Do htmlspecialchars and mysql_real_escape_string keep my PHP code safe from injection?

Earlier today a question was asked regarding input validation strategies in web apps .

Login/session cookies, Ajax and security

I'm trying to determine the most secure method for an ajax based login form to authenticate and set a client side cookie. I've seen things about XSS attacks such as this:

How to overcome this security issue

I have implemented an ajax-polling script that calls an action in the server Controller every 10 seconds. With the response, I replace the content of a div :

How to Check Authenticity of an AJAX Request

I am designing a web site in which users solve puzzles as quickly as they can. JavaScript is used to time each puzzle, and the number of milliseconds is sent to the server via AJAX when the puzzle is completed. How can I ensure that the time received by the server was not forged by the user?

Using PHP/Apache to restrict access to static files (html, css, img, etc)

Lets say you have lots of html, css, js, img and etc files within a directory on your server. Normally, any user in internet-land could access those files by simply typing in the full URL like so: http://example.com/static-files/sub/index.html

JSON security best practices?

While researching the issue of JSON vs XML , I came across this question . Now one of the reasons to prefer JSON was listed as the ease of conversion in Javascript, namely with the eval() . Now this immediately struck me as potentially problematic from a security perspective.

How does this giant regex work?

I recently found the code below in one of my directories, in a file called doc.php . The file functions or links to a file manager. It's quite nicely done. Basically, it lists all the files in the current directory, and it lets you change directories.

How to secure database passwords in PHP?

When a PHP application makes a database connection it of course generally needs to pass a login and password. If I'm using a single, minimum-permission login for my application, then the PHP needs to know that login and password somewhere. What is the best way to secure that password? It seems like just writing it in the PHP code isn't a good idea.

Android Game Keeps Getting Hacked

So we've been through this several times now, we release a game (for cheap) and someone hacks it and puts it up on a mirror. We setup Google Alerts for all our apps, so we get told daily who's doing the hacking. So far, we have implemented the licensing service as Google has suggested, our salt is randomly made each time the license is initiated with the unique device ID. We run the check service once, when the application is started for the first time. We then generate a 512 character hash for the key and the stored value that is compared against in SharedPreferences from there on out.

In a PHP / Apache / Linux context, why exactly is chmod 777 dangerous?

Inspired by the discussion in this question , a maybe stupid question.

What is the best way to stop people hacking the PHP-based highscore table of a Flash game

I'm talking about an action game with no upper score limit and no way to verify the score on the server by replaying moves etc.

How does this giant regex work?

I recently found the code below in one of my directories, in a file called doc.php . The file functions or links to a file manager. It's quite nicely done. Basically, it lists all the files in the current directory, and it lets you change directories.

What"s the best method for sanitizing user input with PHP?

Is there a catchall function somewhere that works well for sanitizing user input for sql injection and XSS attacks, while still allowing certain types of html tags?

Storing PHP(/PHP-FPM/Apache)"s temporary-from-upload files in RAM rather than the filesystem (or encrypted only)?

Thread overview

I can unfortunately only accept one answer - but to anyone reading this, the entire thread is extremely valuable and contains the collective insights of many people. Depending on what you are hoping to achieve, the accepted answer may not be interesting to you . If you've come here through a search engine, please take a moment to read the whole thread .

PHP tutorial that is security-, accuracy- and maintainability-conscious?

Colleagues often ask me: “bobince”, they say*, “I want to learn PHP, but I know you're always ranting on about poor code which is full of errors and security holes. That's why I normally don't like talking to you really. But, I'm looking to learn PHP now and I'd like to be able to write good code. Where's a tutorial that will teach me how to do it properly, so my site won't get all hacked up and you won't get all cross at me?”

Secure hash and salt for PHP passwords

It is currently said that MD5 is partially unsafe. Taking this into consideration, I'd like to know which mechanism to use for password protection.

Why is char[] preferred over string for passwords?

In Swing , the password field has a getPassword() (returns char[] ) method instead of the usual getText() (returns String ) method. Similarly, I have come across a suggestion not to use String s to handle passwords. Why does String pose a threat to security when it comes to passwords?

Exploitable PHP functions

I'm trying to build a list of functions that can be used for arbitrary code execution. The purpose isn't to list functions that should be blacklisted or otherwise disallowed. Rather, I'd like to have a grep -able list of red-flag keywords handy when searching a compromised server for back-doors.

How should I ethically approach user password storage for later plaintext retrieval?

As I continue to build more and more websites and web applications I am often asked to store user's passwords in a way that they can be retrieved if/when the user has an issue (either to email a forgotten password link, walk them through over the phone, etc.) When I can I fight bitterly against this practice and I do a lot of ‘extra’ programming to make password resets and administrative assistance possible without storing their actual password.

What are the risks of PHP sessions?

So everyone says that sessions have security risks, I want to know what kind of risks are these? What can hackers do with sessions?