how secure is php

otuatail

This is interesting. I had a problem with a web page and asked another news group some time ago when I was new to php programming.
They told me there was a problem with my php code. An example of this is ...

<?php
include ("HCfunctions.inc")
?>

They pointed out that I had left out a semi-colon. How did they know as I never supplied the code, only a link to the web page. This is disturbing as it opens the door to seriouse hacking.

Desmond.

laserlight

Even more interestingly, the "missing" semi-colon is not a problem since that statement is terminated by the closing ?>.

I suspect that the part about you leaving out a semi-colon has to do with the code in HCfunctions.inc. Unless the .inc extension has some special treatment, e.g., treated like .php, by your webserver, or HCfunctions.inc is in a directory that is denied public access (not likely given that it is relative to the current script's location), a person viewing that file would see the PHP code contained within it. You probably mentioned HCfunctions.inc, and thus people were able to deduce its location and view it.

otuatail

Sorry. That was a bad example. The point I was making was this guy was able to post a reply to me showing my php code in its entirety with the html. Please ignore the semi colon issue what I showed you above is an example of what he was able to see. BUT you can't see PHP code can you ?????

Desmond.

laserlight

otuatail wrote:
BUT you can't see PHP code can you ?

Assuming that the web server does not fail to parse the PHP code and just sends it as clientside output, then yes, one would only be served the output of the script.

otuatail

Ok so what you are saying is that if there is an error in my php then anyone
Can see my entire code. every single line from 1 to 1000 in there favourate web browser.

I could not see it in my web browser. I did ask him how he saw it but he declined to reply.

laserlight

otuatail wrote:
Ok so what you are saying is that if there is an error in my php then anyone
Can see my entire code. every single line from 1 to 1000 in there favourate web browser.

No, if there was an error with your PHP code, either the error message would be displayed (i.e., display_errors is turned on), or the output would be blank. What I am talking about is the possibility of a server bug/glitch/misconfiguration where for some reason the server, instead of invoking the PHP interpreter, just serves your script's code as-is.

otuatail wrote:
I did ask him how he saw it but he declined to reply.

If you are on shared hosting, one possibility is that the person also had access to the server, and was able to read your code as the file permissions was not properly set and there was no "chroot jail" to prevent users from spying on each other.

otuatail

Ok. I don't know what happened. He copied my entire code + html content and pasted the entire lot into a reply. I only saw a basic error. He would not spill the beans. I have also posted another subject htaccess as I am trying to get around the possible security.

Thanks.

Desmond.

halojoy

It is not recommended
to use .inc extension or .txt for include pages.
Server will pass them as text files if they are browsed directly.

We should use .php extension:
pagename.inc.php will be okay

True is there is 100% security.
This is why we should take care, especially when we put Passwords and such into php pages.
Say the webserver will have some error that disables PHP.
What will happen is that php code will be displayed as plain text!
Because the tag <?php will not work anymore.

laserlight

Considering that you are on shared hosting, I think my scenario where the fellow has an account on the same server is the most likely.

halojoy wrote:
It is not recommended
to use .inc extension or .txt for include pages.
Server will pass them as text files if they are browsed directly.

We should use .php extension:
pagename.inc.php will be okay

It would be even better to place those files in a directory for which public access is denied, e.g., outside of the document root, if the web server is configured properly.

otuatail

If this happens is this not a security issue with my hosting company. Wat do I do with my php functions code (lots of it) and my user name password (which is in a seperate code page). It must exsist somewhere if not in a htaccess folder then where?

laserlight

otuatail wrote:
If this happens is this not a security issue with my hosting company.

Maybe, in the sense that they probably should setup a chroot jail (but this might pose its own set of problems, and I am afraid that I am not sure of the details). But anyway, I suspect that one cannot really get security with shared hosting.

otuatail wrote:
Wat do I do with my php functions code (lots of it) and my user name password (which is in a seperate code page).

What is this username and password for?

otuatail wrote:
It must exsist somewhere if not in a htaccess folder then where?

You can try placing the code in files outside of your document root, and change their permissions such that only you can read from and write to them (i.e., chmod 0600 with respect to Unix file permissions).

otuatail

I thought putting them in a sub folder with htaccess would be the way. simply chod to 0600. This is Owner permissions Read + Write

<?php
include ("securefolder/HCfunctions.php");
?>

a failure of my hosting provider as stated above whould show all content.

otuatail

<?php
include ("securefolder/HCfunctions.php");
?>

If I se this file to 600, the web page does not get displayed. Changing it to 604 or 644 works.
That means I have to set it as publicly readable. This means it can be hacked and seen.