I have a settings.php page in my application which uses $GLOBALS to store configurations used in the web app.
As an example, he is a sample setting variable I use:
$GLOBALS["new_login_page"] = 1;
$GLOBALS["secret_cross_check_token"] = 3243242342423;
I then call those globals on other pages (hence why I use $GLOBALS), to perform tasks, such as give a user a new feature if they have that global toggled to 1.
The Question:
This works really well for me and i do not wish to use a database to store them, however recently I came to think, are $GLOBALS secure? Can a user read or manipulate them? If yes, what is the solution???
I understand it is server side but i just had doubts as to whether the user can somehow access the $GLOBALS
A globals variables can only be accessed server side, you can use them safely.
If an user can access your globals variables it's because he has gained access to execute code in your server, so, in this case, he can do a lot of more things than read your globals variables.
If an user can execute code in your server, he will be able to copy all your files and all your database easily, so the access to global variables would not be the major problem.
$GLOBALS is totally secure global variable.
http://php.net/manual/en/reserved.variables.globals.php
users have no access to it.
the "security" was about register_globals directive.
but its removed from php.
http://php.net/manual/en/security.globals.php
the point there was that, for example, i forgot to define some $includeFile as 'inc.php', and i was doing include $includeFile;, someone could just go http://mysite.ru/script.php?includeFile=http://hackersite.ru/script.php and include his own file.
not very good example but something "near".
But it is not about $GLOBALS, so u should not worry about security there.
sorry for english.
Related
Ok, i have one totaly noob question about php sessions:
I have 3 (and more) php pages, i need to protect them with login system and sessions. Now, i am including this to the top of every page:
session_name('somename');
session_start();
if(!$_SESSION['user_loggedIn']){
header("location: login.php");
}
if (isset($_SESSION["timeout"])) {
$inactive = 900;
$sessionTTL = time() - $_SESSION["timeout"];
if ($sessionTTL > $inactive) {
session_destroy();
header("location: login.php");
}
}
Question: is it correct to add something like include session.php; to top of every php file, ofc. session.php would include only code above.
You shouldn't need to handle the session timeout yourself, your webserver is almost certainly handling that for you already. All you should need to do is check to see if the session exists and make sure you have login info in that session.
Also, as far as "what's the right thing to do" -- if you require it at the top of every php file, remember to use "require_once" because there's no point in doing the same thing over and over if you include other files. Also, you may only need to do this on pages where you know you only want secured users, which isn't always every page of the site.
PHP is a programming language that is similar to JavaScript but allows for better functionality of the code to develop dynamic websites and apps. PHP stands for Hypertext Pre-Processor. In this tutorial, I will walk you through what a session is, how to declare session variables, and introduce you to a few functions that will allow you to get your session up and running in the way you need it to.
What Is a Session?
First, you may be asking yoursslef, “what is a session?” In this programming language, a session is “used to store and pass information from one page to another temporarily (until the user closes the website).” If you are familiar with cookies, sessions are a very similar topic. While cookies are only stored on the local computer and browser that you use, sessions get stored on your machine as well as on the server you’re using. Both of these collect information about the way you interact with the webpage to improve the experience for a user. To summarize the two of them, “data that is kept in cookies is solely kept on the client’s side, whereas the information kept in sessions is kept on both the client and server’s sides.” (The link to the article I found this can be found here).
The most common functions that you will use as you begin to learn PHP are the session_start() function, the die() function, and the session_destroy() function. These three functions allow you as the user to start specific tasks and then stop them whenever you want. The session start function will allow you to, of course, start a new session. The die() function will allow you to clear any session variables that you may have used during your session, and the session_destroy() function will end your session. Now, understanding what a session is, let’s discuss what a session variable is and how you can declare them.
What Are Session Variables?
Session variables make it possible to make sessions in PHP useful and functional. Which variables you use will be different depending on the project you’re working on, but in my project and database I used variables that helped me see the status of users on my database. I’ll share two examples (see screenshot below, lines 54-55). The two variables I declared here were “logged_in” and “username”. All session variables are declared with a unique syntax. The proper way to declare a session variable is as follows:
$_SESSION[“nameofvariable”] = “variable declaration”;
It is important that you declare your session variables in this syntax or you will not be able to have your sessions run properly. As a system administrator, these variables help me to see who is logged into the databases and making edits to tasks. In addition, the logged_in variable enables functionality of the database and webpage. If the user is not logged in, then the code knows to redirect the user to the login page. See the example below:
Screenshot 1:
I then used these variables to help me keep track of the state that my program and database were in to allow it to function properly.
Let’s Get To It: How to Set Up Your Sessions
Now that we understand more about what a session is and how session variables can help us accomplish our goal of a functioning program, let’s discuss the process as to how we can actually implement this. First off, go ahead and open up your IDE. I personally picked Visual Studio Code as it allows me to comfortably program with color codes, but you can pick whichever one you choose. In this example I will show you how I set up both of my sessions using a particular action that implemented my to-do list to my database. Although the code I will share will be specific to my project, the principles will remain the same for all PHP code.
