Preventing session hijacking

Unfortunately, there is no effective way to unmistakably identify a request that originates from an attacker in opposite to a genuine request. Because most properties that counter measures check like the IP address or user agent characteristics are either not reliable (IP address might change among multiple requests) or can be forged easily (e. g. … Read more

Sending mass email using PHP

First off, using the mail() function that comes with PHP is not an optimal solution. It is easily marked as spammed, and you need to set up header to ensure that you are sending HTML emails correctly. As for whether the code snippet will work, it would, but I doubt you will get HTML code … Read more

How to prevent code injection attacks in PHP?

mysql_real_escape_string used when insert into database htmlentities() used when outputting data into webpage htmlspecialchars() used when? strip_tags() used when? addslashes() used when? htmlspecialchars() used when? htmlspecialchars is roughly the same as htmlentities. The difference: character encodings. Both encode control characters like <, >, & and so on used for opening tags etc. htmlentities also encode … Read more

If isset $_POST

Most form inputs are always set, even if not filled up, so you must check for the emptiness too. Since !empty() is already checks for both, you can use this: if (!empty($_POST[“mail”])) { echo “Yes, mail is set”; } else { echo “No, mail is not set”; }

How to validate array in Laravel?

Asterisk symbol (*) is used to check values in the array, not the array itself. $validator = Validator::make($request->all(), [ “names” => “required|array|min:3”, “names.*” => “required|string|distinct|min:3″, ]); In the example above: “names” must be an array with at least 3 elements, values in the “names” array must be distinct (unique) strings, at least 3 characters long. … Read more

Get JSON object from URL

$json = file_get_contents(‘url_here’); $obj = json_decode($json); echo $obj->access_token; For this to work, file_get_contents requires that allow_url_fopen is enabled. This can be done at runtime by including: ini_set(“allow_url_fopen”, 1); You can also use curl to get the url. To use curl, you can use the example found here: $ch = curl_init(); // IMPORTANT: the below line … Read more