Register Members List Search Today's Posts Mark Forums Read

Reply
 
Article Options
Getting Ready for VB3 - A Coding Tutorial
amykhar
Join Date: Oct 2001
Posts: 4,438

PA
by amykhar amykhar is offline 27 Jun 2003

My husband is a Visual Basic programmer (ick) and heís always after me to teach him web development. So, when I started working on a redesign of a modification for VBulletin 3, I told him that he could help me code it. To get him started, I installed a local version of PHP on his computer, and sent him to Web Monkey to take a tutorial.

Shortly after he got started, he yelled for help. He was working on reading data from a form and printing it out to the screen and the data refused to print. I read the code several times, and everything seemed correct. After a couple of minutes of tinkering, I saw that data within his PHP script would print, but not the data being passed in from the form.

Suddenly, in the deep recesses of my mind, a tiny lightbulb went on in my head, and I went to Google to research Register Globals.

By default, Register Globals is now set to OFF in PHP versions 4.2.0. In previous versions, it defaulted to ON. Therefore, things that we always assumed were just how PHP worked (such as being able to process form data easily) work a bit differently now.

The official PHP documentation says:

When on, register_globals will inject (poison) your scripts will all sorts of variables, like request variables from HTML forms. This coupled with the fact that PHP doesn't require variable initialization means writing insecure code is that much easier. It was a difficult decision, but the PHP community decided to disable this directive by default. When on, people use variables yet really don't know for sure where they come from and can only assume. Internal variables that are defined in the script itself get mixed up with request data sent by users and disabling register_globals changes this.
To solve my husbandís problem, I quickly went to his php.ini file, turned Register Globals on, and restarted Apache. Problem solved - the lazy way.

What I really should have done was teach him how to code properly when Register Globals is off, and that is the point of this tutorial. Vbulletin 3 is coded to work with Register Globals off, and any modifications we write should be as well.

So, itís time for us to break some bad habits and learn how to write elegant, more secure code.

One of the blessings, and curses, of PHP is that itís easy and it forgives mistakes. Unlike other languages, PHP does not require us to initialize variables. This makes it cake to throw together a script or VBulletin modification in a matter of minutes.

Unfortunately, the ability to code quickly and easily makes it just as easy to code sloppily. Just about all of us have been guilty of sloppy coding at one time or another. Itís too easy to just throw together something that works and forget about form and style.

Sloppy coding can create security holes though.

Take this example:


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

It would be trivial for somebody to construct a url such as http://www.stupidscript.com/secure.php?userid=1

and whether they were an admin or not, they could possibly do some pretty naughty things.

By initializing userid to something else, and by validating incoming data, we could prevent havoc and mayhem.


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

The code above isnít totally secure. It wonít let a prankster set the userid in a GET or a POST request, but the cookie could still be forged. Data needs to be validated in several ways if security is a concern.

With Register Globals set to OFF, form data is retrieved by using the following syntax:

$variable1 = $_POST['variable1'];
or
$variable1 = $_GET['variable1'];

Whether you use $_POST or $_GET depends on the type of form used.

Even if security isnít an issue, having Register Globals set to off can help stop bugs from creeping in.

In VBulletin 2.x, it was possible to break the functionality of the board by using the wrong variable name in the phpinclude template. With Register Globals set to off, such problems might be prevented because variables will have to be intentionally passed into a script and wonít just drift in on their own.

Having Register Globals set to off wonít cure the worldís ills, and it will take some time to learn. But, if you are going to release code modifications for VBulletin 3, you should master the concept and use it.

More info:

http://www.onlamp.com/pub/a/php/2003..._security.html
Views: 3564
Reply With Quote
Comments
  #2  
Old 27 Jun 2003, 19:43
Gary King's Avatar
Gary King Gary King is offline
 
Join Date: Jan 2002
Nice post you made here amy

I always code with register_globals set to OFF, because, as you quoted, it is quite insecure, and the default is now set to off (although many webhosts still set it to ON for the convenience of its customers).
Reply With Quote
  #3  
Old 28 Jun 2003, 04:03
Erwin's Avatar
Erwin Erwin is offline
 
Join Date: Jan 2002
Nice tips.
Reply With Quote
  #4  
Old 28 Jun 2003, 04:25
amykhar's Avatar
amykhar amykhar is offline
 
Join Date: Oct 2001
Real name: Amy
Thank you
__________________
amykhar.com
----------------------------------------
I do not respond to PM requests for coding assistance.
Reply With Quote
  #5  
Old 20 Aug 2003, 15:16
GCPrez GCPrez is offline
 
Join Date: Dec 2002
06-27-03 at 02:43 PM Gary W said this in Post #2
Nice post you made here amy

I always code with register_globals set to OFF, because, as you quoted, it is quite insecure, and the default is now set to off (although many webhosts still set it to ON for the convenience of its customers).

