File and post data confusion in PHP
PHP has several superglobal variables which contain values from the request or the environment. These differ in whether they contain trustworthy data or not:
Sjoerd Langkemper
Web application security
Latest posts
Changing the timing of light with passive infrared sensor
At our scouting clubhouse we have lights in the toilet that turn on automatically when you enter. However, they only stay on for 30 seconds, which means that you have to wave around your arms while you are peeing to turn on the lights. I couldn’t find affordable small lights with either better sensors or longer timeouts, so I tried to modify the lights we did have, to increase the time.
Vulnerabilities in zdir 3
Zdir is a webapp that lists files in a directory, with preview and download functionality. I found several vulnerabilities in it.
Links for 2025
Here are some links I thought were interesting from the past year.
Unicode and endianness
Computers can only store bits and bytes. If you want to store numbers or characters, you have to know how to convert these to bits.
CVE-2025-25200: this Koa ReDoS is not a serious vulnerability
CVE-2025-25200 describes a regex denial of service (ReDoS) in the Koa web framework. While classified as critical, its actual impact is minimal.
Resetting any user's password in Open Web Analytics with a single request
Open Web Analytics (OWA) is a web app that tracks website visitors. I discovered a simple way to reset any user’s password, by simply requesting a URL.
Encrypting identifiers in practice
Previously, I wrote about encrypting identifiers . The idea is that the database uses incrementing numbers as primary key to identify objects, but the application only exposes encrypted keys to the user. Since theorizing about it in that post I implemented it in a web application, which gave me some new insights in how this can be used in practice.
More links
Here are some links to interesting cybersecurity articles from 2024.
Avoid hotlinking images with Cross-Origin-Resource-Policy
An image on your site can be directly included in other sites. You end up with the costs of hosting and serving the image, while the other sites gain the benefits of showing your nice image on their page. With the response header Cross-Origin-Resource-Policy it is possible to inform the browser that images should only be usable by the same site or origin as the image, thus making hotlinking…