Popular Hacks
//Non-Persistent XSS
!
http://www.yourSite.com/
?page_num=2&per_page=50
!
Send the link to someone, boom
Slide 31
Slide 31 text
Popular Hacks
//Persistent XSS
!
Same idea, except with data that is
saved to the server and
re-displayed
Slide 32
Slide 32 text
Popular Hacks
//XSS Protection
!
Title
Hello
!
!
Slide 33
Slide 33 text
Popular Hacks
//Cross Site Request Forgery
//(CSRF)
!
http://yourSite.com/
users/12/delete
!
!
Slide 34
Slide 34 text
Popular Hacks
//CSRF Protection
!
POST / PUT / UPDATE / DELETE
behind forms with one-time use
tokens
!
!
Slide 35
Slide 35 text
Popular Hacks
//CSRF Protection
!
function generateCsrf() {
$token = mcrypt_create_iv(
16, MCRYPT_DEV_URANDOM);
Session::flash('csrfToken', $token);
return $token;
}
Slide 36
Slide 36 text
Popular Hacks
//CSRF Protection
!
if (
$_POST['token'] == Session::get(‘csrfToken')
) { … }
!
Slide 37
Slide 37 text
Unit Testing
Slide 38
Slide 38 text
No content
Slide 39
Slide 39 text
Unit Testing
PHPUnit
Behat
Mink
Selenium
CodeCeption
PHPSpec
Slide 40
Slide 40 text
Unit Testing
class ApiAuthTest extends PHPUnit_Framework_TestCase {
!
public function testVerify() {
!
$auth = new apiAuth();
$this->assertTrue($auth->verify());
Slide 41
Slide 41 text
Unit Testing
class ApiAuthTest extends PHPUnit_Framework_TestCase {
!
public function testVerify() {
!
$auth = new apiAuth();
$this->assertTrue($auth->verify());
Slide 42
Slide 42 text
Unit Testing
$ phpunit tests
!
PHPUnit 3.3.17 by Sebastian Bergmann.
Time: 0.01 seconds
OK (1 tests, 1 assertions)
Slide 43
Slide 43 text
Resources
Slide 44
Slide 44 text
No content
Slide 45
Slide 45 text
Resources
PHP.net
Slide 46
Slide 46 text
Resources
Modern Frameworks
Laravel
Symfony2
Fuel PHP
SlimPHP 2
Aura for PHP
Silex