Please explain to me why it's convienient for people that install scripts and don't know much about coding? Aren't most scripts assuming register glabals are turned off? I just don't understand how it's a convienence if it's a security hole.
__________________
Best,
-D
http://HyattArt.com
Reply With Quote
  #6  
Old 20 Aug 2003, 18:52
NTLDR's Avatar
NTLDR NTLDR is offline
 
Join Date: Apr 2002
Real name: Lee Botley, BSc (Hons)
Its convenient because variables are global as the name sugests. For example it may be posible to overwrite a value by appending it to the URL:

EG: URL: test.php?debug=1


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

In the above example it checks if $debug is set, if there has been no declaration within the file and register_globals is ON then it will take the variable value from the URL, which may not be desired. If register_globals is OFF then you would need to use $_REQUEST['debug'] or $_GET['debug'] to access that variable within the script.

vB2 works with register_globals ON or OFF and registers the globals for you if its set to OFF. Its convenient because many scripts still require register_globals set to ON, hence why many hosts have it turned on.
__________________
Lee Botley, BSc (Hons) - vBulletin.org Moderator
http://www.thesistersthree.com/lee/sigs/signature.ts3
The Sisters Three Charmed Discussion Forums

WinterDir .:. vBindex v2.1 for vB2 .:. vBindex v3.0.0 RC5 for vB3
Reply With Quote
  #7  
Old 20 Aug 2003, 20:06
GCPrez GCPrez is offline
 
Join Date: Dec 2002
Thanks Lee! I understand that now. :banana:
__________________
Best,
-D
http://HyattArt.com
Reply With Quote
  #8  
Old 20 Aug 2003, 23:29
ap0c's Avatar
ap0c ap0c is offline
 
Join Date: Mar 2003
great thread, any more pointers on the way?
Reply With Quote
  #9  
Old 05 Oct 2003, 21:04
kill_emma's Avatar
kill_emma kill_emma is offline
 
Join Date: Sep 2003
Real name: matt
o_< reminds me of "Getting Ready for Y2K"
Reply With Quote
  #10  
Old 30 Oct 2003, 14:38
gmarik's Avatar
gmarik gmarik is offline
 
Join Date: May 2002
Real name: Marco
Has anybody read my tips?
If not, can add them here.
Reply With Quote
  #11  
Old 30 Oct 2003, 16:32
KuraFire's Avatar
KuraFire KuraFire is offline
 
Join Date: Nov 2001
Real name: Faruk
Originally Posted by amykhar
<snip>

Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

<snip>
You have a little parse error in your code:
$_COOKIE['userid]; will give a parse error, it should be:
$_COOKIE['userid'];

Just FYI that you typo'd


Originally Posted by NTLDR
EG: URL: test.php?debug=1


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

In the above example it checks if $debug is set, ...
Actually, to be entirely precise, it checks whether the variable $debug evaluates to TRUE.

There is a vital difference between a variable that is set and a variable that evaluates to true.

This is important to note, because for starting programmers it's important to know the difference

For instance, if I SET my variable like this:
$debug = 0;

the variable is set fine, and it does exist fine. But it won't evaluate to TRUE, and so that if () will not occur.


If at any point you want to know if a variable is SET, use:


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

if you want to know if the variable evaluates to TRUE, use:


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

etc....

(for detailed hacking guidelines, wait a while until vB3 RC1 is out and we have the Hacking Document ready at vB.org )
__________________
EverythingvB.com is closed; it will merge into the KuraFire Network, version 6. KF*N 6 will have information about XHTML, CSS, PHP and vBulletin, and especially all those combined.
Reply With Quote
Reply



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Article Options

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


New To Site? Need Help?

All times are GMT. The time now is 04:56.

Layout Options | Width: Wide Color: