Wednesday, September 9, 2015

PHP Application - Security

- Unrestricted File Upload(s) leading to code execution
- Broken Authentication & Session Management
- SQL Injection
- Cross site scripting
- Unencrypted Login request
- Insecure Direct object reference
- Cross Site Request Forgery
- Cookie Replay Attack
- MySQL `root` credentials in DB error
- Reversible & plain-text credential persistence
- Authentication Bypass Using SQL Injection - Microsoft Windows MHTML Cross-Site Scripting - DOM Based Cross-Site Scripting - Link Injection - Phishing through frames - Broken Access Control - Weak Authentication Token - Session Identifier Not Updated - Missing Page-Level Access Control - Missing Cross Frame Scripting - Software Version Information Disclosure - Database error pattern found - Cookie without HttpOnly flag - HTML5 cross origin resource - Autocomplete HTML Attribute Not Disabled for Password Field - Flash parameter AllowScriptAccess was set to always - Application Test Script Detected - Email Address in Hidden Parameter - Potential File Upload - Application Error - Client-Side (JavaScript) Cookie References - HTML Comments Sensitive Information Disclosure

Thursday, August 23, 2012

Explain about Abstraction?


Polymorphism in OOP:

Polymorphism in OOP:


In this tutorial we will study about polymorphism.
  • Polymorphism in PHP5 : To allow a class member to perform diffrent tasks.
  • polymorphism where the function to be called is detected based on the class object calling it at runtime.

Example:
< ?
class Person
{
    public function Talk()
    {
         echo "English";
    }
}

class Language extends Person
{
      public function Talk()
      {
           echo "French";
      }


}

function CallMethod(Person $p)
{
      $p->Talk();
}



$l = new Language();
CallMethod($l);
?>


Output:
French;

Tuesday, July 31, 2012

GMT to IST conversion

GMT

IST (GMT+5.5)
00:00 (midnight) 05:30 (5.30am)
00:30 (12.30am) 06:00 (6am)
01:00 (1am) 06:30 (6.30am)
01:30 (1.30am) 07:00 (7am)
02:00 (2am) 07:30 (7.30am)
02:30 (2.30am) 08:00 (8am)
03:00 (3am) 08:30 (8.30am)
03:30 (3.30am) 09:00 (9am)
04:00 (4am) 09:30 (9.30am)
04:30 (4.30am) 10:00 (10am)
05:00 (5am) 10:30 (10.30am)
05:30 (5.30am) 11:00 (11am)
06:00 (6am) 11:30 (11.30am)
06:30 (6.30am) 12:00 (noon)
07:00 (7am) 12:30 (12.30pm)
07:30 (7.30am) 13:00 (1pm)
08:00 (8am) 13:30 (1.30pm)
08:30 (8.30am) 14:00 (2pm)
09:00 (9am) 14:30 (2.30pm)
09:30 (9.30am) 15:00 (3pm)
10:00 (10am) 15:30 (3.30pm)
10:30 (10.30am) 16:00 (4pm)
11:00 (11am) 16:30 (4.30pm)
11:30 (11.30am) 17:00 (5pm)
12:00 (noon) 17:30 (5.30pm)
12:30 (12.30pm) 18:00 (6pm)
13:00 (1pm) 18:30 (6.30pm)
13:30 (1.30pm) 19:00 (7pm)
14:00 (2pm) 19:30 (7.30pm)
14:30 (2.30pm) 20:00 (8pm)
15:00 (3pm) 20:30 (8.30pm)
15:30 (3.30pm) 21:00 (9pm)
16:00 (4pm) 21:30 (9.30 pm)
16:30 (4.30pm) 22:00 (10pm)
17:00 (5pm) 22:30 (10.30pm)
17:30 (5.30pm) 23:00 (11pm)
18:00 (6pm) 23:30 (11.30pm)
18:30 (6.30pm) 00:00 (midnight)
19:00 (7pm) 00:30 (12.30am)
19:30 (7.30pm) 01:00 (1am)
20:00 (8pm) 01:30 (1.30am)
20:30 8.30pm) 02:00 (2am)
21:00 (9pm) 02:30 (2.30am)
21:30 (9.30pm) 03:00 (3am)
22:00 (10pm) 03:30 (3.30am)
22:30 (10.30pm) 04:00 (4am)
23:00 (11pm) 04:30 (4.30am)
23:30 (11.30pm) 05:00 (5am)
For other conversion refer: http://wwp.greenwichmeantime.com/to/ist/index.htm

