PHP - XML: Retrieving Attribute Values

Example of XML: Retrieving Attribute Values by PHP

First, create xml document like this:

01	<?xml version="1.0"?>

02

<datas>

03

<cars>

04

<car>

05	<manufacture country="japan">Honda</manufacture>

06	<type>Honda Jazz</type>

07

</car>

08

<car>

09	<manufacture country="korea">Nissan</manufacture>

10	<type>Nissan Livina</type>

11

</car>

12

</cars>

13

</datas>

Save as "cars.xml" within www/test/xml. Then create reader like this:

view source

print?

01

<?php

02	$xml = simplexml_load_file("cars.xml")

03	or die("Error: Cannot create object");

04

05	foreach($xml->children() as $cars){

06	foreach($cars->children() as $car => $data){

07	echo $data->manufacture['country'];

08	echo "<br />";

09

}

10

}

11

12

?>

How to set HttpOnly in Apache Web Server

Without having HttpOnly and Secure flag in HTTP response header, it is possible to steal or manipulate web application session and cookies. It’s good practice to set HttpOnly and Secure flag in application code by developers. However, due to bad programming or developers’ unawareness it comes to Web Infrastructures.

Implement in Apache:

For detail Click here

Cross-Site Request Forgery(CSRF)

Cross-Site Request Forgery

Cross-Site Request Forgery, or CSRF for short is a common and regular online attack is. CSRF also goes by the acronym XSRF and the phrase “Sea-Surf”. CSRF attacks include a malicious exploit of a website in which a user will transmit malicious requests that the target website trusts without the user’s consent. In Cross-Site Scripting (XSS), the attacker exploits the trust a user has for a website, with CSRF on the other hand, the attacker exploits the trust a website has against a user’s browser.

A Simple Example of a Cross-Site Request Forgery

For Detail Click here

Web Application Security

For Detail Click here

How to combat XSS using CodeIgniter?

What's XSS?

Cross Site Scripting (XSS) is the process of addition of malicious code to a genuine website to gather user’s information with a malicious intent. XSS attacks are possible through security vulnerabilities found in Web applications and are commonly exploited by injecting a client-side script. Although JavaScript is usually employed, some attackers also use VBScript, ActiveX or Flash.

Cross-site Scripting (also known as XSS or CSS) is generally believed to be one of the most common application layer hacking techniques.

For Detail Click here

How to remove SQL injection in Codeigniter?

In the web application security, SQL injections are placing a very important role. To prevent SQL injections in PHP , we usually use mysql_real_escape_string() function along with other techniques for mysql database.

In codeIgniter ,we no need to use mysql_real_escape_string() function, Codeigniter provides inbuilt functions and libraries to generate SQL queries by using those methods or functions we can avoid SQL injections.

There are three methods to prevent SQL injections in Codeigniter application, they are
1) Escaping Queries
2) Query Binding
3) Active Record Class

Removing SQL injection in Codeigniter using Escaping Query Method

Example:

<?

 $email= $this->input->post('email');

 $query = 'SELECT * FROM accounts WHERE user_name='.$this->db->escape($email);

 $this->db->query($query);

?>

Here $this->db->escape() determines the data type so that it can escape only string data.
It also automatically adds single quotes around the data so you don’t have to do that as well.

Removing SQL injection in Codeigniter using Query Binding Method

Example:

<?

    $sql = "SELECT * FROM accounts WHERE status = ? AND email= ?";

    $this->db->query($sql, array('active', 'info@primebank.com.bd '));

?>

The question marks in the query are automatically replaced with the values in the array in the second parameter of the query function.

in Query Binding Method, you don’t have to escape the values manually as it will automatically do that for you.

Removing SQL injection in Codeigniter using Active Record Class

Using Active Records, query syntax is generated by each database adapter. It also allows for safer queries, since the values are escaped automatically by the system.

Example:

<?

 $this->db->get_where('accounts',array('status' => 'active','email' => 'info@primebank.com.bd'));

?>