In the screenshot at the end of this section I have some code I wrote at the top of an action file that ultimately ended up allowing a registered user on my webpage to sign into their to-do list. Because this was an element that required the database to be fully implemented, I knew that I had to use the PHP language. In this screenshot and in your code, you should start your code with the simple PHP starter code of:
<?php
That’s right! That is all you have to do. This allows your IDE to recognize what you will be coding in. Once it has this information you get to set up your session which, believe it or not is another easy step. In order to declare that you’re going to be starting your session all you need to do is declare the following code:
session_start();
In order to properly run your sessions, it is vital to know and understand that this HAS to be the first thing declared in your code document otherwise it will not function properly. Once this code has been declared then the computer knows to iterate through the code in your document until another function is called telling it to stop. Once your function is declared you have the chance to declare your session variables and any other information you need the computer to know. Here in screenshot 2 I have the visual example of me declaring my php language, starting my session, and declaring the variables that are unique to me that establish my connection from my to-do list to my database. This is my 2nd screenshot:
Screenshot 2:
From this example you can see from lines 1-16 of my action file. Everything that I did here is what was explained in this section.
Useful Tip:
Another function that allows you to properly manage your session is the die() function. I implemented this one in my file. It is a way for the script to be stopped while keeping your session open. This was useful to me because it was a way of letting my script know to stop and moving to the next portion of my instructions, which were found in another file. If you are coding a particular project that requires multiple actions, then this is a great function to keep in mind!
Destroying (Ending) a Session
The word “destroy” sounds pretty hardcore, but in PHP sessions destroy is just a word that means “end”. The syntax of this function within the session is the following:
session_destroy()
The destroy function will take any and all data that you used during your session and destroy it. However, it is important to note that it will NOT reset or delete any of the global variables that you may have declared during your coding. In order to start a session again you need to code your project to have the first function, start_session(), called again.
End Result
You may or may not be coding a database, but the steps that I listed above should be a place to allow you to learn the basic principles of what a session is, how to start one, declare variables, and end your session at the appropriate time. In my particular database project I was able to use sessions to allow users to login to a page, log out of their account, register a new user, to update actions included in the database, and more. Whatever your project may be, sessions have a great ability to adapt to the needs that you have as a coder. In the extremely rare event this tutorial didn’t answer every question that you have, I have also included a list of some additional links and videos that may help you answer any unanswered questions about sessions in the PHP language. Happy coding!
Additional Resources:
https://www.javatpoint.com/php-session
This website is a great resource for studying more about what a PHP session is and all basic information about what they do. This page also includes information on specific types of sessions, how to code them, how to implement them, and when they should be used.
https://www.tutorialspoint.com/What-is-the-difference-between-session-and-cookies
This is a great resource for understanding the differences between sessions and cookies, and for also seeing how they are similar. This website is comprehensive in how it compares the two features, even going into detail on their capacities, functions, data storage, and format.
https://code.tutsplus.com/tutorials/how-to-use-sessions-and-session-variables-in-php--cms-31839
This website does a deep dive more into what a session is and defines Session Variables for the PHP language. It goes into detail on how to start sessions and also talks about some common errors that may occur.
https://www.javatpoint.com/php-session
This link has outstanding information and further descriptions as to how to destroy, or end, a session. It also goes into further detail on what it will do to your project and code in addition to describing what it will not do.
https://www.youtube.com/watch?v=h6KID8n0zCU
This is a great video that describes sessions. I personally like to refer to it as “Sessions for Dummies”.
I was reading something about SuplerGlobals like $_SERVER or (see more detail PHP Manual Superglobals) the other day, now, I'm asking me:
Is it possible to implement own SuperGlobals?
Beside of Constants...
So for example user A writes something in the Variable which, if User B is calling it can see.
Something like a server wide Session Variable or something.
Please don't be to hard, if its a silly question :)
I know there are couple of ways outside, like SQL, Xml and Stuff, but maybe...
Your whole idea of PHP superglobals it wrong.
These variables are always available in terms of just one script runtime, no the whole site.
PHP doesn't have context which can be shared between users. You should some replacement like SQL server or file. You may also check some extensions like memcache which might help you achieve your goal.
I was reading something about SuplerGlobals like $_SERVER or (see more detail PHP Manual Superglobals) the other day, now, I'm asking me:
Is it possible to implement own SuperGlobals? Beside of Constants...
Yes it is possible if you've got the PHP runkit extension.
So for example user A writes something in the Variable which, if User B is calling it can see
That's not what superglobals do - they are variables which exist in global scope (i.e. for the duration of an instance of a script).
If you want to share data between different invocations then you need to send it to your storage tier or (in the case of data for a single client) out to the browser.
Since what you are describing here is effectively a shared session, then the sensible place to implement this would be in the session handler.
This is not possible, you can only see your own session data.
