Actually most security holes, counting by number reported,
are buffer overflows and the like. Most of which are caused
by people reinventing invented wheels. But that is neither
here nor there.
Here is the actual problem. PHP by default willfully
violates the good programming practice of not using
symbolic references. Perl not only does not violate it
by default, it allows you to stop accidental use of it with
In fact with PHP in the default configuration, anyone who
wants can, by sending you a form with
specifically named variables, set global variables in your
program. In this case any PHP script that allows someone
to upload a file can be tricked into using a local file
like your password file. If it displays that, emails that,
or whatever, you have handed out critical information.
This is a serious security hole, and I am sure that a
careful analysis of standard PHP programs will show other
global variables that can be tweaked with "interesting"
results. If you want you can go looking yourself. You
just need to find scripts that think specific globals have
been set in some sort of preprocessing and dream up a form
that sets those variables to whatever you want.
Now is this hole simplification? Yes, and no. The good
kind of simplification is to divide a problem up into simple
pieces and solve each one cleanly. This is not an example
of that. The bad kind of simplification is to do whatever
you can to make it simple to do things, with no thought of
the potential consequences. This is an example of the
latter. Most of the API that Microsoft provides in Office
could serve as additional examples, and the periodic
Melissa-class viruses are a consequence. (I am still
for the email virus that can hit people who read it, even
if they have ActiveX turned off, through
the Access mistake. That is kiddie scriptable. The neat
buffer overflow in Outlook upon trying to parse the date is
fortunately well out of your average kiddie's reach.)
Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
Read Where should I post X? if you're not absolutely sure you're posting in the right place.
Please read these before you post! —
Posts may use any of the Perl Monks Approved HTML tags:
You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
- a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
Link using PerlMonks shortcuts! What shortcuts can I use for linking?
See Writeup Formatting Tips and other pages linked from there for more info.
| & || & |
| < || < |
| > || > |
| [ || [ |
| ] || ] ||