Archive for the ‘PHP’ Category
Wednesday, November 5th, 2008
I just finished porting php2sql 0.1 to the new Binnavi 2.0 database format. php2sql is my still private way to import PHP bytecode into Binnavi for manual analysation and navigation.
Here are some screenshots how the PHP bytecode of FluxBB 1.2.20 looks like in Binnavi.
First screen shows the project overview window. ...
Posted in PHP, Security | 5 Comments »
Monday, November 3rd, 2008
Now that the PHP namespace seperator is fixed as backslash developers around the world face two problems. On the one hand their source code will end up looking more ugly than .NET source code and on the other hand most non-american keyboards, especially those attached to apple computers will require ...
Posted in PHP | 25 Comments »
Friday, October 31st, 2008
During International PHP Conference 2008 there where a lot of discussions about the stupid backslash namespace seperator decision. Most of the guys "do not want to have their PHP files look like windows registry dumps" (Quoting some unknown guy at the panel discussion). Some people even suggested forking PHP at ...
Posted in PHP | 36 Comments »
Sunday, October 12th, 2008
Users of Suhosin-Patch will sooner or later see messages like "canary mismatch on efree() - heap overflow detected" in their error log. When this happens they are often confused and don't understand what it means.
The first questions they often ask themself are:
Did they trigger a bug in Suhosin?
Is something wrong ...
Posted in PHP, Security | 6 Comments »
Wednesday, October 1st, 2008
Although PHP 5.3 is still in alpha stage and certain features like the PHAR extension or the whole namespace support are still topics of endless discussions it already contains smaller changes that could improve the security of PHP applications a lot.
One of these small changes is the introduction of a ...
Posted in PHP, Security | 13 Comments »
Thursday, September 18th, 2008
Here are the slides of my ZendCon talk about Lesser Known Security Problems in PHP Applications.
(PDF) Lesser Known Security Problems in PHP Applications
Posted in PHP, Security | 18 Comments »
Monday, September 15th, 2008
The PHP Korea usergroup has organised an improvised PHP mini-conference and coding session called PHP Fest 2008, which will take place at the end of september in Seoul. The mini-conference is not only sponsored by Microsoft Korea but also takes place in the POSCO building in rooms owned by Microsoft ...
Posted in PHP, Security | 2 Comments »
Thursday, September 4th, 2008
The first questions regarding Suhosin are where the name comes from and what it actually means. I usually explain that Suhosin is similar to a guardian angel. Some ghost or god protecting a village from dark ghosts.
Yesterday I was able to take this picture of two of the guardian ghosts ...
Posted in PHP, Projects, Security | 1 Comment »
Friday, August 22nd, 2008
I just released Suhosin 0.9.26 which among bugfixes contains new features. The full changelog is
Fixed problem with suhosin.perdir
Thanks to Hosteurope for tracking this down
Fixed problems with ext/uploadprogress
Reported by: Christian Stocker
Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
Added better internal seeding of rand() ...
Posted in PHP, Projects, Security | 34 Comments »
Thursday, August 21st, 2008
Last week I gave my first webinar for MySQL titled "Bau sicherer LAMP Anwendungen". The webinar, which was a cooperation between MySQL and my company SektionEins, was held in german, covered SQL-Malware, SQL-Injection, safe programming and some tools to detect and block SQL-Injection attacks.
The recording of this webinar is now ...
Posted in MySQL, PHP, Security | 9 Comments »