PHP Securities

Security

1.Register Globals should be Off

2. Error Reporting & Exceptions

  a. display_errors to Off
b. log_errors to On
c. ini_set('error_reporting', E_ALL | E_STRICT);
d. ini_set('display_errors', 'Off');
e. ini_set('log_errors', 'On');
f. ini_set('error_log', '/usr/local/apache/logs/error_log');

3. Filter Input Data – validate the data

a. htmlentities( ) for escaping data to be sent to the client.
b. mysql_real_escape_string()

4. Escape Output

5. URL Attacks - Use POST method for dangerous action in form, use GET method if necessary

6. File upload attacks - is_uploaded_file( ) & move_uploaded_file( ).

7. Cross-Site Scripting(XSS) – use htmlentities( )

8. Protect database connection & .inc file access(db.inc) – Permission to confidential pages.

<Files ~ "\.inc$">
Order allow,deny
Deny from all
</Files>

9. SQL injection - mysql_real_escape_string( )

10. session_set_save_handler('_open', '_close', '_read', '_write', '_destroy', '_clean' ) is the best way to prevent session hijacking

11. Remote file inclusion(RFI).

12. Store passwords in an encrypted format in database or files.

13. Avoid taking confidential value in cookies

INI FILE SECURITIES

a. register_globals - should be Off
b. allow_url_fopen – should be Off
c. disable_functions - should be Off
d. display_errors - should be Off in only production server
e. error_reporting – set to E_ALL
f. enabling log_errors
g. memory_limit – 8M in most cases