/PHP-AIO-Security-Class

The objective of this class is offer an automatic system of protection for developers's projects and simplify some security operations as the check of CSRF or XSS all in a simple class. Infact you could just call the main method to have better security yet without too much complicated operations.

Primary LanguagePHP

PHP AIO Security Class

Version 0.2.1

IF YOU USE ON YOUR PROJECT SOME OF THESE METHODS PLEASE TO CREDIT ME :) THANK YOU!

This is a security class in php with some userful and automatic static methods.

The objective of this class is offer an automatic system of protection for developers's projects and simplify some security operations as the check of CSRF or XSS all in a simple class. Infact you could just call the main method to have better security yet without too much complicated operations.

Instructions

1-0 - Move .htaccess on your ROOT directory

1-1 - Move the class on directory and config the class if you need it.

These are the options:

// Config
$basedir = __DIR__; // Project basedir where is located .htaccess
$session_name = "XSESSID";
$session_lifetime = 288000; // 8 hours
$session_regenerate_id = false;
$csrf_session = "_CSRFTOKEN";
$csrf_formtoken = "_FORMTOKEN";
$hijacking_salt = "_SALT";
$headers_cache_days = 30; // Cache on NO HTML response (set 0 to disable)
$escape_string = true; // If you use PDO I recommend to set this to false
$scanner_path = "./*.php"; // Folder to scan at start and optionally the file extension
$scanner_whitelist = array('./shell.php','./libs'); // Example of scan whitelist
// Autostart
$auto_session_manager = true; // Run session at start
$auto_scanner = false; // Could have a bad performance impact (anyway you can try)
$auto_block_tor = true; // If you want block TOR clients
$auto_clean_global = false; // Global clean at start

PS: You can always change the configuration as following for each parameters or simply editing the var if you need only static var:

Security::$session_name = "MYSESSID"

1-2 - Include the class

include 'classes/security.class.php';

2 - Just create a new object to be more at safe (the constructor/putInSafety filter $_REQUEST and $_GET globals, add some userfull headers for security, check if there is an Hijacking and check the URL Request)

$isAPI = false; // default is FALSE (this remove some check that could block API request)
$security = new Security($isAPI);

or just call

$isAPI = false; // default is FALSE
Security::putInSafety($isAPI);

NOTES:

1 You can also call only the methods that you need instead this method

2 Constructor and putInSafety are the same thing

3 These methods call session_start then don't use it before/after

4 global $_POST is not filtered. If you want it I could add this if someone will request this feature. Anyway if you want filter it write $_POST = Security::clean($_POST);

3 - Prevent XSS/SQL Injection on your variables with:

$is_html = true;        // deafult is TRUE
$have_quotes = true;    // deafult is TRUE
$escape_string = true;  // deafult is TRUE except if you set FALSE in class config
$var = Security::clean($_POST['var'], $is_html, $have_quotes, $escape_string);
echo $var;

or

Security::cleanGlobals();

PS: THIS COULD COMPROMISE DATA IF YOU SEND HTML WITH INLINE JAVASCRIPT

send with htmlentities could be a solution if you want inline js and clean globals at the same time

4 - Use output method to filter your output (it also check for CSRF)

ob_start()
    
// ... Your code ...
    
$output = Security::output(ob_get_clean());
echo = $output;

Enjoy!

Methods available:

Generic Methods

Method Params Return Description
__construct / putInSafety $isAPI = false Void Call some methods:

headers $isAPI
secureSession $isAPI
secureFormRequest $isAPI
secureBots
secureRequest
secureBlockTor
secureHijacking
secureCookies
secureCSRF - Void Check for CSRF
secureCSRFToken - String Get CSRF Token
secureRequest - Void Enable the WAF (Firewall) then check the request method and the URL to prevent some XSS/SQL Injections and bad requests
secureFormRequest $isAPI = false Void Check if the form origin come from the same website
secureSession - Void Set custom session name for prevent fast identification of php and add some secure param to session cookie. PS: This method call session_start
headers $isAPI = false Void Set some secure headers (to prevent some XSS, Clickjacking and others bad requests) and secure php setting
headersCache Void Set cache headers
secureCookies - Void Set some secure paramenter on cookies (autoencryption soon...)
secureDOS - Void Block clients that do too much requests (after 10 requests within 1.5 seconds consecutive detect a DOS attemp, the first 4 times the client must wait 10 seconds after that its ip will be banned from the server)
secureBlockBots - Void Block some generic bad bots/crawler/spiders
secureBlockTor - Void Block TOR clients
secureHijacking - Void Prevent Hijacking and delete session

Cleaning Methods

Method Params Return Description
clean $data, $html = true, $quotes = true Mixed Clean value form XSS, SQL Injection etc… recursively
cleanGlobals - Void Clean all input global vars ($_REQUEST,$_POST,$_GET,$_COOKIE)
THIS COULD COMPROMISE DATA IF YOU SEND HTML WITH INLINE JAVASCRIPT
cleanXSS $data Mixed Clean value from XSS recursively
stringEscape $data Mixed Clean from SQL Injection (similar at mysql_real_escape) recursively
stripTags $data Mixed Strip tags recursively
stripTagsContent $data, $tags = '', $invert = false Mixed Strip tags and contents recursively
trim $data Mixed Trim recursively
stripslashes $data Mixed Strip slashes recursively

Output Methods

Method Params Return Description
output $buffer String Put in safety HTML if is HTML, compress HTML if is HTML, check for CSRF and add cache headers if isn't HTML (usually used with ob_start)
secureHTML $buffer String Put in safety some html elements on output buffer and add automatically the CSRF token
compressHTML $html String Compression of HTML
compressJS $js String Compression of JS
compressCSS $css String Compression of CSS

Utility Methods

Method Params Return Description
crypt (encrypt|decrypt), $string String Encrypt and decrypt strings
getCookie $name String Get decrypted cookie
setCookie $name, $value, $expires = 2592000, $path = "/", $domain = null, $secure = false, $httponly = true Boolean Set encrypted cookie
unsetCookie $name String Unset a cookie
clientIP - String Get real client IP address
clientIsTor - Boolean Check if client use TOR
secureDownload $filename Void Secure headers for download request
secureUpload $file, $path Boolean File upload with scan
secureScan $path Void Scan files in directory recursively and rename bad files if detected
secureScanFile $filepath Boolean Scan file (detect for shell or php code infected)
secureScanPath $path Array Scan files in directory recursively (detect for shell or php code infected)