Bugtraq mailing list archives
Re: Securing PHP or finding PHP alternatives (was: PHP security (or the lack thereof))
From: Matthias Kestenholz <lists () spinlock ch>
Date: Mon, 10 Jul 2006 21:25:53 +0200
* Gezim Hoxha (gezimetc () shaw ca) wrote:
1.) If I have to write PHP, how do I write secure PHP? Give me a number of ensures that I can follow and check-mark each and live a happy life--for the most part.
1. Read the whole PHP security chapter http://www.php.net/manual/en/security.php 2. Read about XSS, CSRF, SQL injections, session hijacking etc. 3. Always initialize your variables 4. Always escape anything going into an SQL query (if you don't use prepared statements) 5. Do not use shell commands. Be very careful if you need to anyway 6. Never assume anything about input coming from the user. 7. Do not display data coming from the user before you are 100% sure that the data is cleaned from XSS etc. 8. http://phpsecurity.org/ (perhaps) 9. Do not give in to living a happy life :-) Stay cautious 10. This list is incomplete.
2.) From a security standpoint what is a better, open-source replacement to PHP?
It's "good enough" for me. Nothing else has the same amount of installations (which is a problem and a bonus at the same time)
Current thread:
- Securing PHP or finding PHP alternatives (was: PHP security (or the lack thereof)) Gezim Hoxha (Jul 10)
- Re: Securing PHP or finding PHP alternatives Crispin Cowan (Jul 10)
- Re: Securing PHP or finding PHP alternatives SkyFlash (Jul 15)
- Re: Securing PHP or finding PHP alternatives Crispin Cowan (Jul 18)
- Re: Securing PHP or finding PHP alternatives Sheryl Coppenger (Jul 15)
- Re: Securing PHP or finding PHP alternatives Crispin Cowan (Jul 22)
- Re: Securing PHP or finding PHP alternatives Michael Cordover (Jul 22)
- Re: Securing PHP or finding PHP alternatives SkyFlash (Jul 15)
- Re: Securing PHP or finding PHP alternatives Michael Shigorin (Jul 15)
- Re: Securing PHP or finding PHP alternatives (was: PHP security (or the lack thereof)) Matthias Kestenholz (Jul 15)
- Re: Securing PHP or finding PHP alternatives (was: PHP security (or the lack thereof)) Meet Myself on the Internet (Jul 15)
- Re: Securing PHP or finding PHP alternatives Crispin Cowan (Jul 10)