Tag: security
Insecure Deserialization
Deserializing attacker-controlled data can trigger arbitrary object construction and method calls — PHP's unserialize() with untrusted input enables remote code execution via gadget chains in the loaded class graph.
CWE-502 OWASP A8:2021
1mo ago
security advanced
Insecure Randomness PHP 7.0+
Using non-cryptographic random functions (rand(), mt_rand(), array_rand()) for security tokens — these are predictable and enable token forgery, session prediction, and CSRF bypass.
2mo ago
security intermediate
Input Validation vs Output Encoding PHP 5.0+
Validation checks that input is acceptable; output encoding makes data safe for the context it's rendered in. Both are required.
2mo ago
general beginner