PHP Güvenlik Notları - Speaker Deck

Slide 1

Slide 1 text

PHP Güvenlik Notları Friday, November 9, 12

Slide 2

Slide 2 text

PHP Güvenlik Notları Kod Okunurluğu PHP Ayarları SQL Injection Cross-site Scripting (XSS) Cross-site Request Forgery (CSRF) Friday, November 9, 12

Slide 3

Slide 3 text

Kod Okunurluğu Friday, November 9, 12

Slide 4

Slide 4 text

PHP Ayarları Her zaman: register_globals = Off allow_url_include, allow_url_fopen error_reporting, display_errors, log_errors Friday, November 9, 12

Slide 5

Slide 5 text

SQL Injection SELECT * FROM tablo WHERE id = $id register_globals = Off mysql_real_escape_string, pg_escape_string, PDO filter_input, filter_var Typecasting (integer) (boolean) (double) (float) addslashes = Yeterli değil! Friday, November 9, 12

Slide 6

Slide 6 text

Cross-site Scripting (XSS) include($dosya); echo $kullanicidan_gelen_veri; register_globals = Off allow_url_include = Off basename, realpath, preg_match htmlspecialchars, htmlentities, strip_tags Friday, November 9, 12

Slide 7

Slide 7 text

Cross-site Request Forgery (CSRF)

Oturum bazlı doğrulayıcı anahtarlar (token) $_SERVER[‘HTTP_REFERER’] kontrol Ajax: $_SERVER[‘HTTP_X_REQUESTED_WITH’] kontrol Friday, November 9, 12

Slide 8

Slide 8 text

Sorular? Friday, November 9, 12

Slide 9

Slide 9 text

PHP ve Web Güvenliği ezber kartları! Friday, November 9, 12

Slide 10

Slide 10 text

Teşekkürler! http://php.net/manual/tr/security.php http://shiflett.org/php-security.pdf http://hi.do http://github.com/hdogan Twitter @hdogan Friday, November 9, 12