BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//LaraChat//Events//EN
CALSCALE:GREGORIAN
METHOD:PUBLISH
BEGIN:VEVENT
UID:01a1b1cc-9460-71fb-b34e-7414f9752b1f@www.larachat.co
DTSTAMP:20261107T175240Z
DTSTART:20220223T113000Z
DTEND:20220223T123000Z
SUMMARY:PHP Oxford meetup
DESCRIPTION:This month we are excited to be joined by Craig Francis to tell
  us about Ending Injection Vulnerabilities.\n\n"How we can bring an end to
  Injection Vulnerabilities\, by "distinguishing strings from a trusted dev
 eloper\, from strings that may be attacker controlled".\n\nPresented at OW
 ASP AppSec US 2021\, this time I'll focus on the PHP implementation via st
 atic analysis tools Psalm and PHPStan\, how it could work for everyone wit
 h `is_literal()`\, and tempt the presentation gods with a few demos\, incl
 uding examples on how simple mistakes using Database and HTML Templating l
 ibraries can lead to Injection Vulnerabilities. This approach allows libra
 ries to address these issues by checking the sensitive strings they receiv
 e (SQL/HTML/CLI/etc) do not contain user values. It will then be up to the
 se well-tested libraries to handle user values safely\; ideally via parame
 terised queries\, but they can also escape values correctly.\n\nDiscussion
  during the talk is welcome (e.g. the inevitable question about SQL contai
 ning user defined field names\, and parameterised IN(?\,?\,?))\; I'm also 
 happy to discuss on Twitter @craigfrancis\, and a quick overview is availa
 ble at https://eiv.dev/\n\nBio: I've been building websites over the last 
 20-something years\, with a focus on Security\, Accessibility\, and Perfor
 mance. At the moment I'm working on approaches to security that prevent de
 velopers from being able to make mistakes."\n\nInteresting in speaking?\n\
 nIf you'd like to present or even do a lightning talk (5-20 minutes) at a 
 future event\, please get in touch!\n\nRefreshments & sponsors\n\nIn the o
 lden days\, we'd have a physical meet-up where the venue and refreshments 
 (drinks and snacks) would be provided courtesy of our sponsors. Despite no
 t being able to take full advantage of their generosity\, we continue to t
 hank Invitial (https://www.invitial.com/) for their support\, and to Oxfor
 d Centre for Innovation (https://www.ocfi.co.uk/) for use of the venue.\n\
 nCode of Conduct\n\nPlease note that this meet-up is covered by our code o
 f conduct (https://github.com/phpoxford/code-of-conduct/blob/master/code-o
 f-conduct.md). We request that all attendees abide by the code of conduct 
 at all times. Thank you!\n\nhttps://www.larachat.co/meetings/php-oxford-me
 etup-63
URL:https://www.larachat.co/meetings/php-oxford-meetup-63
END:VEVENT
END:VCALENDAR