• Awning Works 1
  • Socaz 2
  • Socaz 1
  • Randy Montana 3
  • Randy Montana 2
  • Randy Montana 1
  • Rodgers & Hammerstein 3
  • Rodgers & Hammerstein 2
  • Rodgers and Hammerstein 1
  • Love Fine Art
  • May
  • 11
  • 2009

Uploading Large Images

Posted by admin In PHP | No Comments »
Uploading Large Images

Recently I was working on scripting the back end of a commercial site in PHP5. In this case the back end user interface permits users to upload rather large image files so that the files can be processed for ‘Zoomify’( a fast way of showing a highly detailed “zoomable” image). After making sure the process was secure, I also needed to change a few settings in the php.ini file in order for the system to allow files sizes of over 2 megs (the standard PHP5 default).

It is generally not wise to make these changes in the php.ini file itself unless you have a very good reason. The preferred way would be to make the required change at execution time for the particular script you happen to be running only. This gives you better control over site operations and security. To do this you use the “ini_set()”  function.
To demonstrate how to do this, I will show you the code for the four changes I needed to make to my script to accommodate the large image uploads. First, I defined global variables that determine what the setting should be.

Defineing Globals in PHP

Defineing Globals in PHP

I do this so that later if I chose to edit the settings I can do so from my configuration file and not have to hunt through the script to make the changes. Also this allows me to duplicate the setting elsewhere if needed. The setting are as follows:

Use ini_set() to change settings in the php.ini file.

Also, If you are using a form to upload the file, do not forget to make the MAX_FILE_SIZE directive large enough to accommodate your file size. By the way, do not rely on MAX_FILE_SIZE as any sort of security measure.

Once I made these settings on my local testing server, all worked well. However, after the site was in the “live” pre production mode, the large file sizes would return an error. I knew it was not the file size issue because I had already compensated for that. What tipped me off to the problem was the fact that, every once in a while the file would upload with no error. That is when I realized it was not only a “memory limit” issue but also a timing issue. This did not show up at first because it takes much longer for a file to upload to a remote server than to the local server.

Settings we do not often deal with are easy to forget about and that was the case this time. Once I remembered to reset the “max_execution_time”  to the appropriate amount of seconds, the files uploaded just fine.

As mentioned above, the maximum execution time limit is set in the php.ini file. The line of code in the php.ini file is:

Set the max_execution time in the php.ini file.

Set the max_execution time in the php.ini file.

With this little line of code in your PHP script, you are now afforded 180 seconds of time to run your program. You can adjust the seconds as you wish by simply changing the number.

I hope this helps!

  • May
  • 11
  • 2009

What is the php.ini file?

Posted by admin In PHP | No Comments »
What is the php.ini file?

A really great feature of PHP it the ability to modify its behavior by altering its configuration file (php.ini).

By having the php.ini file, PHP has made it easier to change how it responds and beh

aves even after it has already been installed. What a pain it would be to have to re-compile every time you realize the need for a configuration change.

The php.ini file really helps make PHP more powerful and more secure as well. This is because you can configure PHP with secure settings until the setting need to change for some reason. Then you can also programmatically alter its behavior to accommodate a particular script file’s needs, on the fly, and returning the settings to normal when you’re done.

Changeing the php ini file memory limit

When PHP is booting, one of the first things it does is look at the php.ini file. It reads into memory the directives defined with in it. In most cases, when you compile PHP, it puts a copy of the php.ini file in /usr/local/lib/php. This may different depending upon your server.

If you are on a Unix machine, you may be able to type locate php.ini or find / -name php.ini -print and have it tell you the location of the php.ini file. If you have installed it on a Windows machine, use the “Find -> Files or Folders” option from the Start Menu.

  • May
  • 07
  • 2009

How to Protect Against SQL Injection

Posted by admin In AJAX, How To, MySQL, PHP, Web Security | No Comments »
How to Protect Against SQL Injection

One of the most common web security problems is SQL Injection. As the name implies, SQL injections works by introducing malicious SQL code where it doesn’t belong. Since it is SQL code you could probably guess that the attacker “injects” his poison via database queries. Web developers often pass some sort of variable to their database queries. Very common are variables that are influenced by user input. User input, to variable, then to query,- get it? So, there is a need for a way of eliminating the user’s ability to manipulate the variable in any way that could effect the query.

What Happens With SQL Injection

By passing an unexpected string of code into a user input, such a form, an attacker send damaging code that causes an otherwise good query to go haywire. For example:

  • May
  • 07
  • 2009

PHP Error Reporting and Security

Posted by admin In PHP, Web Security | No Comments »

Error reporting in PHP gives valuable insight during the development stages. This Insight can be a great aid to problem solving. There are others, however who are interested in why your web site has failed on occasion. The information thrown out by many PHP errors gives the kind of information about your web application that can make you vulnerable to crackers (malicious web site breakers). In fact apart from reading the code itself, error reporting is some of the most valuable intelligence an attacker can gather when looking for vulnerabilities in your web application.

So, what should be done once you launch your new web site? Well, as proud as you may be of your new creative geniuses, a wise web developer has the humility to recognize that bugs are still likely to surface from time to time. While you do not want any attackers to see error

  • May
  • 06
  • 2009

PHP Execution Time Limit Setting

Posted by admin In PHP, User Iterface Design | No Comments »

Recently I had a little problem stump me while designing the back end of a commercial site. The back end user interface uploads rather large image files so that the files can be processed for ‘Zoomify’( a fast way of showing a highly detailed zoomable image). After making sure the process was secure, I also needed to change a few settings in the PHP ini file in order for the system to allow files sizes of over 2 megs. All was working great on the local testing server.

Flickr Stream