Hands on PHP secure programming

	See also...  Organization of the courses  Training sessions planning  E-learning PHP secure programming
Goals  Duration  Instructor(s)  Pre-requisite for attendants  Teaching method  Related courses  Material  Agenda  Methods of inscription

Dates of the coming sessions: 7-9 April 2010 (Paris) 3-5 November 2010 (Paris) Dates subject to modification without prior notice. The sessions will only take place if the number of registered attendants is high enough.

PHP Web application are easy and fast to develop. Numerous PHP applications exposed on the internet are vulnerable to common vulnerabilities like SQL injections. This course is one way to increase the security level of your Web application.The content of this course is based on the feedback of all PHP code audit HSC performed. A laptop and a virtual machine containing Web applications will be given to each attendant. The attendant's main goal is to fix the vulnerabilities located in the installed Web applications.
Each type of vulnerability is described in 4 steps:

• overview
• exploitation risks exposure
• secure implementations description
• exercices in order to check that attendants really understand how to fix the vulnerability

The aim of this course is to expose most well-known web application vulnerabilities so the attendant will be able to implement secure PHP code.

3 days.

This training is given by:

• Nicolas Collignon

The target audience for this course is PHP developers, PHP projects leaders and IT security consultants focused on Web applications security.
Attendants must be familiar with PHP programming and databases interactions (basic SQL level).

Web Servers and applications Security

The course is delivered in french only. Course material include slides and exercices in French.

Rappels

• HTTP Protocol
• Client/Server model
• Cookies and users sessions
• HTTPS Protocol

• Code organisation
• Files naming issues

• User profiles management
• User passwords management
• Implementing access controls

• Introduction
• SQL injections
• Implementing secure database accesses without "SQL prepared statements"
• Implementing secure database accesses with "SQL prepared statements"
• Minimizing risks

• Files handling
• Uploads handling
• External programs execution
• Dynamic code execution
• safe_mode

• Introduction
• Attacks sample cases
• Implementing XSS-free code
• CSRF

For registering an HSC course, please contact our training department by phone : +33 141 409 704 or by email at formations@hsc.fr, with first and last name of every student, your postal address and your company VAT number. Thoses informations enable us to send your the training agreement. The training agreement must be return agreed with signature and company stamp with you purchase order, at least 6 days before the course. The purchase order should precise your billing address and our payment regulations : net 30 days from our invoice date. Registration is completed as soon as we received those two documents.