[Information] website-secure-PHP

Cryptography is the process of changing the format of data (i.e., encrypting it) so that it is more difficult to read. Some cryptography, such as PGP, available for free for public use from http://www.pgp.com, uses public and private keys in order to encode and decode information. Other cryptographic systems, like the crypt() function built into PHP will encrypt data but will not decrypt it. You can find out more about crypt() within the Strings section of the PHP manual.

Cryptography is just a part of a secure solution as it can only be used once data has been received by the server. You may also need to take advantage of SSL connections in your Web sites. SSL, which stands for Secure Sockets Layer, is a method of securely transmitting information between a client (the Web browser) and the server. Utilization of SSL connections (indicated by the https://prefix in a URL) is a must for e-commerce applications. You can also specify that cookies are sent over a SSL connection by setting the proper parameters when using the setcookie function. Check with your ISP or server administrator to see if SSL connections are supported on the machine you are using.

Passwords used within your PHP application should always be encrypted. If the server you are using does not support mcrypt(), use crypt() to encrypt the password entered during the login, then check this against the stored encrypted password.

While PHP does not have the same security concerns that you might find using CGI scripts or ASP, they still exist. There are a several considerations to keep in mind while programming.

The first recommendation I would make is that files which contain sensitive information such as passwords be placed outside of the Web document root. Every Web server application uses a folder as the default root for Web documents. Items within the folder can be accessed via a URL but items located above the default folder cannot be. However, they can still be used within PHP with the line:

require ("../secure.php"); 

The above line of code will include the file secure.php which is located one folder above the current document.

My second recommendation is a two-parter involving getting user submitted data from HTML forms. First you should always remember to use the POST form method (as opposed to GET) when transferring sensitive information. This is because the GET method will append the submitted data to the URL, making it visible in the Web browser window.

Second, you should be wary of user-submitted data because it can be a common loophole through which malicious users can wreak havoc with your system. Clever people may be able to insert JavaScript or executable code into your site using an HTML form. This code could send them sensitive information, alter databases, and so forth.

If you will be doing more than just basic Web development work, you ought to seriously consider learning more about Web security than the few points illustrated in this appendix.

There are literally dozens upon dozens of Web sites you can visit to keep yourself informed of pertinent security issues. The most prominent four, in my opinion, are:

• Computer Response Emergency Team http://www.cert.org
• Security Focus http://www.security-focus.com
• Packet Storm http://packetstorm.securify.com
• World Wide Web Consortium http://http://www.w3.org/Security/Faq/www-security-faq.html

There are also any number of books available ranging from those that generically discuss security to those that will assist in establish secure Windows NT or Linux Web servers.

With respect to PHP, do not forget to read the PHP manual's section on security. Also review the security section of the documentation for the database you are using on the server. Some, such as MySQL's manual, includes tips specifically with respect to using PHP and MySQL.

source : http://merdeka.com, http://seo-tips-tech.blogspot.com, http://pinterest.com

Posted by Hodie J