Re: PHP Security

[Brian Reilly <reillyb () GEORGETOWN EDU>]

On 11/23/05, Tim Lane <tlane () scu edu au> wrote:
>  Hi,
>
>  just wondering if anyone is aware of recommended guides for PHP security,
> or good free PHP vulnerability scanners?

Tim,

I can recommend this book:

Pro PHP Security
Chris Snyder, Michael Southwell
Apress, Paperback, Published August 2005, 528 pages, ISBN 1590595084
http://www.bookpool.com/sm/1590595084

In addition to covering several classes  of PHP attacks, the authors
also walk through a few public vulnerabilities in various PHP
applications.  The book also provides good coverage to general web
application vulnerabilities (SQL injection, XSS, unvalidated user
input, etc.), which could be used as a security guide for other web
application languages.  Based entirely on a "gut-feeling" comparison
after skimming both of them, I recently ordered this book over the
O'Reilly PHP security book.  YMMV.

--Brian