|
|
BugTraq
Re: Re: PHP security (or the lack thereof) Jun 21 2006 11:52PM nabiy hotmail com (2 replies) Re: PHP security (or the lack thereof) Jun 24 2006 05:07AM Ronald Chmara (ron Opus1 COM) (1 replies) RE: PHP security (or the lack thereof) Jun 26 2006 04:06PM Geo. (geoincidents nls net) (3 replies) Re: PHP security (or the lack thereof) Jun 26 2006 05:45PM Paul Schmehl (pauls utdallas edu) (1 replies) Re: PHP security (or the lack thereof) Jun 26 2006 05:32PM Matthias Kestenholz (lists spinlock ch) (1 replies) RE: PHP security (or the lack thereof) Jun 27 2006 11:41AM Geo. (geoincidents nls net) (1 replies) Securing PHP or finding PHP alternatives (was: PHP security (orthe lack thereof)) Jul 08 2006 02:48AM Gezim Hoxha (gezimetc shaw ca) (4 replies) Re: Securing PHP or finding PHP alternatives Jul 11 2006 06:21AM Michael Shigorin (mike osdn org ua) Re: Securing PHP or finding PHP alternatives (was: PHP security (or the lack thereof)) Jul 10 2006 08:37PM Meet Myself on the Internet (me arteabstracta net) Re: Securing PHP or finding PHP alternatives Jul 10 2006 05:37PM Crispin Cowan (crispin novell com) (2 replies) Re: Securing PHP or finding PHP alternatives Jul 11 2006 02:50PM Sheryl Coppenger (gubydala his com) (2 replies) Re: Securing PHP or finding PHP alternatives Jul 18 2006 09:35PM Michael Cordover (michael cordover gmail com) Re: Securing PHP or finding PHP alternatives Jul 11 2006 07:54AM SkyFlash (webmaster hackquest de) (1 replies) Re: PHP security (or the lack thereof) Jun 23 2006 08:16PM Crispin Cowan (crispin novell com) (3 replies) Re: PHP security (or the lack thereof) Jun 24 2006 12:43PM Glynn Clements (glynn gclements plus com) Re: PHP security (or the lack thereof) Jun 24 2006 08:28AM Daniel Hulme (bugtraq doublezero uklinux net) |
|
Privacy Statement |
> 1.) If I have to write PHP, how do I write secure PHP? Give me a number
> of ensures that I can follow and check-mark each and live a happy
> life--for the most part.
1. Read the whole PHP security chapter http://www.php.net/manual/en/security.php
2. Read about XSS, CSRF, SQL injections, session hijacking etc.
3. Always initialize your variables
4. Always escape anything going into an SQL query (if you don't use
prepared statements)
5. Do not use shell commands. Be very careful if you need to anyway
6. Never assume anything about input coming from the user.
7. Do not display data coming from the user before you are 100% sure
that the data is cleaned from XSS etc.
8. http://phpsecurity.org/ (perhaps)
9. Do not give in to living a happy life :-) Stay cautious
10. This list is incomplete.
> 2.) From a security standpoint what is a better, open-source replacement
> to PHP?
It's "good enough" for me. Nothing else has the same amount of
installations (which is a problem and a bonus at the same time)
[ reply ]