though only good programmer, hax0rs , skr1pt kidd3s know abt it (generally)

    1) YOU CANNOT MAKE A PHP SCRIPT THAT IS UNCONDITIONALLY SECURE. This is because it runs on a web server which has security flaws, using the php engine which has security flaws, over the http protocols which have security flaws, on an operating system that has security flaws.

    2) YOU CAN MAKE A PHP SCRIPT THAT IS COMPUTATIONALLY SECURE. So your script will be penetrable but it will be significantly difficult that the hacker won't bother.

    3) ANY SYSTEM IS ONLY AS STRONG AS ITS WEAKEST LINK. Make your program more secure then the rest of the system and you're in good shape.

      Well, you can not rely on HTTP_REFERER. A good start would be to encrypt a session variable and check it is comming OK.

        Originally posted by abx_2112
        Well, you can not rely on HTTP_REFERER. A good start would be to encrypt a session variable and check it is comming OK.

        yes that's a great start it's so much harder to load one of your pages in a hidden frame then it is to fake the http_referer.

          yes that's a great start it's so much harder to load one of your pages in a hidden frame then it is to fake the http_referer.

          Care to explain?

            hidden frame.... no border, no width, no height. would set the session variable. you could then load the image........

              FYI : reget download manager allows you to fake the referer (I sometimes use it to test my code)

                I feel I was (am) completely ignorant in this subject. I'm afraid I didnt give enough thought to the problem, so i deserve the sarcasm 😕

                yes that's a great start it's so much harder to load one of your pages in a hidden frame then it is to fake the http_referer.

                anyway, thinks for the info drawmack 🙂

                  Originally posted by abx_2112
                  I feel I was (am) completely ignorant in this subject. I'm afraid I didnt give enough thought to the problem, so i deserve the sarcasm 😕



                  anyway, thinks for the info drawmack 🙂

                  My sarcasm is not intended to offend. NP about the info

                    Wouldn't it be a better idea to set up admin privaleges in your database and set the page to check the cookie name against the database and see if that user has sufficient access to be allowed onto a page?

                      there is another problem with HTTP_REFERER. If a valid user is grabbing the file from your site as intended, it still may fail becuase some proxies will not send the referring page in the headers. You could be keeping legitimate users from seeing what you want them to see.

                      Bottom line, if you make a file public on your site, it's basically public for everyone to find. you can only do so much to limit usage, but a determined person will always find a way, unless you protect everything via htaccess.

                      • keith
                        6 years later

                        Uh, you resurrected a six-year-old thread to show that you got the wrong end of the stick?

                          5 days later
                          Weedpacket;10937009 wrote:

                          Uh, you resurrected a six-year-old thread to show that you got the wrong end of the stick?

                          Perhaps he found a bug in [man]date/man ?

                          Oh, no, I guess not. This tag prolly won't work, either. [man]if_pebkac/man. Ah, well.

                            Write a Reply...