1 You can determine if you can seek an arbitrary stream in PHP with the ___________ function
2 To ensure that a given object has a particular set of methods, you must provide a method list in the form of an ________ and then attach it as part of your class using the ________ keyword.
Answer...
array, interface
interface, implements
interface, extends
instance, implements
access-list, instance
3 When executing system commands from PHP, what should one do to keep applications secure?
Answers: (choose 3)
Remove all quote characters from variables used in a shell execution
Avoid using shell commands when PHP equivlents are available
Hard code all shell commands
Escape all shell arguments
Escape all shell commands executed
4 When attempting to prevent a cross-site scripting attack, which of the following is most important?
Answer...
Not writing Javascript on the fly using PHP
Filtering Output used in form data
Filtering Output used in database transactions
Writing careful Javascript
Filtering all input
Please answer through the comments I will make it publish on blog..............
1 :
ReplyDeletestream_get_meta_data()
2 :
interface, implements
3 :
Hard code all shell commands
Avoid using shell commands when PHP equivlents are available
still looking for the 3d solution
4 :
Filtering all input
good luck
cheers
Stéphane
www.vediovis.com
for question 3, i think:
ReplyDeleteHard code all shell commands
Escape all shell arguments
Escape all shell commands executed
Question 3 - this makes sense:
ReplyDeleteRemove all quote characters from variables used in a shell execution
Avoid using shell commands when PHP equivalents are available
Escape all shell arguments
3. I'm quite sure of:
ReplyDeleteEscape all shell arguments
Escape all shell commands executed
(see warning at http://us2.php.net/manual/en/function.system.php)
I'm not sure of 3rd answer as:
Avoid using shell commands when PHP equivlents are available
and:
Hard code all shell commands
are both valid in my opinion (from ZCE Study Guide: "When possible avoid the use of shell commands. If they are necessary, avoid the use of client input to construct dynamic shell commands")