PHP Warning: json_encode() [function.json-encode]: Invalid UTF-8 sequence in argument in

PHP Warning: json_encode() [function.json-encode]: Invalid UTF-8 sequence in argument in The problem we are seeing is that the value being encoded to json is not UTF-8 encoded data. PHP function json_encode, unfortunately, will only accept UTF-8 as its parameter. If you search online, you will find that most people solve this problem by using the PHP function utf8_encode. This is fine and dandy if the data you deal with only contains regular alphanumerical characters (letters and numbers), but what if it contains characters from foreign languages? utf8_encode will most certainly return unwanted values, and this is not what you want. Using utf8_encode is the right idea, but you don’t want to call the function on all your values, just the ones that require it. better to use utf8_encode($value); in the latest php version the warning will not come.

Monday, January 2, 2012

SOAP

What is SOAP?


SOAP is simple XML based protocol to let applications exchange information over HTTP or SOAP is a protocol for accessing a Web Service.
  • SOAP stands for Simple Object Access Protocol
  • SOAP is a communication protocol
  • SOAP is for communication between applications
  • SOAP is a format for sending messages
  • SOAP communicates via Internet
  • SOAP is platform independent
  • SOAP is language independent
  • SOAP is based on XML
  • SOAP is simple and extensible
  • SOAP allows you to get around firewalls
  • SOAP is a W3C recommendation

Why SOAP?

It is important for application development to allow Internet communication between programs.


SOAP Building Blocks

A SOAP message is an ordinary XML document containing the following elements:
  • An Envelope element that identifies the XML document as a SOAP message
  • A Header element that contains header information
  • A Body element that contains call and response information
  • A Fault element containing errors and status information

Syntax Rules

Here are some important syntax rules:
  • A SOAP message MUST be encoded using XML
  • A SOAP message MUST use the SOAP Envelope namespace
  • A SOAP message MUST use the SOAP Encoding namespace
  • A SOAP message must NOT contain a DTD reference
  • A SOAP message must NOT contain XML Processing Instructions

Skeleton SOAP Message

<?xml version="1.0"?>
<soap:Envelope
xmlns:soap="http://www.w3.org/2001/12/soap-envelope"
soap:encodingStyle="http://www.w3.org/2001/12/soap-encoding">

<soap:Header>
...
</soap:Header>

<soap:Body>
...
  <soap:Fault>
  ...
  </soap:Fault>
</soap:Body>

</soap:Envelope>

The SOAP Envelope Element

The required SOAP Envelope element is the root element of a SOAP message. This element defines the XML document as a SOAP message.
Example
<?xml version="1.0"?>
<soap:Envelope
xmlns:soap="http://www.w3.org/2001/12/soap-envelope"
soap:encodingStyle="http://www.w3.org/2001/12/soap-encoding">
  ...
  Message information goes here
  ...
</soap:Envelope>


The xmlns:soap Namespace

Notice the xmlns:soap namespace in the example above. It should always have the value of: "http://www.w3.org/2001/12/soap-envelope".
The namespace defines the Envelope as a SOAP Envelope.
If a different namespace is used, the application generates an error and discards the message.

The encodingStyle Attribute

The encodingStyle attribute is used to define the data types used in the document. This attribute may appear on any SOAP element, and applies to the element's contents and all child elements.
A SOAP message has no default encoding.

