Php how to verify is string is certain function for security verification

Question

I an using the eval() function in an ajax file that will allow me to call functions from Javascript (similar to Securely calling PHP code from JavaScript);

I have around 20 functions that I want to be able to use. I do not want malicious code passed in. How can I verify that the string passed in is one of my functions, and nothing more?

Why not have your function in your php, and the javascript just pass in an a value that indicates which one of your functions should run? — Andrew
– Andrew, Commented Apr 2, 2017 at 19:49
@Andrew That is what I am talking about doing. I am wondering how to verify it is a function, incase a hacker gets access to that ajax file. I don't want people passing in strings and having them executed when it's not one of my functions. — Wyatt
– Wyatt, Commented Apr 2, 2017 at 19:51
It depends on the environment; if your site is a user controlled where everyone have to login; then you can let sessions and cookies do the validation for you. And you can also filter incoming strings using addslashes and htmlspecialchars functions to reduce the chance of malicious data passing through. — Prav
– Prav, Commented Apr 2, 2017 at 19:55

Hyder B. · Accepted Answer · 2017-04-02 20:18:46Z

2

You are overcomplicating things by using eval to achieve this. You can simply define your functions on the server-side and switch to the correct one using a simple switch case. This way you do not have to worry about security-related issues.

jQuery:

function callPhp(func, callback){
    $.ajax({
    type: 'GET',
    url: 'callPhp.php',
    data: {action:'register'},
    success: function (data) {
        data = JSON.parse(data);
        callback(data);
    }
});
}

PHP:

<?php

$action = $_GET['action'];

switch ($action) {
    case "register":
        register_user();
        break;
    case "login":
        login();
        break;

?>

If you really want to use eval, which I highly discourage you to use, you can simply implement a sort of whitelist of method names that should be executed on the server side.

<?php

$whiteListMethod = array('register', 'login', 'forgotPassword');
$action = $_GET['action'];

// Is the user supplied function present in my whitelist?

if(in_array($action,$whiteListMethod)){

  // You can call this method safely

}else{

  // Hack attempt detected

}

edited Apr 2, 2017 at 20:18

answered Apr 2, 2017 at 19:54

Hyder B.

12.6k5 gold badges58 silver badges61 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Wyatt Over a year ago

This would work, except for a problem. What if my functions each have their own set/number of parameters?

Hyder B. Over a year ago

If the arguments is different for each function, you can simply create a multi-dimensional array.

Prav · Accepted Answer · 2017-04-02 20:08:26Z

0

You can use the @Hyder B is method for that. personally I think that's the best option if you just want to call a function. Also if you're worried about someone getting access to your ajax files (other than viewing then through the browser's source reader); they can access the function file also so that something you'll need to improve on the server. You can however stop people from trying to load the functions file directly by adding this:

<?php
if (count(get_required_files()) <= 1) {
  header("location: ./index.php");
}
?>

That will redirect the user if the file is accessed directly.

answered Apr 2, 2017 at 20:08

Prav

2,9132 gold badges24 silver badges34 bronze badges

3 Comments

Nytrix Over a year ago

You should've edited @HyderB 's post for this addition, as it's not an alone standing answer.

Wyatt Over a year ago

What if the function's have different parameters?

Prav Over a year ago

I believe you can pass parameters through ajax as well. Have a look at the link below. stackoverflow.com/questions/18697034/…

Collectives™ on Stack Overflow

Php how to verify is string is certain function for security verification

2 Answers 2

2 Comments

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related