PHP security-session data exposure (2)

Session data exposure

When you focus on preventing source code exposure, your session data is only equally at risk. By default, SESSION is saved in the /tmp directory. This is convenient in many situations, one of which is that all users have write permissions to /tmp, so Apache also has permission to write. Although other users cannot read these session files directly from the shell environment, they can write a simple script to read them:

 <?php
 
  header(&#39;Content-Type: text/plain&#39;);
  session_start();
 
  $path = ini_get(&#39;session.save_path&#39;);
  $handle = dir($path);
 
  while ($filename = $handle->read())
  {
    if (substr($filename, 0, 5) == &#39;sess_&#39;)
    {
      $data =
file_get_contents("$path/$filename");
 
      if (!empty($data))
      {
        session_decode($data);
        $session = $_SESSION;
        $_SESSION = array();
        echo "Session [" . substr($filename, 5) .
"]\n";
        print_r($session);
        echo "\n--\n\n";
      }
    }
  }
 
  ?>

This script searches for files prefixed with sess_ in the session file saving directory defined by session.save_path. Once the file is found, its contents are parsed and its contents are displayed using the print_r() function. This way other developers can easily obtain your user's session data.

The best way to solve this problem is to store your session data in a database protected with a username and password. Since access to the database is controlled, this adds an extra layer of protection. By applying the techniques mentioned in the previous section, your database can provide a safe place for your sensitive data, but you should remain vigilant that the security of your database is becoming increasingly important.

In order to save session data in the database, you first need to create a data table:

  CREATE TABLE sessions
  (
    id varchar(32) NOT NULL,
    access int(10) unsigned,
    data text,
    PRIMARY KEY (id)
  );

If you are using MySQL, the table structure is described as follows:

 
  mysql> DESCRIBE sessions;
 
+--------+------------------+------+-----+---------+-------+
  | Field  | Type             | Null | Key | Default
| Extra |
 
+--------+------------------+------+-----+---------+-------+
  | id     | varchar(32)      |      | PRI |        
|       |
  | access | int(10) unsigned | YES  |     | NULL  
 |       |
  | data   | text             | YES  |     | NULL  
 |       |
 
+--------+------------------+------+-----+---------+-------+

If you want session data to be saved in this table, you need to use session_set_save_handler( ) function to edit PHP's built-in session mechanism:

<?php
 
  session_set_save_handler(&#39;_open&#39;,
                           &#39;_close&#39;,
                           &#39;_read&#39;,
                           &#39;_write&#39;,
                           &#39;_destroy&#39;,
                           &#39;_clean&#39;);
 
  ?>

Each of these six arguments is the name of a function that you must write. These functions handle the following tasks:

Each of the above six parameters represents the name of the function that you must write. They handle the following tasks. ：

##l Turn on session storage

##l Turn off session storage

l   Read session data

l     Write session data

l     Destroy session data

l Clear old session data

I intentionally use meaningful names so that you can see their purpose at a glance. Naming is arbitrary, but you may want to start with an underscore (as shown here) or another naming convention to prevent name conflicts. Here are examples of these functions (using MySQL):

 <?php
 
  function _open()
  {
    global $_sess_db;
 
    $db_user = $_SERVER[&#39;DB_USER&#39;];
    $db_pass = $_SERVER[&#39;DB_PASS&#39;];
    $db_host = &#39;localhost&#39;;
 
    if ($_sess_db = mysql_connect($db_host,
$db_user, $db_pass))
    {
      return mysql_select_db(&#39;sessions&#39;,
$_sess_db);
    }
 
    return FALSE;
  }
 
  function _close()
  {
    global $_sess_db;
 
    return mysql_close($_sess_db);
  }
 
  function _read($id)
  {
    global $_sess_db;
 
    $id = mysql_real_escape_string($id);
 
    $sql = "SELECT data
            FROM   sessions
            WHERE  id = &#39;$id&#39;";
 
    if ($result = mysql_query($sql, $_sess_db))
    {
      if (mysql_num_rows($result))
      {
        $record = mysql_fetch_assoc($result);
 
        return $record[&#39;data&#39;];
      }
    }
 
    return &#39;&#39;;
  }
 
  function _write($id, $data)
  {
    global $_sess_db;
 
    $access = time();
 
    $id = mysql_real_escape_string($id);
    $access = mysql_real_escape_string($access);
    $data = mysql_real_escape_string($data);
 
    $sql = "REPLACE
            INTO    sessions
            VALUES  (&#39;$id&#39;, &#39;$access&#39;,
&#39;$data&#39;)";
 
    return mysql_query($sql, $_sess_db);
  }
 
  function _destroy($id)
  {
    global $_sess_db;
 
    $id = mysql_real_escape_string($id);
 
    $sql = "DELETE
            FROM   sessions
            WHERE id = &#39;$id&#39;";
 
    return mysql_query($sql, $_sess_db);
  }
 
  function _clean($max)
  {
    global $_sess_db;
 
    $old = time() - $max;
    $old = mysql_real_escape_string($old);
 
    $sql = "DELETE
            FROM   sessions
            WHERE  access < &#39;$old&#39;";
 
    return mysql_query($sql, $_sess_db);
  }
 
  ?>

You must call session_set_save_handler() before session_start() ) functions, but you can define the functions themselves anywhere.

The beauty of this process is that you don't have to edit the code or change the way you use sessions. $_SESSION still exists, the behavior remains the same, PHP still generates and delivers session identifiers, and configuration changes related to the session will also take effect. All you need to do is call this one function (and create all the functions specified by it) and PHP will take care of the rest.

The above is the content of PHP Security - Session Data Exposure (2). For more related content, please pay attention to the PHP Chinese website (www.php.cn)!