Syntax

soap:encodingStyle="URI"

The SOAP Header Element

The optional SOAP Header element contains application-specific information (like authentication, payment, etc) about the SOAP message.
If the Header element is present, it must be the first child element of the Envelope element.
Note: All immediate child elements of the Header element must be namespace-qualified.
<?xml version="1.0"?>
<soap:Envelope
xmlns:soap="http://www.w3.org/2001/12/soap-envelope"
soap:encodingStyle="http://www.w3.org/2001/12/soap-encoding">

<soap:Header>
  <m:Trans xmlns:m="http://www.w3schools.com/transaction/"
  soap:mustUnderstand="1">234
  </m:Trans>
</soap:Header>
...
...
</soap:Envelope>
The example above contains a header with a "Trans" element, a "mustUnderstand" attribute with a value of 1, and a value of 234.
SOAP defines three attributes in the default namespace ("http://www.w3.org/2001/12/soap-envelope"). These attributes are: mustUnderstand, actor, and encodingStyle.
The attributes defined in the SOAP Header defines how a recipient should process the SOAP message.

The mustUnderstand Attribute

The SOAP mustUnderstand attribute can be used to indicate whether a header entry is mandatory or optional for the recipient to process.
If you add mustUnderstand="1" to a child element of the Header element it indicates that the receiver processing the Header must recognize the element. If the receiver does not recognize the element it will fail when processing the Header.

Syntax

soap:mustUnderstand="0|1"

Example

<?xml version="1.0"?>
<soap:Envelope
xmlns:soap="http://www.w3.org/2001/12/soap-envelope"
soap:encodingStyle="http://www.w3.org/2001/12/soap-encoding">

<soap:Header>
  <m:Trans xmlns:m="http://www.w3schools.com/transaction/"
  soap:mustUnderstand="1">234
  </m:Trans>
</soap:Header>
...
...
</soap:Envelope>


The actor Attribute

A SOAP message may travel from a sender to a receiver by passing different endpoints along the message path. However, not all parts of a SOAP message may be intended for the ultimate endpoint, instead, it may be intended for one or more of the endpoints on the message path.
The SOAP actor attribute is used to address the Header element to a specific endpoint.
Syntax
soap:actor="URI"
Example
<?xml version="1.0"?>
<soap:Envelope
xmlns:soap="http://www.w3.org/2001/12/soap-envelope"
soap:encodingStyle="http://www.w3.org/2001/12/soap-encoding">

<soap:Header>
  <m:Trans xmlns:m="http://www.w3schools.com/transaction/"
  soap:actor="http://www.w3schools.com/appml/">234
  </m:Trans>
</soap:Header>
...
...
</soap:Envelope>


The encodingStyle Attribute

The encodingStyle attribute is used to define the data types used in the document. This attribute may appear on any SOAP element, and it will apply to that element's contents and all child elements.
A SOAP message has no default encoding.
Syntax
soap:encodingStyle="URI"




The SOAP Body Element

The required SOAP Body element contains the actual SOAP message intended for the ultimate endpoint of the message.
Immediate child elements of the SOAP Body element may be namespace-qualified.
Example
<?xml version="1.0"?>
<soap:Envelope
xmlns:soap="http://www.w3.org/2001/12/soap-envelope"
soap:encodingStyle="http://www.w3.org/2001/12/soap-encoding">

<soap:Body>
  <m:GetPrice xmlns:m="http://www.w3schools.com/prices">
    <m:Item>Apples</m:Item>
  </m:GetPrice>
</soap:Body>

</soap:Envelope>

The example above requests the price of apples. Note that the m:GetPrice and the Item elements above are application-specific elements. They are not a part of the SOAP namespace.
A SOAP response could look something like this:
<?xml version="1.0"?>
<soap:Envelope
xmlns:soap="http://www.w3.org/2001/12/soap-envelope"
soap:encodingStyle="http://www.w3.org/2001/12/soap-encoding">

<soap:Body>
  <m:GetPriceResponse xmlns:m="http://www.w3schools.com/prices">
    <m:Price>1.90</m:Price>
  </m:GetPriceResponse>
</soap:Body>

