Full Disclosure mailing list archives
Re: How secure is PHP ?
From: Morgan Reed <morgan.s.reed () gmail com>
Date: Wed, 3 Nov 2004 10:47:29 +1100
First I'd recommend reading some guides on securing PHP, MySQL and Apache. PHP itself CAN be (relatively) secure but only if it's configured correctly, the same goes for Apache, it's like the old saying "never build a house on shifting sand" (or something to that effect) a the most secure PHP web application can be compromised by the simplest mistake in the configuration of the underlying technology. These articles are all from SecurityFocus, for more I'd suggest googling around a bit. Securing PHP Step-by-Step: http://www.securityfocus.com/infocus/1706 Securing MySQL Step-byStep: http://www.securityfocus.com/infocus/1726 Secure MySQL Database Design: http://www.securityfocus.com/infocus/1667 Securing Apache Step-by-Step: http://www.securityfocus.com/infocus/1694 Morgan -- Microsoft Windows: A 32-bit extension and graphical shell to a 16-bit patch to an 8-bit operating system originally coded for a 4-bit microprocessor, written by a 2-bit company that can't stand 1-bit of competition. On Mon, 1 Nov 2004 17:45:36 +0600, Nayana Somaratna <npsomaratna () gmail com> wrote:
Hi everyone, I've been tasked with creating a learning management system for my University. Given that we're only handling a few handred students, I'd typically want to create it using linux/apache/mysql/php. However, when browsing the web, I found an article which said that "it requires an expert to lockdown php" (Sorry, but I can't quite recall the URL). While I am not a novice, I am defintely not an expert either - expecially on security issues. So, I'd like to ask the members of this list - how difficult is it to secure php ? Do you really need a security "expert" to do this ? P.S. The few hundred students mentioned above are IT students ;-) Thanks, - Nayana _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: How secure is PHP ?, (continued)
- Re: How secure is PHP ? ph0enix (Nov 01)
- Re: How secure is PHP ? Gary E. Miller (Nov 01)
- Re: How secure is PHP ? Dan Margolis (Nov 02)
- Re: How secure is PHP ? Gary E. Miller (Nov 02)
- Re: How secure is PHP ? Ron DuFresne (Nov 04)
- Re: How secure is PHP ? Stefan Esser (Nov 04)
- Re: How secure is PHP ? Ron DuFresne (Nov 22)
- Re: How secure is PHP ? Gary E. Miller (Nov 04)
- Re: How secure is PHP ? Dan Margolis (Nov 02)
- Re: How secure is PHP ? Dan Margolis (Nov 11)
- Re: How secure is PHP ? Meder Kydyraliev (Nov 01)
- Re: How secure is PHP ? VeNoMouS (Nov 04)
- Re: How secure is PHP ? Matt (Nov 05)
- Re: How secure is PHP ? Gary E. Miller (Nov 05)
- Re: How secure is PHP ? Matt (Nov 05)