Link Details

Link 271101 thumbnail
User 225256 avatar

By mswatcher
via blog.tuvinh.com
Published: Oct 28 2009 / 04:12

PHP is a terrific language for the rapid development of dynamic Websites. It also has many features that are friendly to beginning programmers, such as the fact that it doesn’t require variable declarations. However, many of these features can lead a programmer inadvertently to allow security holes to creep into a Web application. The popular security mailing lists teem with notes of flaws identified in PHP applications, but PHP can be as secure as any other language once you understand the basic types of flaws PHP applications tend to exhibit.
  • 12
  • 7
  • 1595
  • 745

Comments

Add your comment
User 275943 avatar

OIS replied ago:

1 votes Vote down Vote up Reply

Unvalidated Input Errors - try the filter functions built into php, there is also the ctype functions.
Access Control Flaws - you should not have an .htaccess / index.php file in every directory, because you should only have one webroot folder with public php files and subfolders for static files you want the browser to have access to. Keep function/class/log/temp files outside the webroot folder.
Session ID Protection - at least use (long and better random) salts with the hash, but prefearably dont store password in session at all.
SQL Injection Vulnerabilities - use something like mysqli or PDO with prepared statements and stored procedures.

User 218789 avatar

eelmore replied ago:

0 votes Vote down Vote up Reply

Language security != Implementor security

User 314131 avatar

StephenCronin replied ago:

0 votes Vote down Vote up Reply

The original article is on Sitepoint: http://articles.sitepoint.com/article/php-security-blunders/1
It sucks when someone just copies another article word for word.

User 212808 avatar

Pedro Santos replied ago:

0 votes Vote down Vote up Reply

Voted down because of copied content.

Add your comment


Html tags not supported. Reply is editable for 5 minutes. Use [code lang="java|ruby|sql|css|xml"][/code] to post code snippets.