Laravel API Security: Triple-Check Request TYPES (example 'hack')

One potential security issue in your application may be comparing strings with loose comparison. Let me show the example.

Links mentioned in the video:

Support the channel by checking out my products:

Other places to follow:

[milosb]

This is ultra useful, thanks for pointing that out Povilas!

[the-code-reviewer]

For PHP/Laravel developers out there: You should always use strict comparisons and set strict types in your files and you should always know exactly what data types you have (if you don't, then cast your variables to what data type you need). If a variable is not 100% boolean, you should never write: if ($variable) or if (!$variable), but compare it to the boolean value that it can be: if (false !== $variable). If you don't understand why, you are not senior enough :) To use "if ($array['key'])" is a huge mistake, as you don't know the data type for sure so you need to cast it if you know what you are doing or compare it to strict values if you can.

[fcolecumberri]

Before thinking about if you use == or ===, USE Validations, you should always write validation rules on every request, never trust the user, there is a reason in laravel docs that's under the basics chapter.

[bboydarknesz]

I think query params will always be a string type, so those are No return.
But yeah, maybe it is a security issue if the logic is something like could bypass the check or can bypass the authorization stuff.

So always remember validation, and strict type :D

[ゲンスルー-gq]

How about reviewing the new features of the upcoming PHP8.4 as a video theme.

[the-code-reviewer]

PHP becomes stricter and stricted with each new version and that is wonderful, so don't write something just because it works in current PHP version. Most of the issues with Legacy Code is developers wrote code that worked, but very bad code, like: using not declared properties, comparing strings with integers/floats, summing strings with floats etc. Even empty function is abused by Laravel/PHP developers and that is a bad habbit. Instead of if (empty($variable)) you should compare it to the case you have: if (null === $variable) / if ([] === $variable) etc

[gustavosandoval]

Good morning sir, what level of JS is required to work with PHP ?

[mushtaqrahimvideos]

Please also make a video on secure endpoint specially parameters in url I know post method other than post

[ricko]

wow i didn't know that, thank you su much

[gtsmeg]

Hey please can you do a video about eager loading pivot tables ?

[mituts]

Always validate the request, never trust user input

$request->validate(["api_key" => "required|string"]);

if($request->api_key == "secret") return "working";
return "not working";

[AtiqSamtia]

They are also missing the FormRequest Validation for types as well and pull values from validated.

Getting raw data from request and blaming Laravel 😮

triple check is just a good bad habit to have, specially when dealing with user input data

[mushtaqrahimvideos]

Upload videos from a security point of view...

[maflones]

What is the effect on computational power spent with == instead of ===?
Hate to waste resources.