Generally datas are two types when processing in a web page.

1. Filter Data
2. Tainted Data

Filter Data:
============
Any valuable data that is hard coded is filtered data, like 
$email = "amarbijay@pennywise.org".
This is bit secure.

Tainted Data:
=============
Generally tainted datas are attcked by the hackers.
Tainted data is anything that is not guaranteed to be valid, such as form data submit-ted by the user, email retrieved from an IMAP server, or an XML document sent from another web application like,


Semantic URL Attacks
=====================
This type of attack involves the user modifying the URL in order to discover what interesting things can be done.
For example an url structure
"http://www.example.com/profile.php?user=christ"
which display the profile of the user logged in. If some one tries to change the "user" query string value to see what interesting things come out in the screen like
"http://www.example.com/profile.php?user=jesu"
This is called semantic attack.

If sessions are being used to keep track of things, this can be avoided easily:
     <?php
     session_start();   
     if ($_SESSION['user'] == $_GET['user']))
     {
        // do the operation
     }else{
	// A hacking is attempted
     }
     ?>


File Upload Attacks
====================
While uploading a file from the interface,If the code uses tmp_name without verifying that
it is in fact the uploaded file, a theoretical risk exists. 
It refer to this as a theoretical risk because there is no known exploit that
allows an attacker to modify tmp_name. However, don’t let the lack of an exploit from implementing some simple safeguards. New exploits are appearing daily, and a simple step can protect you.

PHP provides two convenient functions for mitigating these theoretical risks: is_uploaded_file( ) and move_uploaded_file( ).
If we want to verify only that the file referenced in tmp_name is an uploaded file, we can use is_uploaded_file( ):
     <?php
     $filename = $_FILES['attachment']['tmp_name'];
     if (is_uploaded_file($filename))
     {
        $old_filename = $_FILES['attachment']['tmp_name'];
	$new_filename = '/path/to/attachment.txt';
	if (move_uploaded_file($old_filename, $new_filename))
	{
	  /* $old_filename is an uploaded file, and the move was successful. */
	}

     }
     ?>


Cross-Site Scripting
======================
Any application that displays input is at risk like web-based email applications, forums,
guestbooks, and even blog aggregators. In fact, most web applications display input
of some type—this is what makes them interesting, but it is also what places them at
risk. If this input is not properly filtered and escaped, a cross-site scripting vulnera-
bility exists.

This type of attack can be avoided easily by properly filtering input data and escaping output data.
For example, 
$html['name'] = htmlentities($clean['name'], ENT_QUOTES, 'UTF-8');
$html['comment'] = htmlentities($clean['comment'], ENT_QUOTES, 'UTF-8');


Cross-Site Request Forgeries:
==============================
A cross-site request forgery (CSRF) is a type of attack that allows an attacker to send
arbitrary HTTP requests to the server.

For example If a form method is "post" but still we are using "$_REQUEST" global variable to get the post values,
An attacker can use the form from view source and try o send arbitarry values through querystring in url,
which genearates a security issue.
<?php
session_start();
$clean = array();
if (isset($_REQUEST['item'] && isset($_REQUEST['quantity']))
{
   /* Filter Input ($_REQUEST['item'], $_REQUEST['quantity']) */
   if (buy_item($clean['item'], $clean['quantity']))
   {
     echo '<p>Thanks for your purchase.</p>';
   }
   else
   {
     echo '<p>There was a problem with your order.</p>';
   }
}
?>
So "$_REQUEST" variable shouldn't be used in case of usefull data.

While there are several possible ways to launch a CSRF attack, using an embedded
resource such as an image is the most common. To understand this particular
approach, it is necessary to understand how a browser requests these resources.

It can be avoided by using unique token in form elements
<?php
session_start();
$token = md5(uniqid(rand(), TRUE));
$_SESSION['token'] = $token;
$_SESSION['token_time'] = time();
?>
<form action="buy.php" method="POST">
<input type="hidden" name="token" value="<?php echo $token; ?>" />
<p>
Item:
<select name="item">
   <option name="pen">pen</option>
   <option name="pencil">pencil</option>
</select><br />
Quantity: <input type="text" name="quantity" /><br />
<input type="submit" value="Buy" />
</p>
</form>

<?php
if (isset($_SESSION['token']) &&
     $_POST['token'] == $_SESSION['token'])
{
   /* Valid Token */
}
?>


Spoofed Form Submissions
==========================
Suppose a form is like below,
<form action="http://www.example.com/process.php" method="post">

An attacker copy the view source of the form, changed all the input values and create a file in his server.
Now the attcker able to send arbitary values to the server using the form, which agian generaes a security issue.
So this is called spoofed form submission.

To avoid from this problem "$_SERVER['HTTP_REFERER']" can be used to check where the user came from or what is parent page.


Spoofed HTTP Requests
=======================
Modifying the raw HTTP request is called spoofed http request.

The following is an example of manually requesting the front page
of http://example.org/ using telnet technique:

     $ telnet example.org 80
     Trying 192.0.34.166...
     Connected to example.org (192.0.34.166).
     Escape character is '^]'.
     GET / HTTP/1.1
     Host: example.org
     HTTP/1.1 200 OK
     Date: Sat, 21 May 2005 12:34:56 GMT
     Server: Apache/1.3.31 (Unix)
     Accept-Ranges: bytes
     Content-Length: 410
     Connection: close
     Content-Type: text/html
     <html>
     <head>
     <title>Example Web Page</title>
     </head>
     <body>
     <p>You have reached this web page by typing &quot;example.com&quot;,
     &quot;example.net&quot;, or &quot;example.org&quot; into your web browser.</p>
     <p>These domain names are reserved for use in documentation and are not
     available for registration. See
     <a href="http://www.rfc-editor.org/rfc/rfc2606.txt">RFC 2606</a>, Section
     3.</p>
     </body>
     </html>
     Connection closed by foreign host.
     $

Also header can be modified using socket functions in php.

<?php
$http_response = '';
$fp = fsockopen('example.org', 80);
fputs($fp, "GET / HTTP/1.1\r\n");
fputs($fp, "Host: example.org\r\n\r\n");
while (!feof($fp))
{
  $http_response .= fgets($fp, 128);
}
fclose($fp);
echo nl2br(htmlentities($http_response, ENT_QUOTES, 'UTF-8'));
?>

As with spoofed forms, spoofed HTTP requests are not a concern. My reason for
demonstrating these techniques is to better illustrate how easy it is for an attacker to
provide malicious input to your applications. This should reinforce the importance
of input filtering and the fact that nothing provided in an HTTP request can be
trusted.



