PHP apps: Security's Low-Hanging Fruit

PHP apps: Security's Low-Hanging Fruit
Kelly Martin, 2007-01-08

PHP has become the most popular application language on the web, but common security mistakes by developers are giving PHP a bad name. Here's how PHP coding errors have become the new low-hanging fruit for attackers, contributing to the phishing problems on the web.

Expand all | Post comment

PHP apps: Security's Low-Hanging Fruit 2007-01-09
ninjah (1 replies)

Re: PHP apps: Security's Low-Hanging Fruit 2007-01-11
rdivilbiss

PHP apps: Security's Low-Hanging Fruit 2007-01-09
Anonymous

PHP apps: Security's Low-Hanging Fruit 2007-01-09
Anonymous (2 replies)

Re: PHP apps: Security's Low-Hanging Fruit 2007-01-10
Anonymous

Re: PHP apps: Security's Low-Hanging Fruit 2007-01-11
Josef Meixner

Don't forget basic file system security 2007-01-09
Void (1 replies)

Also please don't overlook basic file system security. This one is a bigger crime than coding in an unintentional vulnerability in my opinion. I just have to shake my head when I see these defacements happen that wouldn't have happened if they just applied basic/proper file system security. I have seen tutorials that tell the user to change the ownership of their web directory structure to the same user the web server runs under. Duh!! Someone deface my web site, PLEASE! Even if a PHP script is exploited if the exploiter doesn't have permission to drop his files the site won't be defaced in most instances. Also, don't forget to think about the security on the underlying database. Does the script user really need to be granted INSERT,UPDATE,DELETE?

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/427/34248#34248

Re: Don't forget basic file system security 2007-11-03
Catalin Hulea

PHP apps: Security's Low-Hanging Fruit 2007-01-10
andyT

PHP apps: Security's Low-Hanging Fruit 2007-01-11
Anonymous (2 replies)

Re: PHP apps: Security's Low-Hanging Fruit 2007-01-11
Anonymous

Re: PHP apps: Security's Low-Hanging Fruit 2007-11-03
Catalin Hulea

PHP apps: Security's Low-Hanging Fruit 2007-01-11
Anonymous

PHP apps: Security's Low-Hanging Fruit 2007-01-12
Kevin Waterson

Don't blame PHP, it's the newbies 2007-11-03
Catalin Hulea

PHP apps: Security's Low-Hanging Fruit 2008-02-12
Anonymous