To all the people who carelessly claim that Cross Site Scripting (XSS) is not a real security problem here is definitive proof that the threat is quite real. A very creative user of MySpace, Samy created a little self propogating worm via a stored XSS attack. He was able to inject raw HTML into his profile by breaking the normally disallowed "javascript" into components, relying on IE to "combine" it back together. This code snippet then utilized XMLHTTPRequest, usually used for Ajax to execute a request in the background that would cause the viewer to transparently add Samy (author of the trick) to their buddy list. The "worm" component of the hack used the same code to insert the attack HTML sequence into the profiles of comprised users allowing the hack to self propagate. The attack process and why it was possible is explain is fair amount of detail here. It should be noted that while Samy was careful not to cause any lasting damage, a more malicious person could have used the same code to do a w...

I am happy to announce that the SQL Injection chapter from my book, Guide to PHP Security has been published on MySQL's developer zone. You can find this chapter here.

Here goes the 2nd and hopefully the final release candidate prior to the final 2.7.3 release. Not a whole lot of changes, nearly all of them bug fixes. One welcome addition is the newly deployed Korean translation which brings FUDforum's localization number to 24 (WOW!). Big thanks to all the people who have and continue spending the time adding and updating the translations. This RC offers a small number of bug fixes, which is usually a good sign indicating we are nearing the final release. You can download the installer or upgrade script at the listed links. Some of the "main" changes include the following: Updated the French Translation. Workaround for Solaris that does not support GLOB_BRACE. The message compactor is now fully operational. Fixed a bug with search indexing when PostgreSQL is used. Fixed a bug when posting message to NNTP from the forum where the NNTP server requires authentication.

My book, PHP Security Guide is now available for purchase on Amazon and Barnes & Noble. Unfortunately both of these stores have the book's title wrong in different and "creative" fashions, more so on B&N where they've decided to come up with their own creative title :P. Hopefuly these will be corrected in short order and additional info about the book (that was sent to them) will appear as well. Non the less, both stores now carry the book and have stock ready to ship, so if you want a copy you can now get one for under $25.

Two weeks late, but, better late then never, that's what I think :-). The September issue of PHP|Architect, has a fairly long and hopefully interesting article on PDO covering all of the new features found at the time. As far as PDO material goes, aside from the manual it is probably the most up to date resource on it that you can find. And even then it does not cover my BC break that was made recently. So if you are considering using PDO, this is definitely something that should be of interest. The issue also held a pleasant surprise for me, which was a fairly detailed and positive review of FUDforum, yey! It only got 4 stars (out of 5), but I did manage to acquire the missing star directly from Peter (Forum’s Reviewer, thanks for the review btw) on a napkin, PERFECTION!!! :-).