A Note on Security in PHP

PHP is a powerful and flexible tool. This power and flexibility comes from PHP being a very thin framework sitting on top of dozens of distinct 3rd-party libraries. Each of these libraries have their own unique input data characteristics. Data that may be safe to pass to one library may not be safe to pass to another.

A recent Web Worm known as NeverEverSanity exposed a mistake in the input validation in the popular phpBB message board application. Their highlighting code didn’t account for double-urlencoded input correctly. Without proper input validation of untrusted user data combined with any of the PHP calls that can execute code or write to the filesystem you create a potential security problem. Despite some confusion regarding the timing of some unrelated PHP security fixes and the NeverEverSanity worm, the worm didn’t actually have anything to do with a security problem in PHP….

Looks like a really good time for the PHP Security Consortium to be created.

I mean with members like:

  • Ammar Ibrahim
  • Andi Gutmans
  • Ben Ramsey
  • Christian Wenz
  • Daniel Kushner
  • Ivan Ristic
  • Marcus Whitney
  • Paul Reinheimer

how could they go wrong… good luck guys.