Pro PHP Security: From Application Security Principles to the Implementation of XSS Defenses, Second Edition

C H A P T E R  5

Preventing Remote Execution

We continue our discussion of safe PHP programming with an examination of remote execution attacks, which involve misusing the internal logic of your application in order to execute arbitrary commands or scripts on the server. Cross-site scripting (discussed in Chapter 4) is similarly accomplished by inserting scripts containing malicious code; in that case, however, the code execution takes place in the client browser and doesn't actually affect any systems. Remote execution, on the other hand, takes place in your protected environment on the server, a very serious problem indeed.

While many of the ...