Essential PHP Security: Errata

Errata

The following list pertains to errata in the first printing. In cases where errors exist in the code, they are corrected immediately in the code repository.

To report errors, please contact the author.

Page Errata

Error:
attracks
Correction:
attacks

Error:
http://elists.oreilly.com
Correction:
http://elists.oreilly.com/

URLs must contain the path to the resource. Although this goes against O'Reilly's style guide, technical precision is more important than style.

Error:
/usr/local/apache/logs/error_log
Correction:
/path/to/error_log

Both references to the error log on this page should emphasize the fact that this path is arbitrary.

Error:
search = $_GET['search'];
Correction:
$search = $_GET['search'];

Error:
while (strpos($_POST['filename'], '..')
Correction:
while (strpos($filename, '..')

Without inspecting $filename, this is an endless loop.

Error:
printf

The entry for printf can be removed from the bulleted list, because a search for print includes these cases.

Error:
    <option name="pen">pen</option>
    <option name="pencil">pencil</option>
Correction:
    <option value="pen">pen</option>
    <option value="pencil">pencil</option>

Error:
http://www.google.com
Correction:
http://www.google.com/

Error:
Red from the list and clicks Select
Correction:
Red from the list and clicks Select

The words "Red" and "Select" should be in a fixed-width font.

Error:
discoveries have revealed both weaknesses
Correction:
discoveries have revealed weaknesses

This sentence has been reworded improperly, and the word "both" is now misleading.

Error:
INTO user(last_name)
Correction:
INTO users(last_name)

This isn't an error, but it is inconsistent with the naming conventions I use elsewhere in the book.

In Figure 4-2, the "No" path from "PHPSESSID in query string?" is not labeled.

Error:
basename($_GET['filename'] ==
Correction:
basename($_GET['filename']) ==

Error:
/* $filename is within /path/to */.
Correction:
/* $filename is within /path/to. */

Error:
and the filename is treated as
Correction:
and the original filename is treated as

Error:
setcookie('auth', $cookie);
Correction:
setcookie('auth', $auth);

This is meant to be an example of what not to do, but not because of the typo.

Error:
"$path/$sess_name"
Correction:
"$path/sess_$sess_name"

Error:
ENT_QUOTES, 'UTF-8'));
Correction:
ENT_QUOTES, 'UTF-8');

This line of code (longest on this page) has an extra closing parenthesis.

Error:
get_magic_quotes_gpc
Correction:
magic_quotes_gpc

To report errors, please contact the author.