Secure Coding in PHP Training Boot Camp

IT security and secure coding

• Nature of security
• IT security related terms
• Definition of risk
• Different aspects of IT security
• Requirements of different application areas
• IT security vs. secure coding
• From vulnerabilities to botnets and cybercrime
• Classification of security flaws

Web application vulnerabilities

Basics of cryptography

• Cryptosystems
• Symmetric-key cryptography
• Other cryptographic algorithms
• Asymmetric (public-key) cryptography
• Public Key Infrastructure (PKI)

Client-side security

• JavaScript security
• AJAX security
• HTML5 security

PHP security services

• ​Cryptography extensions in PHP
• Input validation APIs

PHP environment

• ​Server configuration
• Securing PHP configuration
• Environment security
• Hardening
• Configuration management

Advice and principles

• ​Matt Bishop’s principles of robust programming
• The security principles of Saltzer and Schroeder

Input validation

• Input validation concepts
• Remote PHP code execution
• MySQL validation errors – beyond SQL Injection
• Variable scope errors in PHP
• File uploads, spammers
• Environment manipulation

Improper use of security features

• ​Problems related to the use of security features
• Insecure randomness
• Weak PRNGs in PHP
• Stronger PRNGs we can use in PHP
• Password management – stored passwords
• Some usual password management problems
• Storing credentials for external systems
• Privacy violation
• Improper error and exception handling
• Classification of security flaws

Time and state problems

• ​Concurrency and threading
• Concurrency in PHP
• Preventing file race condition
• Double submit problem
• PHP session handling
• A PHP design flaw – open_basedir race condition
• Database race condition
• Denial of service possibilities
• Hashtable collision attack
• Classification of security flaws

Using security testing tools

• Web vulnerability scanners
• SQL injection tools
• Public database
• Google hacking
• Proxy servers and sniffers
• Exercise – Capturing network traffic
• Static code analysis