</soap:Envelope>


The SOAP Fault Element

The optional SOAP Fault element is used to indicate error messages.
If a Fault element is present, it must appear as a child element of the Body element. A Fault element can only appear once in a SOAP message.
The SOAP Fault element has the following sub elements:
Sub ElementDescription
<faultcode>A code for identifying the fault
<faultstring>A human readable explanation of the fault
<faultactor>Information about who caused the fault to happen
<detail>
Holds application specific error information related to the Body element
SOAP Fault Codes
The faultcode values defined below must be used in the faultcode element when describing faults:
ErrorDescription
VersionMismatchFound an invalid namespace for the SOAP Envelope element
MustUnderstandAn immediate child element of the Header element, with the mustUnderstand attribute set to "1", was not understood
ClientThe message was incorrectly formed or contained incorrect information
ServerThere was a problem with the server so the message could not proceed



The HTTP Protocol

HTTP communicates over TCP/IP. An HTTP client connects to an HTTP server using TCP. After establishing a connection, the client can send an HTTP request message to the server:
POST /item HTTP/1.1
Host: 189.123.345.239
Content-Type: text/plain
Content-Length: 200
The server then processes the request and sends an HTTP response back to the client. The response contains a status code that indicates the status of the request:
200 OK
Content-Type: text/plain
Content-Length: 200
In the example above, the server returned a status code of 200. This is the standard success code for HTTP.
If the server could not decode the request, it could have returned something like this:
400 Bad Request
Content-Length: 0


SOAP HTTP Binding

A SOAP method is an HTTP request/response that complies with the SOAP encoding rules.
HTTP + XML = SOAP
A SOAP request could be an HTTP POST or an HTTP GET request.
The HTTP POST request specifies at least two HTTP headers: Content-Type and Content-Length.

Content-Type

The Content-Type header for a SOAP request and response defines the MIME type for the message and the character encoding (optional) used for the XML body of the request or response.

Syntax

Content-Type: MIMEType; charset=character-encoding

Example

POST /item HTTP/1.1
Content-Type: application/soap+xml; charset=utf-8


Content-Length

The Content-Length header for a SOAP request and response specifies the number of bytes in the body of the request or response.

Syntax

Content-Length: bytes

Example

POST /item HTTP/1.1
Content-Type: application/soap+xml; charset=utf-8
Content-Length: 250

A SOAP Example

In the example below, a GetStockPrice request is sent to a server. The request has a StockName parameter, and a Price parameter that will be returned in the response. The namespace for the function is defined in "http://www.example.org/stock".
A SOAP request:
POST /InStock HTTP/1.1
Host: www.example.org
Content-Type: application/soap+xml; charset=utf-8
Content-Length: nnn

<?xml version="1.0"?>
<soap:Envelope
xmlns:soap="http://www.w3.org/2001/12/soap-envelope"
soap:encodingStyle="http://www.w3.org/2001/12/soap-encoding">

<soap:Body xmlns:m="http://www.example.org/stock">
  <m:GetStockPrice>
    <m:StockName>IBM</m:StockName>
  </m:GetStockPrice>
</soap:Body>

</soap:Envelope>
The SOAP response:
HTTP/1.1 200 OK
Content-Type: application/soap+xml; charset=utf-8
Content-Length: nnn

<?xml version="1.0"?>
<soap:Envelope
xmlns:soap="http://www.w3.org/2001/12/soap-envelope"
soap:encodingStyle="http://www.w3.org/2001/12/soap-encoding">

<soap:Body xmlns:m="http://www.example.org/stock">
  <m:GetStockPriceResponse>
    <m:Price>34.5</m:Price>
  </m:GetStockPriceResponse>
</soap:Body>

</soap:Envelope>





Friday, December 30, 2011

How to post XML using CURL?

