Implementing Secure

Transactions with PHP

and MySQL
Khalilullah Akbari
khalil.akbari18@gmail.com
Providing secure transactions
Providing secure transactions using the Internet is a matter of examining the flow of
information in your system and ensuring that, at each point, your information is
secure. In the context of network security, there are no absolutes. No system is ever
going to be impenetrable. By secure, we mean that the level of effort required to
compromise a system or transmission is high compared to the value of the
information involved.
Providing secure transactions
Using Secure Sockets Layer (SSL)
The Secure Sockets Layer protocol suite was originally designed by Netscape to
facilitate secure communication between web servers and web browsers. It has since
been adopted as the unofficial standard method for browsers and servers to
exchange sensitive information.
Using Secure Sockets Layer (SSL)
Networking protocols and the software that implements them are usually arranged as
a stack of layers. Each layer can pass data to the layer above or below and request
services of the layer above or below
Using Secure Sockets Layer (SSL)
Using SSL adds an additional transparent layer to this model. The SSL exists between
the transport layer and the application layer. The SSL modifies the data from the HTTP
application before giving it to the transport layer to send it to its destination.
Using Secure Sockets Layer (SSL)
SSL is capable of providing a secure transmission environment for protocols other
than HTTP. Other protocols can be used because SSL is essentially transparent. The
SSL provides the same interface to protocols above it as the underlying transport
layer. It then transparently deals with handshaking, encryption, and decryption.
Using Secure Sockets Layer (SSL)
Using Secure Sockets Layer (SSL)
Using Secure Sockets Layer (SSL)
Screening User Input
One of the principles of building a safe web application is that you should never trust
user input. Always screen user data before putting it in a file or database or passing it
through a system execution command.

You should use the addslashes() function to filter user data before it is passed to a
database. This function escapes out characters that might be troublesome to a
database. You can use the stripslashes() function to return the data to its original
form.
Screening User Input
You can switch on the magic_quotes_gpc and magic_quotes_runtime directives in
your php.ini file. These directives automatically add and strip slashes for you. The
magic_quotes_gpc applies this formatting to incoming GET, POST, and cookie
variables, and the magic_quote_runtime applies it to data going to and from
databases.

You should use the escapeshellcmd() function when you are passing user data to a
system() or exec() call or to backticks. This function escapes out any metacharacters
that can be used to force your system to run arbitrary commands entered by a
malicious user.
Screening User Input
You can use the strip_tags() function to strip out HTML and PHP tags from a string.
This function prevents users from planting malicious scripts in user data that you
might echo back to the browser.

You can use the htmlspecialchars() function, which converts characters to their HTML
entity equivalents. For example, < is converted to &lt;.This function converts any
script tags to harmless characters
Providing Secure Storage
The three different types of stored data (HTML or PHP files, script-related data, and
MySQL data) are often stored in different areas of the same disk.

The most dangerous type of data you store is executable content. On a website, this
usually means scripts. You need to be very careful that your file permissions are set
correctly within your web hierarchy. By this, we mean the directory tree starting from
htdocs on an Apache server or inetpub on an IIS server. Others need to have
permission to read your scripts to see their output, but they should not be able to
write over or edit them.
Storing Credit Card Numbers
Now that we’ve discussed secure storage for sensitive data, one type of sensitive data
deserves special mention. Internet users are paranoid about their credit card
numbers. If you are going to store them, you need to be very careful. You also need to
ask yourself why you are storing them and whether it is really necessary.

If you are going to store large numbers of your customers’ card details, make sure
that you have a skilled and somewhat paranoid system administrator who has enough
time to check up-to-date sources of security information for the operating system and
other products you use.
Using Encryption in PHP
A simple, but useful, task you can use to demonstrate encryption is sending
encrypted email. For many years, the de facto standard for encrypted email has been
PGP, which stands for Pretty Good Privacy. Philip R. Zimmermann wrote PGP
specifically to add privacy to email.

An open source alternative to PGP has more recently become available. Gnu Privacy
Guard, known as GPG, is a free replacement for PGP. It contains no patented
algorithms and can be used commercially without restriction.
Installing GPG
To add GPG to your Linux machine, you can download the appropriate archive file
from www.gnupg.org. Depending on whether you choose the .tar.gz or .tar.bz2
archive, you need to use gunzip or tar to extract the files from the archive.
Installing GPG
If you are using the command-line version of GPG to generate your keys, enter the
following command:
gpg –-gen-key
You are prompted with a number of questions. Most of them have a default answer
that you can accept. On separate lines, you are asked for your real name, your
email address, and a comment, which will be used to name the key.
To export the public key from your new key pair, you can use the following command:
gpg --export > filename
Installing GPG
If you want to email this key to people so that they can import it into their key rings,
you can instead create an ASCII version like this:
gpg --export –a > filename

To import the pubic key exported earlier, use the following command:
gpg --import filename
Testing GPG
GPG should now be set up and ready to use. Creating a file containing some text and
saving it as test.txt will allow you to test it.
gpg -a --recipient ‘Luke Welling ’ --encrypt test.txt

and create a file named test.txt.asc. If you open test.txt.asc, you should see an
encrypted message like this:
Testing GPG
Testing GPG
You should be able to transfer this file to the system where you generated the key
initially and run
gpg test.txt.asc

to retrieve your original text. The text will be written to a file with the same name as it
had before—in this case, test.txt.
To have the text echoed to the screen, use the -d flag:
gpg -d test.txt.asc
Thank You