PHP/MySQL Security Checklist: The definitive practical guide

Question

After seeing this awesome guide on Stack and needing a practical PHP/MySQL security checklist in-house, I have decided to pay homage to the original guide.

What I need is a practical security checklist for PHP and MySQL. The contents here can function as the checklist, while the answers should function as the guides.

By practical I mean that each answer should avoid superfluous security theoretics and focus on real results. Most of us don't need to know about RFC3174 when you're suggesting to secure passwords using a SHA-1 hash. We just want to make passwords secure.

I will go through the entries from time to time and tidy them up so they have a consistent look and feel and it's easy to scan the list. Feel free to follow a simple "header - brief explanation - list of instructions - gotchas and extra info" template. I'll also link to the entries from the bullet list below so it's easy to find them later.

Procedural note: PLEASE pick one and only one of the below topics and answer it clearly and concisely. Don't try to jam a bunch of information into one answer. Don't just link to other resources - cut and paste with attribution if copyright allows, otherwise learn it and explain it in your own words (that is, don't make people leave this page to learn a task). Please comment on, or edit, an already existing answer unless your explanation is very different and you think the community is better served with a different explanation.

PHP

---

Validate user input
Guard your file system
Guard your sessions
Guard against XSS vulnerabilities
Guard against invalid POSTs
Guard against CRSF
Stop using $_REQUEST
Stop using register_globals

MySQL

---

Avoid SQL injection

Use mysql_real_escape_string to protect against SQL injection

Keep in mind that the above list is only a starter, and that many of the above topics will likely become sub-headers and are too broad to write on. Try to distill something smaller like "Stop using register_globals" rather than, say, trying to write an answer on XSS as a whole. Over time I hope everyone can add many more things.

Answer 1

Stop using $_REQUEST

$_REQUEST combines $_GET, $_POST, and $_COOKIE.

Why is this dangerous to use?
The inclusion of $_COOKIE is what makes this dangerous. If any of your form parameters have the same name as a cookie, things can start breaking in ways that become difficult to debug.

How can you avoid this?
You can avoid this behavior in one of three ways:

1. PHP 5.3 has the request_order config, which you can set to GP (as opposed to GPC). The default php.ini configuration now excludes the C for cookies.
2. Don't use $_REQUEST in your code. Instead, choose either $_GET or $_POST, or
3. Create your own $_REQUEST using a combination of $_GET and $_POST in your application's bootstrapper like so:
   $_REQUEST = array_merge($_GET, $_POST);

Answer 2

Use mysql_real_escape_string() to protect against SQL injection

You can use:

mysql_real_escape_string()

to make data safe before sending a query to MySQL, this will secure your queries from SQL injections.

Answer 3

While mysql_real_escape_string is fine, you really should be using PDO to query your databases. http://php.net/pdo.

Answer 4

Check out the PHP Security Guide, and the OWASP Top 10.

But in all reality your security check list should be the entire CWE system. There are over 1,000 vulnerabilities in this list. Weather or not you have to take these into consideration depends what you are doing.

Security isn't a check box, it isn't a mechanical set of rules to follow. As an exploit writer I attack the developers perception of the systems they are using. As an attacker my job is about creativity and persistence.

Answer 5

Avoiding SQL injection

Use prepared statements with bound parameters. When parameters are bound they are sent to the MySQL server outside the SQL and the server doesn't parse them as part of the SQL. The content of the parameters can therefore never be injected into your SQL to compromise your server.

This is safer than mysql_escape_real_string which relies on PHP detecting and escaping relevant characters.

http://www.php.net/manual/en/mysqli-stmt.bind-param.php
http://uk2.php.net/manual/en/pdostatement.bindparam.php