I flew in to San Jose today to visit Zend, and later attend the
Zend/PHP Conference and Expo
(two days left... register now
if you haven't, and have the time to attend; the conference sessions promise
to be very interesting).
During the flight, I had plenty of time to go through
Ilia's Guide to PHP Security, which
I'd ordered several weeks ago, but hadn't had time to read since.
The thing about PHP security, and web security in general, is that there are
some very simple rules that have been around for a long time, most important
of which is: never trust your users.
Perl developed a special mode, taint mode, to deal with user input -- if
input hasn't been filtered and verified, it's considered tainted (and the
standard method for doing so is passing the data through a regexp).
Additionally, it's considered good practice in perl to 'use strict' and 'use
warnings', as these two pragmas will let the developer know when they're
succumbing to bad habits.
Ilia takes the lens of security and applies it to the PHP language. His
book is a pragmatic look at how to safely handle user input to prevent such
things as XSS attacks, SQL injection, and more. Most importantly, he
explains what the various dangers are, gives some examples of how to create
the attacks -- and then some methods for defending your script from them.
Covered are XSS attacks, SQL injection, code injection (via include files),
command injection, sessions, and session hijacking. He also has some tips on
being proactive -- building sandboxes and tar pits in which to monitor
hacker activity so you can see what you're up against.
I found that much of the theory that Ilia writes about is not new. However,
his examples often contained some nuggets of experience I'd never
considered. For instance, I have often used ImageMagick, but never
considered what would happen if I tried to convert an animated GIF to
another format (it creates several files, one for each frame) -- and how
that might affect my script (the expected filename will not be present). Nor
had I considered that character input may actually come in encoded -- which
would often be either invalid for the filters I create, or completely bypass
them.
On one particular point, I feel I must congratulate Ilia: he details the
complexity of creating secure applications, and also goes to some lengths to
show how just about any countermeasure can still be foiled by a determined
hacker. 100% secure applications that utilize user input are virtually
impossible -- but that doesn't mean we shouldn't strive for that goal.
The book is well written, in a conversational, almost conspiratorial, voice.
(Having had the pleasure of attending a session of Ilia's at php|Tropics, I
can say that his written voice is very similar to his presentation voice,
and very easy to follow.)
However, the book suffers from what appears to me to be quick editing --
there are quite a number of typographical errors throughout (I'd say, on
average, one every three pages), and a few areas where large sentences or
paragraphs should have been rewritten prior to publication. Layout also had
a few issues; on page 87, for instance, the page number was injected into
the text of the third paragraph, instead of placed at the page bottom, and
many examples started with a single line on the end of one page and
continued on the following page (a page break prior would have made these
easier to read).
All told, however, these editing and layout issues did not subtract from the
message. Ilia's book is a strong wake-up call to any php developer worth his
or her salt, and should be a part of any PHP developer's library.
