Craig Francis

Security, Accessibility, Performance... trying to make the world better. @[email protected]

[Craig Francis @craigfrancis]

How we can End Injection Vulnerabilities https://t.co/0Rt0HaEwye

#Security #programming

[PHP UK Conference @PHPUKConference]

Are you safe from injection vulnerabilities?

Even using abstraction layers like Doctrine or parameterised queries mistakes can still happen.

@craigfrancis shows us how mistakes can be made and what can be done to mitigate them.

Buy your ticket here: https://t.co/U8UtZNliy3

#phpuk #phpuk25 #php #phpc

[PHP UK Conference @PHPUKConference]

Speaker Announcement 🚨

Want to uncover how to spot and prevent SQL injection mistakes—even in complex codebases?

Join Craig Francis' (@craigfrancis) talk, "Ending Injection Vulnerabilities," at the PHP UK Conference 2025! 🐘

Buy a ticket now 🎟️ https://t.co/b3hpZO89ik

#phpuk25 #phpuk #php #phpc #securecoding

[Craig Francis @craigfrancis]

MDN HTTP Observatory was updated yesterday, check your sites; it looks like the new top score is 145 :-)

https://t.co/Q6C1mYr1Nr

[Craig Francis @craigfrancis]

@Maxim1llion Happy Birthday!

Hope you’re well, and feeling bit better than the image implies :-)

(sorry I’ve been off Twitter for a while, my feed got a bit messy after the idiot took charge).

[Craig Francis @craigfrancis]

@EmmaLovelace I’m not saying it can’t be used, but it won’t work for all transport, as an electric cable over the main routes is just more efficient (maybe bio diesel can be used to generate the electricity for the less used tracks?)

[Craig Francis @craigfrancis]

Even if you ignore the environment, fossil fuels will get too expensive to extract from the ground.

But, there isn’t enough lithium for everyone… so, trains?

[Craig Francis @craigfrancis]

@PerttiSoomann @brendt_gd Considering I don’t know what framework you’re using, how do you setup the form?

[Craig Francis @craigfrancis]

@ChrisArter How about:

if ($user->can(‘block-public-access’) {
exit(‘Permission denied’);
}

For that lovely double negative experience (I’m looking at you Amazon S3).

[Craig Francis @craigfrancis]

@PerttiSoomann @brendt_gd How do you know they are part of the original form?

(I’ve seen a few, erm, less than ideal ways; e.g. simple form builders, that only created basic HTML; or developers just writing the HTML directly, because it gave them “full control”; and they just passed $_POST to the model).

[Craig Francis @craigfrancis]

@PerttiSoomann @brendt_gd Field existence, as defined in the View?

i.e. the View creates HTML, shown in browser (where the user could modify, like adding input fields), and you simply check which fields exist in the POST data?

(you could use a hidden input to list which fields, and sign it).

[Craig Francis @craigfrancis]

@PerttiSoomann @brendt_gd Yeah, I always find this stuff interesting, as validation on the model side can get difficult (e.g. some users can set the “approved” field in some context, which may also be based on their permission to access some records).

[Craig Francis @craigfrancis]

@brendt_gd Ok, will be interesting to see how that works… and how you get developers to query the database.

[Craig Francis @craigfrancis]

Korok School Bus!
#Zelda #TearsoftheKindom

[Craig Francis @craigfrancis]

@davidfowl *fine, as in safe from injection vulnerabilities… with the exception that a developer could intentionally go out of their way to create a vulnerability, by creating an array of developer defined characters, then dynamically concatenating them together based on user input.

[Craig Francis @craigfrancis]

@davidfowl Ideally they should work - it depends on the language, but dynamically concatenating developer defined strings is fine*

If that’s not possible then you will need a basic query builder, so it can validate on input, concatenate, then pass on to the DB, Browser (HTML), CLI, etc.

[Craig Francis @craigfrancis]

@davidfowl I would prefer the type system itself, as I would assume that would work for everyone… but just to check, you’re suggesting a custom attribute could be used to flag, and then an analyser would need to be developed to check if (i.e. not currently available, but could be done).