W1 Assignment

The PHP Code

Brandon Whitley

South University Online

ITS4221

April 7, 2015

Introduction

PHP is a server-side scripting language, which is specially designed for development of websites. It is also used as a general purpose programming language. PHP was originally created in 1994, by Rasmus Randorf and was successfully installed in over 240 million websites. Originally, PHP stood for Personal Home page but is nowadays used to refer to HypertextPreprocessor. The code can easily be used with a combination of other engines or be mixed with HTML, (Turland, 2011). This paper examines the potential for attack and defense in the areas of input validation, access control and session management.

Locate the PHP code for validating the user's login information. Use the variables defined there to restrict the content page to only those who have successfully logged into the system.

The PHP code used for validating user’s login information is ‘config.php’. First, the common code is executed to connection to the database and for the session to start, the ‘common.php’ variable is required. At the top of the page, the process of ensuring that the user is either logged in or out takes place. If the user is not logged in, they are redirected to the log in page with the header ‘location: login.php’. With this, it is crucial as it permits only the accounts owner to view details in his or her account and no trespass to other users’ account. The content in the page is highly restricted to only those who have successfully logged into the system. The variables used in PHP are presented using the dollar sign followed by the name of the variable, which is case sensitive. Variables used are: $var, $4site and $tayte among others. In case the user enters a wrong email address, the filter option displays certain information to validate the codes and accept the sign in attempts.

Describe how the session is managed from page to page in the application. How long is the session active by default? What conditions will end the session?

Genuine account users will have all the information required for log in details and provide them on time. Delays in this case, are not flagged off, and the account may be suspended for a while until further verifications are made by the rightful owner. After the user enters the CAPTCHA code correctly, a database table is designed to necessitate storage of the username, password, account creation time, number r of log in attempts and last logged in IP address. These are very crucial in determining who logged in last in the system, (Tyson, 2014). The session is active by default for a maximum of twenty four hours before any sign out attempts are noted. This is the maximum amount of time the account is expected to remain inactive before the default pages are restored, for the purpose of data security.

Identify the form validation rules that need to be put in place for the login form and the registration form. What format should the data have? What is the maximum length of each item? Identify the necessary functions in JavaScript and PHP to create these validation rules and list them in your report.

By default, the validation framework expects the user to key in information into selected or marked fields. Validation rules are specified per action for example, the ‘action class’ where the java class name of the action element is specified. Secondly, the XML file is required to be placed in the class path (Leon, 2001). This is the same location as the action class where rules are further specified using validators. The maximum length for each item is six characters and the format entirely depends on the data types used. Examples of validators are: field validators and non-field validators.

References

Turland, M. (2011). PHP Master. London: Cengage learning.

Tyson, S. (2014). Decode the PHP Codes. New York: Cambridge University Press.

Leon, A. (2001). Core PHP Programming. California: CRC Press.