Re: FN-FORUM: PHP PostData security

date posted 29th May 2007 13:56

From: "Anthony Cartmell" [EMAIL REMOVED]
>
> > In summary, what was ultimately referred to as the MVC pattern to
> > approach (separation of logic) was to enable most developers to
> > kill web page security issues, whether by URL or form field
> > injection.
>
> MVC is another red-herring, as separting the model, view and controller
> has no intrinsic security benefits, merely maintenance and flexibility
> ones. In no way does using the MVC pattern "kill web security issues". The
> location of the logic, and the number of pages used, doesn't matter: what
> matters is filtering inputs and escaping outputs.
>
> Processing user-supplied data on the same page that it was submitted from
> is no more risky than processing it via any number of objects in any
> pattern you like. The "solution" originally referred to was "a processing
> script that put all post variables into a session and then redirected to
> the main script", which suggested that copying $_POST variables into
> $_SESSION, and then redirecting, would have some magic security benefit,
> which is plainly wrong.

Sorry Anthony, on both points you have failed to understand the outcome of
this long thread - particularly on the second point. Feedback on this
subject has been based on a lot of failure to understand.

Disconnecting logic and methods from the client/business/data tier is just
that - whole disconnection. Noting of security flaws can get through. How
it's done is a matter of coding. To suggest MVC (I prefer n-tier) is a
red-herring is wrong. Correct separation is about security as well as good
architecture.

I repeated what I meant about $_SESSION variables but there is still a
failure ad nauseum to pick up that I do not, and would never, advocate
dumping request variables into a session variable. The notion is plainly
ridiculous. But parsing request variables for processing, acting upon them,
disposing them and, ad separatim returning results using the session
mechanism, is a good and robust way to go. There are other methods, but it
is a good way to go - and clean.

I did take on board some of criticism received to my posts on this thread. I
couldn't resist having a look at some of the websites produced by critics -
sheer nosiness. Alas, I saw a mixture of poor design, failed validation and
accessibility, and other issues with the result that I wondered how much
theory was put into practice.