mailing list archives
Re: Securing PHP or finding PHP alternatives (was: PHP security (or the lack thereof))
From: Matthias Kestenholz <lists () spinlock ch>
Date: Mon, 10 Jul 2006 21:25:53 +0200
* Gezim Hoxha (gezimetc () shaw ca) wrote:
1.) If I have to write PHP, how do I write secure PHP? Give me a number
of ensures that I can follow and check-mark each and live a happy
life--for the most part.
1. Read the whole PHP security chapter http://www.php.net/manual/en/security.php
2. Read about XSS, CSRF, SQL injections, session hijacking etc.
3. Always initialize your variables
4. Always escape anything going into an SQL query (if you don't use
5. Do not use shell commands. Be very careful if you need to anyway
6. Never assume anything about input coming from the user.
7. Do not display data coming from the user before you are 100% sure
that the data is cleaned from XSS etc.
8. http://phpsecurity.org/ (perhaps)
9. Do not give in to living a happy life :-) Stay cautious
10. This list is incomplete.
2.) From a security standpoint what is a better, open-source replacement
It's "good enough" for me. Nothing else has the same amount of
installations (which is a problem and a bonus at the same time)