There are several ways to Send XML requests via HTTP POST.
This is the very simple way to send the xml request via HTTP POST 
  
<?php 
$xml_data ='<AATAvailReq1>'.
    '<Agency>'.
        '<Iata>1234567890</Iata>'.
        '<Agent>lgsoftwares</Agent>'.
        '<Password>mypassword</Password>'.
        '<Brand>phpmind.com</Brand>'.
    '</Agency>'.
    '<Passengers>'.
        '<Adult AGE="" ID="1"></Adult>'.
        '<Adult AGE="" ID="2"></Adult>'.
    '</Passengers>'.
'<HotelAvailReq1>'.
'<DestCode>JHM</DestCode>'.
        '<HotelCode>OGGSHE</HotelCode>'.
        '<CheckInDate>101009</CheckInDate>'.
        '<CheckOutDate>101509</CheckOutDate>'.
        '<UseField>1</UseField>'.
  '</HotelAvailReq1>'.  
  '</AATAvailReq1>';
 
 
$URL = "https://www.yourwebserver.com/path/";
 
   $ch = curl_init($URL);
   curl_setopt($ch, CURLOPT_MUTE, 1);
   curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
   curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
   curl_setopt($ch, CURLOPT_POST, 1);
   curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: text/xml'));
   curl_setopt($ch, CURLOPT_POSTFIELDS, "$xml_data");
   curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
   $output = curl_exec($ch);
   curl_close($ch);
 
?>

Thursday, December 29, 2011

Features of MySQL

The following list shows the most important properties of MySQL. This section is directed to the reader who already has some knowledge of relational databases.

Relational Database System: Like almost all other database systems on the market, MySQL is a relational database system.

Client/Server Architecture: MySQL is a client/server system. There is a database server (MySQL) and arbitrarily many clients (application programs), which communicate with the server; that is, they query data, save changes, etc. The clients can run on the same computer as the server or on another computer (communication via a local network or the Internet).

Almost all of the familiar large database systems (Oracle, Microsoft SQL Server, etc.) are client/server systems. These are in contrast to the file-server systems, which include Microsoft Access, dBase and FoxPro. The decisive drawback to file-server systems is that when run over a network, they become extremely inefficient as the number of users grows.

SQL compatibility: MySQL supports as its database language -- as its name suggests – SQL (Structured Query Language). SQL is a standardized language for querying and updating data and for the administration of a database. There are several SQL dialects (about as many as there are database systems).

SubSELECTs: Since version 4.1, MySQL is capable of processing a query in the form SELECT * FROM table1 WHERE x IN (SELECT y FROM table2) (There are also numerous syntax variants for subSELECTs.)

Views: Put simply, views relate to an SQL query that is viewed as a distinct database object and makes possible a particular view of the database. MySQL has supported views since version 5.0.

Stored procedures: Here we are dealing with SQL code that is stored in the database system.
Stored procedures (SPs for short) are generally used to simplify certain steps, such as inserting or deleting a data record. For client programmers this has the advantage that they do not have to process the tables directly, but can rely on SPs. Like views, SPs help in the administration of large database projects. SPs can also increase efficiency. MySQL has supported SPs since version 5.0.

Triggers: Triggers are SQL commands that are automatically executed by the server in certain database operations (INSERT, UPDATE, and DELETE). MySQL has supported triggers in a limited form from version 5.0, and additional functionality is promised for version 5.1.

Unicode: MySQL has supported all conceivable character sets since version 4.1, including Latin-1, Latin-2, and Unicode (either in the variant UTF8 or UCS2).

User interface: There are a number of convenient user interfaces for administering a MySQL server.

Full-text search: Full-text search simplifies and accelerates the search for words that are located within a text field. If you employ MySQL for storing text (such as in an Internet discussion group), you can use full-text search to implement simply an efficient search function.

Replication: Replication allows the contents of a database to be copied (replicated) onto a number of computers. In practice, this is done for two reasons: to increase protection against system failure (so that if one computer goes down, another can be put into service) and to improve the speed of database queries.

