployment and it appears that my configuration constants need to be stored in environment variables. I can do this in Heroku, but my ...
3
votes
1answer
191 views

Secure random number generator

I just wrote this function and I was curious if anyone could find any flaws in it. It look pretty secure to me but I just want to make sure since I'm no cryptography expert. ...
2
votes
2answers
69 views

Social network message board website security

I have a script that contains functions from login in to posting status to friend request send and receive. Pretty much a social network script. Anyways i think my security is not up to date so if ...
0
votes
1answer
65 views

Including a page specified in query string

This is how I include a page depending by name. Example URL: http://www.page.com/index.php?page=admin where ...
1
vote
2answers
51 views

Safety of globalizing config data

I have some framework in PHP/MySQL for developing web services. Finally my code works on two servers - production and developer. My idea is to create one code without differences, which will work ...
1
vote
0answers
67 views

Security of blog system

I just want to know if my PHP code is secure and if it's as clean as it can be. I'm trying to make a blog system and I want to make sure all my users information is safe and secure, although this is ...