Poor PHP Programming

Lately, I’ve been working on numerous projects where I’m debugging or updating other people’s code.  I’m constantly amazed at the poor programming that goes into a lot of these sites.  They are filled with SQL injection vulnerabilities, confusing file structures, even remote code execution problems.

Properly escape database queries – By including a user provided variable directly into a query, you are opening yourself up to SQL injection problems.  For example this code:

mysql_query(” SELECT * FROM sometable WHERE somecolumn = ‘”.$_POST[‘somevalue’].”‘);

is just plain bad! You are allowing the user to insert arbitrary data into the query without sanitizing it first.    Always sanitize your variables before using them in a query, or better yet, use a database abstraction layer like PEAR::DB that does the escaping for you.

Don’t store user passwords in clear text!   I hate it when sites do this.  Combined with SQL injection attacks, this could allow hackers to view all of the usernames and passwords in your database.   At the very least, you should store the password as an MD5 hash, preferably with some salt so that even if an attacker manages to read the values of your table, they are much more difficult to use.   Since most users tend to re-use passwords, it also allows hackers to potentially use stolen user credentials to access other accounts not even associated with your site.

Poor file structures can be extra confusing.  One of the site’s I’m working with now has no less than three copies of most of the code spread between a half dozen directories with no clear association between them.   Files in one directory are including library files in a completely unrelated directory.   In this case, a development branch was using a combination of production and development usernames to access a remote resource, causing extreme amounts of confusion, and destroying the integrity of the data.

I’ve also recently become converted to using Subversion to track code changes over time.  I used to keep multiple copies of a file (include.php.OLD, include.php.1, OLDinclude.php, you know the drill) but Subversion makes it far easier to keep backup coies and refer back to them if something breaks.

The future of Television

This recent story on Wired caught my attention

http://www.wired.com/news/wiredmag/0,72506-1.html?tw=wn_story_page_next1

It’s about a new company called Joost that has plans to reinvent the television market as we know it today.

Essentially, the designers of Kazaa and Skype are applying a lot of the concepts that they have learned with those ventures to the Television marketing where they could announce any kind of product no matter what. Encrypted 10 second video clips, will be streamed from peers and assembled back into a full program.  Their design also adds a lot of modern social networking concepts, like inviting others to view your show, and applying tags to clips.
Television will be huge for marketing but expensive.

It will be interesting to follow how this technology develops.

First experience with Subversion

I’ve long realized the importance of version control, but since I tend to work on most projects myself, I’ve never really been force to use one. Recently though, I’ve been working on several different website simultaneously, and I’ve found myself making changes to code on one site.

Subversion is the perfect answer to this situation.  I’ve recently set up a subversion repository for my common code, and I can now work on the code on one site and ‘commit’ it.  Then, just update my local copy on another site, and all of my work is merged.

Of course, I have to take care to realize what the updates will do, and that it doesn’t break functionality on each site, but the usefulness of being able to share code like this is amazing.

What companies can do to avoid phishing scams

A recent blog post about the Google Blacklist brought up a thought I had a while ago about reducing the effectiveness of phishing. In his post Micheal says that “The pages are generally exact replicas of the original web page and generally pull graphics (*.jpg, *.gif, etc.) from the legitimate web site.” This has been my experience as well. The phishing page actually includes graphics from the legitimate site.

I can see a couple reasons for this.

  1. The phishers have some concern about bandwidth usage or disk space usage on their hosts
  2. When the page is loading, some browsers will say “waiting for www.paypal.com” which helps to make the site appear more legitimate.
  3. Phishers are lazy and don’t want the added work of changing the source and uploading more files to their web host

In any case, the fact that these phishing sites are pulling graphics from the legitimate site provides an easy way for the target site to identify phishing sites. On 90% (or more) of browsers, when the browser requests a graphic, it sends an HTTP_REFERRER header that tells the web server which page included the graphic.

For example, if you are hitting my site now, your browser requested this graphic:

http://www.brandonchecketts.com/wp-content/themes/cordobo-green-park-09-beta-09/images/h3_bg.gif

When your browser requested it, it also told my web server which page the request originated from. This is the default behavior for all major browsers. The request in my Apache log looks like this:

11.22.33.44 – – [05/Jan/2007:09:59:58 -0500] “GET /wp-content/themes/cordobo-green-park-09-beta-09/images/h3_bg.gif HTTP/1.1” 200 1581 “http://www.brandonchecketts.com/wp-content/themes/cordobo-green-park-09-beta-09/style.css” “Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1”

Basically, your web browser told my server to request the graphic, and that the page that instructed it to do that was the “style.css” file.

