• Never insert untrusted user data except in some allowable locations.
• Use HTML Escape before inserting untrusted data into HTML element content.
• Use Attribute escape before inserting untrusted data into HTML common attributes.
• Use JavaScript escape before inserting untrusted data into JavaScript data values.
• Use HTML escape to read JSON values in an HTML context and read the data with JSON.parse.
• Use CSS escape and strictly validate data before inserting the untrusted data into HTML style property values.
• Use URL escape before inserting untrusted data into HTML URL parameter values.
• Sanitize HTML markup with a proper library.
• Use the HTTPOnly cookie flag.
• Implement a content security policy.

What is the dynamic code evaluation attack?

The dynamic code evaluation attack is an attack in which all or part of the input string of the eval() function in PHP gets maliciously controlled by the attacker.

Example: For example, let’s consider the following piece of code :

<?php
$name = 'Adam';
$string = $_GET['arg'];
eval("\$name = \"$string\";");
?>

Here, $string is an input taken from a user, and then, the value is assigned to $name. But, suppose an attacker gives as input ‘noname; system(“ls”)’.

Then, $string will be assigned ‘noname; system(“ls”)’, and inside the eval() function, ‘ls’ will get called. As a result, it will reveal the list of files in the directory to the attacker. The attacker may even update, delete, or see sensitive files in the server using this vulnerability. And, this is how the dynamic code evaluation attack is perpetrated.

Interested readers may find more information about this attack in the following article: What is the dynamic code evaluation attack?

How to prevent dynamic code evaluation attacks?

We can avoid the usage of eval() as far as possible. The usage of eval() is actually normally discouraged. The web application developers should try implementing the functionality with some other function.

But, if you think you must use eval(), then make sure user-provided inputs are not directly used as input for the eval() function. Instead, we should process the input string, discard suspicious characters carefully, and then use it.

What is the file inclusion attack?

In the file inclusion attack, an attacker tricks a web server into executing certain scripts. As a result, the server is tricked into revealing sensitive files from the server to the attacker. The attacker may even inject a malicious file remotely into the server with the purpose of performing more attacks.

Example:

Let’s consider this piece of code :

<?php
if ( isset( $GET['EYES'] ) ) {
include( $_GET['EYES'] . '.php' );
}
?><form method="get">
<select name="EYES">
<option value="black">Black</option>
<option value="blue">Blue</option>
</select>
<input type="submit">
</form>

Here, if the attacker executes /eyes.php?EYES=/etc/passwd that will allow the attacker to read the content of file /etc/passwd from the web server. This may lead to theft of sensitive data or even more …