Transactions: In the context of a database system, a transaction means the execution of several database operations as a block. The database system ensures that either all of the operations are correctly executed or none of them. This holds even if in the middle of a transaction there is a power failure, the computer crashes, or some other disaster occurs. Thus, for example, it cannot occur that a sum of money is withdrawn from account A but fails to be deposited in account B due to some type of system error.
Transactions also give programmers the possibility of interrupting a series of already executed commands (a sort of revocation). In many situations this leads to a considerable simplification of the programming process. In spite of popular opinion, MySQL has supported transactions for a long time. One should note here that MySQL can store tables in a variety of formats. The default table format is called MyISAM, and this format does not support transactions. But there are a number of additional formats that do support transactions. The most popular of these is InnoDB.

Foreign key constraints: These are rules that ensure that there are no cross references in linked tables that lead to nowhere. MySQL supports foreign key constraints for InnoDB tables.

GIS functions: Since version 4.1, MySQL has supported the storing and processing of two-dimensional geographical data. Thus MySQL is well suited for GIS (geographic information systems) applications.

Programming languages: There are quite a number of APIs (application programming interfaces) and libraries for the development of MySQL applications. For client programming you can use, among others, the languages C, C++, Java, Perl, PHP, Python, and Tcl.

ODBC: MySQL supports the ODBC interface Connector/ODBC. This allows MySQL to be addressed by all the usual programming languages that run under Microsoft Windows (Delphi, Visual Basic, etc.). The ODBC interface can also be implemented under Unix, though that is seldom necessary.

Platform independence: It is not only client applications that run under a variety of operating systems; MySQL itself (that is, the server) can be executed under a number of operating systems. The most important are Apple Macintosh OS X, Linux, Microsoft Windows, and the countless Unix variants, such as AIX, BSDI, FreeBSD, HP-UX, OpenBSD, Net BSD, SGI Iris, and Sun Solaris.

Speed: MySQL is considered a very fast database program. This speed has been backed up by a large number of benchmark tests (though such tests -- regardless of the source -- should be considered with a good dose of skepticism).

Wednesday, December 28, 2011

basic questions and answers

What is the difference between echo and print?

One difference is that echo() can take multiple expressions
Print cannot take multiple expressions. That is the main distinct difference!

The echo() function is not actually a function, so you are not required to use parentheses with it. However, if you want to pass more than one parameter to echo(), using parentheses will generate a parse error.

The echo() function is slightly faster than print().

The echo() function has the shortcut syntax as echo.

Tuesday, December 27, 2011

How many types of indexes or keys are in MySQL?

MySQL allows four general types of indexes (keys). These indexes can be created either on single column or multi-columns however both single column index and multi columns index have some different behaviors.

1. Primary Key Indexes
2. Unique Key Indexes
3. Normal Indexes also known as "Non-Unique Indexes", "Ordinary Indexes", or "Indexes without constraints"
4. Full-Text Indexes

RESTful Services for PHP

It is very simple, but needs the patience.

REST is an acronym standing for Representational State Transfer, a software architecture used for developing stateless web services. The most common use of REST is on on the Web with HTTP being the only protocol used here. And the only operations allowed are the HTTP – GET (Read), PUT (Update), POST(Create) and DELETE (Delete).
The operations are like sql resource.

The main features and constraints of REST architectural style are:

Client-Server: A clear separation concerns is the reason behind this constraint. Separating concerns between the Client and Server helps improve portability in the Client and Scalability of the server components.

Stateless: All REST resources are required to be stateless. The idea is that the application would be resilient enough to work between server restarts. However, it is not uncommon to see some RESTful web services save states between requests.

Caching: Caching is allowed, however it is required that “response to a request be implicitly or explicitly labeled as cacheable or non-cacheable”

As there is no interface definition (like in SOAP), it becomes mandatory for a Client and Server to have a mutual understanding of the messages being transmitted between them.


You may want to see the pear package HTTP Request for making REST calls, which among many things supports GET/POST/HEAD/TRACE/PUT/DELETE, basic authentication, proxy, proxy authentication, SSL, file uploads and more. Using this package, I got started on a simple wrapper class called RESTclient, which gives intuitive support for making REST resource calls.

Explaining the REST by code is coming soon...

Wednesday, April 27, 2011

Thursday, August 20, 2009