March 18th(4)_Lecture

  • Setup Instructions

    • Install PHP and set up a database to focus on software vulnerabilities.
    • Use a provided PHP setup document in Canvas for guidance.
    • The longest installation step is likely the MySQL secure installation, as it involves several prompts.
    • MariaDB is a fork of MySQL and works with the same tools.
    • Create a test database (e.g., CSD 344) for class exercises with a few tables: a user table and a post table.

  • Today’s Focus: PHP Crash Course

    • Start virtual machine (VM) and set up environment for PHP coding.
    • Use either a text editor like Gedit or command-line editors like VI or Nano.
    • Show a simple demonstration of PHP to confirm setup, such as using echo to output a string.

  • Introduction to PHP

    • PHP is a widely-used server-side scripting language, initially developed for web programming.
    • Facebook initially used PHP when it first launched and still utilizes it for certain components.
    • Current version is PHP 8, showcasing significant evolution despite criticisms regarding design decisions and security flaws in popular applications such as WordPress.
    • Very easy for new programmers to learn, especially for web services and dynamic page creation.

  • Basic PHP Syntax

    • PHP uses weak typing, so variables do not require type declaration.
    • Variables declared with a dollar sign (e.g., $variableName).
    • String concatenation uses a period instead of plus sign.
    • Example of creating arrays:
    • Regular array: $array = array('A', 'B', 'C');
    • Associative array: $assocArray = array('key1' => 'value1', 'key2' => 'value2');
    • Iteration through arrays can be done using foreach.
    • Conditional structures (if statements) similar to Java with some differences in syntax for comparison.

  • Error Handling in PHP

    • Errors may not display on the webpage; they instead get logged in Apache’s error log located at /var/log/apache2/error.log.
    • Use tail -f error.log to monitor error logs.

  • Functions in PHP

    • Use function keyword to define functions and return values without needing to specify the type.
    • Functions can be called with variables passed as parameters.

  • Integrating PHP with HTML Forms

    • Create HTML forms for user data input with POST method for secure data transfer.
    • Use PHP to retrieve data from forms using $_POST array for handling form inputs securely.
    • Ensure security practices avoid hardcoding sensitive information like passwords.

  • Identifying Vulnerabilities

    • Common vulnerabilities include SQL injection; always validate and sanitize user input to avoid SQL injection attacks.
    • Demonstrated SQL injection attack by manipulating input to bypass security checks.
    • Other vulnerabilities include cross-site scripting (XSS) attacks, which involve injecting client-side scripts through user input fields.
    • Strongly recommend using session management through cookies or server-side sessions instead of embedding sensitive information like passwords within HTML forms.

  • Next Steps & Further Learning

    • The next session will cover common software vulnerabilities based on OWASP top ten.
    • New assignments will involve exploiting vulnerabilities within provided software applications.
    • Resources for deeper knowledge on PHP can be found at php.net, which contains functions, examples, and further reading.

  • Student Engagement through Practice

    • Students should practice setting up their environment and executing sample scripts to gain hands-on experience.
    • Be prepared to experiment with identifying vulnerabilities in PHP code for upcoming assignments.