Lab - PHP with HTML Forms

1. Set up a form and a PHP page to process it using HTTP GET.
2. PHP echos back the argument.

Hacking attack: Overwrite PHP vars

1. Use the unsafe parse_str method and see how to set any variable.

Hacking attack: Inject CSS

1. Use the safe parse_str method, but simple echo back of the argument.
2. See the security problem with injecting CSS. Get an injection that catastrophically changes the style of the page.
3. Fix the injection problem

Get PHP to output image (no HTML).

1. What happens if you omit the Content-Type: line?
2. What happens if you output a blank line before the PHP starts? Strange isn't it? See HTTP response format.

1. Get the random image program working for 4 images.
2. Consult the PHP manual to see how to get 4 random numbers.