PHP Security

[InNeedofHelp]

How easy would it be for somebody to hack into a PHP file or one of my MYSQL databases and find a password to a secret page, or is it even possible?

MY question is, i'm in the process of making a webpage with my buddies and i think it'd be really cool and simple to add a separate page that is accessible only by user name and password that me and my buddies know, so that only the three of us can access this page. on this page we could make something like a comment script that would update what is on the home page. Basically a script that we just go to our site, type in the password, and add a new section to the News column.

I'd like to use this on our site but i dont want anybody somehwo hacking in and spamming and/or ruining our front page.

Before you laugh at me - i know nothing about hacking and web security. :p
So any help here would be great.

Thanks.

[Twey]

How easy would it be for somebody to hack into a PHP file or one of my MYSQL databases and find a password to a secret page, or is it even possible?The software you use is hypothetically invulnerable. That is to say, it isn't, but you can't possibly defend against security holes nobody knows exist, so all you can do is trust that the developers know their software better than you do and keep updated with the patches they provide.

So, within that hypothesis, your site is as secure as the pages you code. If you write an insecure page, even if you just miss one possible exploit, your whole site is pretty much a pushover. Ask djr33 or cr3ative -- they know. Luckily for cr3, it was me who got in, but it could have been someone less friendly. djr33 wasn't so fortunate.

The number one thing you have to watch is user input. There are a few possibilities that don't involve it, but they tend to involve flaws in our hypothetically secure software. For the most part, then, you need to check user input again and again. For files, make sure they can't be put anywhere sensitive, and make sure they can't be named something that has permission to execute or change server configuration (server-side scripts; .htaccess files; overwriting files that you don't want overwritten...). If it's going to be executed in an SQL query, you need to check it doesn't contain any special characters. mysql_real_escape_string (http://www.php.net/mysql-real-escape-string)() is usually the best way of achieving that if you're using MySQL; I presume there are similar functions for other databases too. For other strings, you have to make sure they're being parsed as they should be, which of course changes depending on the parsing code.

It's an ongoing battle, but yes, what you're talking about is perfectly feasible, and seen in many sites all over the Web. Generally speaking, the simpler you keep things, the harder they are to crack. For example, a simple
if($_GET['password'] == 'incrediblySecretPassword')is pretty damn tricky to get past. :) And the best sort of login (for admin purposes, obviously this wouldn't do for a public login) is one that nobody knows even exists.

[InNeedofHelp]

Great. :D
So what advice can you give me to make sure this login is one that nobody knows exists? All i was planning on doing is making a page called something like newsupdater.php, and when i go there i get a form, login to it, then go update my news. And there will be no link to this page anywhere on the site, it'll be only known (supposedly) to my freinds and i who are working on the site. Is that secretive enough? Or should i just not even worry about that?

[Twey]

That's fine, but don't think that means it's invulnerable. You still have to make all the usual checks too.

[InNeedofHelp]

Right, well I plan to use that simple code you suggested above.


if ($_POST['password'] == 'thisisthepassword')

Thanks. :D