The phishing targets (PayPal, eBay, Bank of America, etc) could easily look through their logs to identify those phishing sites that are including their graphics.

Or, better yet, instead of just displaying the static images, they could program their web server to look at the HTTP_REFERRER field on each request. If it comes from a legitimate source, then display the normal graphic. If it comes from an unknown source, then display an alternate graphic that says “THIS IS NOT THE REAL PAYPAL SITE!”

Who knows why they haven’t done this yet. I could whip up a script to do it in about an hour!

2007 Predictions

Lots of the blogs I read are making predictions for 2007, so I figured I’d chime in with my own (mostly agreeing with others).

Second life will get a bunch of negative press (finally)

– The biggest news in Virtual Worlds will be when Areae debut’s their upcoming Virtual World product.  Presumably, here are some of the characteristics it will have:

  • A broad environment with loose storyline
  • The world will piece together chunks of content provided by the users, much the same way that an news reader pulls in RSS feeds from a variety of sources.
  • Users will be able to provide much of the content.  I’m not sure how they will accomplish this, but it will be something like creating web sites, as opposed to creating 3D content (like in Second Life)
  • Along with the previous point, I suspect that users will be able to host the content themselves somehow.

– I’ll finally find a way to make a full-time living with online games

ldssd.org is now live

I’ve spent the past few days working on a new website at ldssd.org. The site has most of the LDS Scriptures available online, and can generate them in an RSS Feed that will deliver one chapter to you each day. The site still has a couple of small issues that should be fixed soon, but I wanted to make sure that it was ‘officially’ launched today in time for people (me) to keep their New Years Resolutions to read the scriptures each day.

Asian earthquake brings virtual currency sales to a screeching halt

IGE, MySuperSales, GamerKing, EzGaming, Enotts (all really the same company), Mogs, FavGames, and Guy4Game are all reporting significant delays in virtual currency deliveries due to the earthquake in Asia. Vendors that do have stock available are being overwhelmed. In short, if you plan on buying any virtual currency in the next few days, expect some significant delays.

Debugging with strace

strace is a useful Linux utility for watching the system calls that a program makes. I usuall don’t have to dig this deeply into an application to debug it, but I’m running int a problem with one application, and the developer recommended doing an strace to see if anything looks suspicious. Here’s the command I’m using:
strace -Fft -o /var/tmp/strace.out -p <PID>

This command has a couple useful options. the “Ff” makes the strace follow program forks. The “-t” makes it print a human readable timestamp before each line. The “-o” argument dumps the output to the specified file, and the -p argument attaches it to a specific process.

The output is fairly cryptic, but I’m hoping that it catches something useful

Finally, a Page Rank of 4!

Google is a mystery to me. The home page of this site has had a Page Rank of 2 for quite a while. Right, now, if you check out my links on Google, it shows the same ones that I’ve had forever, bu somehow I suddenly have a page rank of 4!

I have been working on generating more content on this site (like the semi-regular blog postings). As part of that, I installed WordPress, which I supposed search engines might like. I’ve also been generating some incoming links by posting a couple things on Slashdot and various other places. In addition, I’ve noticed that I’m slowly getting a few more people that have installed my speedtest, which has a link to this site.

I guess everything is working. Now I need to start doing this to the sites that I make money from 🙂

Changing the IP Address of a DNS Server

We’re upgrading our DNS Servers from BIND to PowerDNS, and at the same time, will be changing their IP addresses to move them onto different networks.

I looked all over the Internet and could never really find a way to change the IP address of a DNS server. It seemed that there was a chicken and egg problem. Suppose you have a domain named mydomain.com. At your registrar, you’ve told them that the Primary name servers for mydomain.com are ns1.mydomain.com and ns2.mydomain.com.

Now, if you change the IP address of ns1 & ns2.mydomain.com, how does the rest of the Internet know how to get to them? The solution is that somewhere, there is a global registry of DNS servers that really define where ns1 and ns2.mydomain.com are at. I’m not sure where this is at, but fortunately, our registrar (Godaddy) has a way to edit them. All that was required was to log into our Godaddy account, find the “host summary” section, and change the IP addresses there that were assigned to ns1 and ns2.

I assume that once we changed that, Godaddy submits those changes to the mysterious database of name servers. They said it takes 4-8 hours for that to happen, but I noticed queries coming in to our new servers immediately. Queries will continue to go to our old DNS server for a couple days. dnsstuff.com has a cool tool called “ISP Cached DNS Lookup” where you can see how long your DNS records are cached at many major ISP’s.

With careful planning and an decent understanding of how DNS works, our switchover went flawlessly.