PHP Source Code Research Articles

VulEye: A Novel Graph Neural Network Vulnerability Detection Approach for PHP Application

Following advances in machine learning and deep learning processing, cyber security experts are committed to creating deep intelligent approaches for automatically detecting software vulnerabilities. Nowadays, many practices are for C and C++ programs, and methods rarely target PHP application. Moreover, many of these methods use LSTM (Long Short-Term Memory) but not GNN (Graph Neural Networks) to learn the token dependencies within the source code through different transformations. That may lose a lot of semantic information in terms of code representation. This article presents a novel Graph Neural Network vulnerability detection approach, VulEye, for PHP applications. VulEye can assist security researchers in finding vulnerabilities in PHP projects quickly. VulEye first constructs the PDG (Program Dependence Graph) of the PHP source code, slices PDG with sensitive functions contained in the source code into sub-graphs called SDG (Sub-Dependence Graph), and then makes SDG the model input to train with a Graph Neural Network model which contains three stack units with a GCN layer, Top-k pooling layer, and attention layer, and finally uses MLP (Multi-Layer Perceptron) and softmax as a classifier to predict if the SDG is vulnerable. We evaluated VulEye on the PHP vulnerability test suite in Software Assurance Reference Dataset. The experiment reports show that the best macro-average F1 score of the VulEye reached 99% in the binary classification task and 95% in the multi-classes classification task. VulEye achieved the best result compared with the existing open-source vulnerability detection implements and other state-of-art deep learning models. Moreover, VulEye can also locate the precise area of the flaw, since our SDG contains code slices closely related to vulnerabilities with a key triggering sensitive/sink function.

A Python-WSGI and PHP-Apache Web Server Performance Analysis by Search Page Generator (SPG)

The web servers (WSGI-Python) and (PHP-Apache) are in middleware tier architecture. Middleware architecture is between frontend tier and backend tier, otherwise it’s a connection between frontend tier and backend tier for three tier architecture. The ELearning systems are designed by two different dynamic web technologies. First is by Python-WSGI and the second is by Personal Home Page (PHP-Apache). The two websites were designed with different open source and cross platform web technologies programming language namely; Python and PHP in the same structure and weight will evaluate perform over two different operating systems (OSs): 1) Windows-16 and 2) Linux-Ubuntu 20.4. Both systems run over the same computer architecture (64bit) as a server side with a common backend MySQL web database for both of them. Nevertheless, the middleware for PHP is a cross Apache MySQL PHP Perl (XAMPP), but the middleware for Python is Pycharm and the web server gateway interface (WSGI). WSGI and Apache are both web servers and this paper will show which of them has a better response time (RT). On the one hand, the experimental results demonstrate that the Python-WSGI is even weightier in Mbyte than PHP-Apache, on the other hand Python is still faster and more accurate than PHP. The designed SPG is by handwriting codes: one time designed the SPG by PHP source code and the other time designed by Python source code. Both Python-WSGI and PHP-Apache results are targeted to compare by the least time in milliseconds and take in to account enhanced performance.

Cross-Site Scripting Guardian: A Static XSS Detector Based on Data Stream Input-Output Association Mining

The largest number of cybersecurity attacks is on web applications, in which Cross-Site Scripting (XSS) is the most popular way. The code audit is the main method to avoid the damage of XSS at the source code level. However, there are numerous limits implementing manual audits and rule-based audit tools. In the age of big data, it is a new research field to assist the manual auditing through machine learning. In this paper, we propose a new way to audit the XSS vulnerability in PHP source code snippets based on a PHP code parsing tool and the machine learning algorithm. We analyzed the operation sequence of source code and built a model to acquire the information that is most closely related to the XSS attack in the data stream. The method proposed can significantly improve the recall rate of vulnerability samples. Compared with related audit methods, our method has high reusability and excellent performance. Our classification model achieved an F1 score of 0.92, a recall rate of 0.98 (vulnerable sample), and an area under curve (AUC) of 0.97 on the test dataset.

Function Point Analysis FPA on A Team Planning Website Based on PHP and MYSQL

A function point analysis (FPA) has been carried out on a custom team planning website based on PHP and MYSQL. The FPA was done after the development was finished (retrospective) and a constructive cost model analysis (COCOMO) was carried out to asses source lines of code (SLOC). In the present study the function point analysis is based on entities of the relational database evaluated as internal logical files, and evaluation of PHP source code with dynamic SQL as either external input files or external inquiry files. The complexity for a custom team planning website was found to be 510 total adjusted function points (TAFP) (UAF=580 FP, TDI=23, VAF=0, 88, TAFP=510FP). The function point estimate was classified as an organic project in a COCOMO analysis, and it was concluded that the complexity corresponds to 27742 LOC (or 27, 4 KDSI). The estimate of 66-82 person-months project would correspond to a 4 crew team in 16-21 months. The estimate was compared to the actual source code count of 22300 LOC.

Cross Site Scripting: Removing Approaches in Web Application

By reviewing the literature pertaining to XSS vulnerability, it has been found that many investigations have directed their focus only on XSS vulnerability detection, but not many studies have concentrated on removing XSS vulnerability. While PHP is the most common web technologies to build web application, this literature paper describes the gap that still exists on removing XSS vulnerability in PHP web application. This paper explains the presented methods to remove XSS vulnerability and presents the tools that are used to remove vulnerability of XSS from the PHP source code. There is no specific solution that can efficiently mitigate XSS incursions. More research is required in the field of vulnerability elimination from the PHP web application source code before deployment.

Development of an E-Learning Web Portal: The Foss Approach.

With the vast development of various technologies, learning today is no longer confined to classrooms with lecture delivery as the only method of conveying knowledge, rather, an electronic means of learning has continued to evolve. Electronic learning (e-Learning), which facilitates education using communications networks, has made learning possible from anywhere at anytime using the Internet, wide area networks or local area networks. Notably, e-Learning applications which have now become central to the learning process may be developed using proprietary programming tools and the process of acquiring and using them to develop large software application is not only complex but require a huge sum of money. A viable alternative is to utilize the open source software platform that allows software engineers and institutions the right to reuse, study, distribute and localize to satisfy user’s requirements. This paper provides an overview of e-Learning and the open source domain as well as discusses how open source can be used to speedily realizes the development of an eLearning application in a web environment using an adaptive process. Specifically, the authors described their preliminary experiment of implementing an open source eLearning platform by adapting free PHP source code and MySQL database to suit an electronic class bulletin board.

TaxonGrab: Extracting Taxonomic Names From Text

Identification of organism names in biological texts is essential for the management of archival resources to facilitate comparative biological investigation. Because organism nomenclature conforms closely to prescribed rules, automated techniques may be useful for identifying organism names from existing documents, and may also support the completion of comprehensive indices of taxonomic names; such comprehensive lists are not yet available. Using a combination of contextual rules and a language lexicon, we have developed a set of simple computational techniques for extracting taxonomic names from biological text. Our proposed method consistently performs at greater than 96% Precision and 94% Recall, and at a much higher speed than manual extraction techniques. An implementation of the described method is available as a Web based tool written in PHP. Additionally, the PHP source code is available from SourceForge: http://sourceforge.net/projects/taxongrab, and the project website is http://research.amnh.org/informatics/taxlit/apps/.