Security Issues Creating a Site Research Proposal

Even though there is always some form of a risk involved in the coding technique together with the deployment methods of a website, some technologies such as PHP and MySQL form some of the worst aggravators of online website security. The loopholes that exists in the use of these technologies results in some of the worst hack attacks and security breaches ever experienced in the field of web design. The internet is bustling with a lot of activities. Some of the activities that are officiated over the internet are very sensitive due to both the nature of the information exchanged or even the information stored in the database.

It is paramount that websites be provided with secure and personalized databases. One inevitable fact however is that once a site is deployed on the internet, it becomes a resource to be accessed by everyone as postulated by Kabir

Secure website development is of the utmost importance as the number of websites that provide personalized accounts and utilize cross site information. "When you deploy your application on the Web, it becomes available to everyone" (Kabir 737)

In order to fully prescribe a viable solution to be used in tackling the various forms of security threats associated with the use of trending technologies such as PHP and MySQL, it is paramount to understand the mechanisms through which the security threats are orchestrated. Below is a discussion of the general techniques employed by hackers in gaining access to different websites that are developed using the PHP and MySQL, mix

Query String Manipulation

In a query string manipulation, is a hacker passes a set of values that are passed through a browser's address bar. This form of attack appears on site that provides services of some sort. Query String Manipulation can be extremely detrimental in poorly planned and programmed website. It provides an easy access point for a hacker to gain access to the database via referred to as SQL Injection, which leads to root access to the machine and then to the subsequent access to various parts of the websites source code.

Implications

The meaning and implication of this type of attack is that the hacker gains root access to the entire computer and is he or she only gets limited the access level restrictions provided to the web server, a level which is in fact an administrative. This gives the hacker an express permission to modify and even delete files that reside on the machine. The hacker also gains access to the machine's database and all of the data that exist in the database. This is true in the case of web server and database server not being on the same machine.

The possibility of a hacker gaining access to a machine's source code presents him or her with an opportunity to orchestrate devious actions such as website defacement. An interaction with a websites source code also give a revelation of the site's database design and schema (Wood,2004). This could then lead to an easy access to the websites' database and a possible change to its content.

This kind of PHP and MySQL website attack is as a result of to an improperly used and handled query string. The major source of common mistake is the trusting of inputs that originate from the query string as valid. Such a mistake would lead a hacker to interfere with the query string in order to get the information they require. The query string must therefore be validated accordingly and then appropriately verified every time in order in the process of creating and accessing of data. Query string must therefore bee tested for both existence and utmost validity.

Root level access with the administrator privileges can be gained because the server wasn't set up properly. Normally a server should be set to run with the least amount of privileges required by the server to perform its duties. One should determine the appropriate level of access a server will have before a website is developed.

Illustration

When one creates a link that has a query string variable needed to be passed to the next page. This variable is referred to as ID. If one uses this variable to access information from the database then a test for its safety should be carried out.

This test is done by means of the isset () function, which is arguably the simplest method. This allows one to move the back to the previous page whenever the value is present.Then if the variable exists one should then carry out a test to find out if its value has been interfered with. The ID is supposed to be contained in a numeric field only so we on should carry out an examination on the value which has a regular expression.

PHP gives a perfectly good regular expression evaluator function refered to as: ereg (). According to Friedl (2002)"Regular expressions are the key to powerful, flexible, and efficient text processing." By means of the regular expression, '^[0-9]+$', the testing of the value will ensure that there is at least a one digit (0-9) in the variable. The analysis of regular expressions is never to be explored at this point.

After the verification of the value if the ID, the employment of this variable becomes more secure, and one will have gotten rid of most of the invalid ID values. To offer more security, if this value is being utilized to access a file or a database field, one should test such scenarios for its existence before employing the value.

Separation of client and server

As pointed out by Kabir (2003).Sensitive data is often made available unintentionally by programs to people who should not have any access to the information." The various web applications usually run in two separate locations; that is, the server and the client. This has the meaning that both the locations must be developed to give the best security for the user and the system itself. The server must be developed in a way that ensures that the information being stored is never compromised. This must be done while the client should be developed to present and also to retrieve only the required data. A client that gives out too much information is never secure.

This means that the server is the place all the application dynamics are taken place. This separation is therefore mostly evident to the user since are the ones seeing everything that happens during the server -client interaction. This action is so since PHP operates on a transitive level for the website (between the client and the server). The user then request a webpage (1) and then server responds by locating file (2) together with its directories. It then processes (3) and finally delivers the result to the user (4).

Source: Wood (2004)

Developing applications for the client has the implications that the data and actions the user can carry out must be limited.

As a rule of thumb web page must never allow the user to interact directly with a database. If a particular user id providing information then the client should only collect and submit the acquired data to the server.

How it happens

In the process of developing a web page a particular developer would have to manage two different kinds of data types . The data types are very sensitive since they mainly contain user information and various forms business data. The second data type which is insensitive contains application level data that is used to display various forms of images files.

The web application client can be decoded and then subsequently viewed by the unintended audience and this therefore gives room to the client domain to be the entry point of accessing the various sensitive data. This leads to the exposure of sensitive data the tainted version of the client can be utilized to attack the website and also to fool other unsuspecting website users into giving out vital personal and financial information.

A particular webpage is delivered to a browser in a HTML format. This HTML script is then interpreted by the browser and is viewable in plain text. Since HTML is readily and commonly available to most web browsers, it allow its user to seamlessly view the source code of a particular web page.

A hacker then analyses the source code of a web page and then deduces some of the functionalities that may be contained on the page. A form and its input fields may all have values that get posted when the particular form is submitted. This content can than be effectively manipulated in order to as something else which dupes the server to think that it is receiving something else other then what the page was originally intended to submit. Such a form of form overloading can lead to sensitive….....