Creating accounts in a cpanel/whm account I am trying to make this code that creates accounts in a cpanel/whm account more secure.

Could someone please let me know what needs to be done to make this more secure?

&lt;?php
///////  YOUR WHM LOGIN DATA
$whm_user   = "username";      // reseller username
$whm_pass   = "password";  // the password you use to login to WHM

#####################################################################################
##############          END OF SETTINGS. DO NOT EDIT BELOW    #######################
#####################################################################################

$whm_host   = $_SERVER['HTTP_HOST'];

function getVar($name, $def = '') {
  if (isset($_REQUEST[$name]))
    return $_REQUEST[$name];
  else
    return $def;
}

// Domain name of new hosting account
// To create subdomain just pass full subdomain name
// Example: newuser.zubrag.com
if (!isset($user_domain)) {
  $user_domain = getVar('domain');
}

// Username of the new hosting account
if (!isset($user_name)) {
  $user_name = getVar('user');
}

// Password for the new hosting account
if (!isset($user_pass)) {
  $user_pass = getVar('password');
}

// New hosting account Package
if (!isset($user_plan)) {
  $user_plan = getVar('package');
}

// Contact email
if (!isset($user_email)) {
  $user_email = getVar('email');
}

// if parameters passed then create account
if (!empty($user_name)) {

  // create account on the cPanel server
  $script = "http://{$whm_user}:{$whm_pass}@{$whm_host}:2086/scripts/wwwacct";
  $params = "?plan={$user_plan}&amp;domain={$user_domain}&amp;username={$user_name}&amp;password={$user_pass}&amp;contactemail={$user_email}";
  $result = file_get_contents($script.$params);
}
// otherwise show input form
else {
$frm = &lt;&lt;&lt;EOD
EOD;
echo $frm;
}

?&gt;


EDIT:

This works:

$whm_host   = $_SERVER['SERVER_NAME'];



function getVar($name, $def = '', $sg_method = 'POST') {
  switch($sg_method){
      case 'POST'   : return isset($_POST[$name])   ? $_POST[$name]   : $def;
        break;
      case 'GET'    : return isset($_GET[$name])    ? $_GET[$name]    : $def;
        break;
      case 'COOKIE' : return isset($_COOKIE[$name]) ? $_COOKIE[$name] : $def;
        break;
      default : return $def;
  }
}

// Domain name of new hosting account
// To create subdomain just pass full subdomain name
// Example: newuser.zubrag.com
if (!isset($user_domain)) {
  $user_domain = getVar('domain');
}

// Username of the new hosting account
if (!isset($user_name)) {
  $user_name = getVar('user');
}

// Password for the new hosting account
if (!isset($user_pass)) {
  $user_pass = getVar('password');
}

// New hosting account Package
if (!isset($user_plan)) {
  $user_plan = getVar('package');
}

// Contact email
if (!isset($user_email)) {
  $user_email = getVar('email');
}

// if parameters passed then create account
if (!empty($user_name)) {

  // create account on the cPanel server
  $script = "http://{$whm_user}:{$whm_pass}@{$whm_host}:2086/scripts/wwwacct";
  $params = "?plan={$user_plan}&amp;domain={$user_domain}&amp;username={$user_name}&amp;password={$user_pass}&amp;contactemail={$user_email}";
  $result = file_get_contents($script.$params);
}
// otherwise show input form
else {
$frm = &lt;&lt;&lt;EOD
EOD;
echo $frm;
}
Let's start with the easy fish - $_REQUEST. Going by the PHP manual, $_REQUEST is a combination of $_POST, $_GET, and $_COOKIE. 

In your getVar(...) function, you reference the request superglobal, and in the following lines, you use it to get a password. Using the request superglobal would allow a password to be given in via insecure methods like GET and COOKIE. Ideally, you want to POST any sensitive data like a password, so let's modify the code to just grab from POST by default, and let's add a third parameter in case we need to get certain values from GET or COOKIE. 

function getVar($name, $def = '', $sg_method = 'POST') {
  switch($sg_method){
      case 'POST'   : return isset($_POST[$name])   ? $_POST[$name]   : $def;
        break;
      case 'GET'    : return isset($_GET[$name])    ? $_GET[$name]    : $def;
        break;
      case 'COOKIE' : return isset($_COOKIE[$name]) ? $_COOKIE[$name] : $def;
        break;
      default : return $def;
  }
}


One glaring security issue is the following line:

$whm_host = $_SERVER['HTTP_HOST'];


You have to remember that HTTP_HOST is gotten from a user-defined header. Unless a business requirement dictates it, you should use SERVER_NAME. See HTTP_HOST vs. SERVER_NAME on Stack Overflow for a better explanation - specifically this answer by BalusC. 

Now, we can compress the multiple IF statements into a simpler foreach, as follows:

$user_data = array(
    "domain"   =&gt; array($user_domain, 'user_domain'),
    "user"     =&gt; array($user_name,   'user_name'),
    "password" =&gt; array($user_pass,   'user_pass'),
    "package"  =&gt; array($user_plan,   'user_plan'),
    "email"    =&gt; array($user_email,  'user_email')
);

foreach($user_data as $key =&gt; $val){
    if(empty($val[0])){
        $$val[1] = getVar($key);
    }
}


Below is how I've modified your code:

# Your WHM login data
$whm_user   = "username";  # reseller username
$whm_pass   = "password";  # the password you use to login to WHM

#####################################################################################
##############          END OF SETTINGS. DO NOT EDIT BELOW    #######################
#####################################################################################

$whm_host   = $_SERVER['HTTP_HOST'];

function getVar($name, $def = '', $sg_method = 'POST') {
  switch($sg_method){
      case 'POST' : return isset($_POST[$name]) ? $_POST[$name] : $def;
        break;
      case 'GET' : return isset($_GET[$name]) ? $_GET[$name] : $def;
        break;
      case 'COOKIE' : return isset($_COOKIE[$name]) ? $_COOKIE[$name] : $def;
  }
}

# Domain name of new hosting account
# To create subdomain just pass full subdomain name
# Example: newuser.zubrag.com
$user_data = array(
    "domain"   =&gt; array($user_domain, 'user_domain'),
    "user"     =&gt; array($user_name,   'user_name'),
    "password" =&gt; array($user_pass,   'user_pass'),
    "package"  =&gt; array($user_plan,   'user_plan'),
    "email"    =&gt; array($user_email,  'user_email')
);

foreach($user_data as $key =&gt; $val){
    if(empty($val[0])){
        $$val[1] = getVar($key);
    }
}

# if parameters passed then create account
if (!empty($user_name)) {
  # create account on the cPanel server
  $script = "http:#{$whm_user}:{$whm_pass}@{$whm_host}:2086/scripts/wwwacct";
  $params = "?plan={$user_plan}&amp;domain={$user_domain}&amp;username={$user_name}&amp;password={$user_pass}&amp;contactemail={$user_email}";
  $result = file_get_contents($script.$params);
} else {
    $frm = &lt;&lt;&lt;EOD
EOD;
    echo $frm;
}