RE: Anyone have some basic security tips for PHP-programmers?

[Härnhammar, Ulf <Ulf.Harnhammar.9485 () student uu se>]

Quoting "Herbold, John W." <JWHERBOLD () arkbluecross com>:

> > but PHP is NOT vulnerable to buffer overflows from PHP scripts
> A quick search on Goggle for "PHP buffer overflow" shows otherwise.

A program written in a scripting language might at some point send data to a 
program written in a compiled language. Common examples include MySQL and 
sendmail. Thus, if we only check what characters are used and not the length of 
data fields, people could conceivably crack a sendmail server through our 
script, even if they can't connect to it directly.

Moral of the story: always check lengths as well, and avoid regular expression 
characters such as * or +, as they allow an unlimited amount of something.

-- 
Ulf Härnhammar, student, Uppsala universitet

"Jag är en tvivelaktig figur / Duger ej mycket till"
-- Cornelis Vreeswijk, "Somliga går med trasiga skor"

Uggs != Cmectbb