To achieve this you would need to store the data somewhere else. in text files or in a MySQL database would be the most common.
i suppose you can use (asterix)export yourvar="something"(asterix) and to receive it using getenv
sry, dont know how to embed asterix=`, but it is better to avoid it...
If you use apache following could be used:
http://php.net/manual/en/function.apache-setenv.php
same idea, enveroinment variable
I saw this example in php manual page
http://www.php.net/manual/en/session.examples.php
The example will create a global session for all client. Can I use this example to create some global application for all client, instead of save it to DB or local file.
What're the pros and cons of this method?
Thanks for any help.
It might work, but I wouldn't recommend it... to much scope for potential confusion by othe rdevelopers working with the code, potential issues if you update session variables within the wrong scope, and the use of the term "session" for something that is not session-related can lead to a whole world of confusion
Yes it is possible by sharing the session id between two clients but sessions are only used to store temporary data of a user. So once a session is destroyed there is no way to retrieve that data.
No, this is not possible, or advised. A session is bound to one client, and clients do not share a session.
What is best practice with regards to using session variables?
Is it best to just refer to them as session variables or is it better at the beginning of the script to transfer them to local variables of the same name?
I am also a little stumpped on the best folder/file structure for my application if anyone has a useful link with regards to that it would be very useful.. thanks.
Just access them as they are, there will be no performance hit.
In my mind data is usually in session for a reason, so moving it from the session to local, and the having to put it back again just provides a step for errors to occur, plus it may make your code more confusing to read.
You probably only want to assign the session value to a local variable if you need to manipulate the data and want to retain the original value.
I usually transfer them to local variables if I don't intend to manipulate them, just to avoid the chance of unintentionally overwriting. Plus, it's easier to work with local variables than writing out $_SESSION[''] every time.
Is it best to just refer to them as
session variables or is it better at
the beginning of the script to
transfer them to local variables of
the same name?
For me it depends on what you are doing with it, if you are using it once then use $_Session[] if you are doing lots of logic with it, it makes sense to transfer it to a local var.
Either way its preferance.
I'd recommend against using $_SESSION. Use a Session wrapper/manager class for handling session variables.
There are many available out there, but Zend_Session is among the best.
I have an admin site that I have copied over to a new server to test for bugs and put live, along with some other sites.
The admin appears to have REGISTER GLOBALS on and is using it for most of the 300 php files.
Based on the fact that you have to login to this system anyway is it worth the weeks of work to re code all the variables?
Or be happy that I would fix each page as I add any new feature to it in the future?
Does Register Globals leave problems in code that has been cleaned, if we don't fix all at once?
I'm guessing it could as $user_id can be set by any global.
This app could be littered with many other shoddy programming practices as well. (How large is the app to warrant 300 php files?). If that's the case, it might be a good idea to leave the app as it is and code a new version from scratch on top of a decent framework if maintenance has already become too troublesome.
I would disable register_globals from the php.ini, and put a code block at the top of each script that extracts the variables from the $_REQUEST, $_GET or $_POST, something like:
$nVars = extract($_GET, EXTR_SKIP);
The above code will register variables by the same name as the key in the passed array. It is useful for quickly refactoring old REGISTER_GLOBALS enabled code, but you must be careful. Read the following excerpt from the PHP extract() documentation:
Do not use extract() on untrusted
data, like user-input ($_GET, ...). If
you do, for example, if you want to
run old code that relies on
register_globals temporarily, make
sure you use one of the
non-overwriting extract_type values
such as EXTR_SKIP and be aware that
you should extract in the same order
that's defined in variables_order
within the php.ini.
Register_Globals is insecure and shouldn't be used. If I were you I would rewrite the code, or the application itself from scratch. However if this is an admin system, and no one knows its URL and therefore only the admin himself can access it, then you should be fine with not changing it (just make sure its URL remains a secret)
It can lead to some very serious security issues, it kinda depends on how it's coded.
For example:
<?php
// $loggedin comes from $_SESSION['loggedin']
if($loggedin)
{
echo 'Loggedin!';
}
else
{
echo 'Please login';
}
?>
The main problem here is, is that the script doesn't check where $loggedin comes from. So if I would do script.php?loggedin=1, I would be logged in. Seeing as there are ~300 PHP files, it would be hard to check everything.
So keeping it is a (very) bad idea. Even it you'd use .htaccess to block access, it would probably lead to problems in the future (IE web hoster setting REGISTER_GLOBALS off) and confusion.
Don't re-write the entire system. If the system works and you'll casually upgrade as you go you don't need to start from scratch.
I would weigh the importance of addressing the Register Globals based on the sensitivity of the information.
If it's a well built system you should be able to see what variables are used throughout the site and simply make them available at the top of the pages. Be wary of any functions that pull in their data through global $this, $that;
My vote, if the data is important to protect, is to do the work.
This depends on your quite a lo t of things. Just to name a few:
Company's security policy
Cost to rewrite
Importance of the application
Impact on other parts of the application.
etc