Comments on Writing Secure PHP, Part 4 - AddedBytes.com

Comment on Writing Secure PHP, Part 4

2008-12-24T14:50:26+00:00

Comment by Pete ( http://dev-notes.com )

This is a good article. I have already deployed similar methods to combat #1 mentioned above for similar reasons, and will look into the other two.

Comment on Writing Secure PHP, Part 4

2008-12-21T22:35:01+00:00

Comment by Gizmore ( http://wechall.net )

Very nice summary of secure php coding.
A good reading and kind_a must read for beginners.

i follow this rule of thumb:

- mysql_real_escape_string() or intval() before query any userdata into database.

- htmlspecialchars() _every_ user input before output to browser

- use one-time-tokens in forms to prevent csrf.

Regards
Gizmore

Comment on Writing Secure PHP, Part 4

2008-11-20T13:54:44+00:00

Comment by Ewan ( http://www.ewan.org.uk )

Great set of articles written in plain English. Thanks for making it so easy to understand!

Comment on Writing Secure PHP, Part 4

2008-11-05T14:31:22+00:00

Comment by suzanne ( http://www.selectaskip.co.uk )

great article for anyone who is struggling with ASP

Comment on Writing Secure PHP, Part 4

2008-11-02T09:52:22+00:00

Comment by Mike ( http://kreativeearth.com )

I think this is an amazing article, for those ASP and PHP based wesbites which have loop holes for security. really informative.

Comment on Writing Secure PHP, Part 4

2008-10-27T20:36:04+00:00

Comment by Security ( http://www.experl.com )

This is a very beautiful website, I have enjoyed my visit here very much. I’m very honoured to sign in your guestbook. Thanking you for the great work that you are doing here.

Comment on Writing Secure PHP, Part 4

2008-10-26T17:42:24+00:00

Comment by Jason Gaved ( http://www.lexel.co.uk/ )

Great stuff Dave =) I wrote an similar article on security with ASP .. I read your "Secure PHP" and that gave me the idea, so thanks =P

Comment on Writing Secure PHP, Part 4

2008-10-12T12:28:00+01:00

Comment by James Moss ( http://www.jamesmoss.co.uk )

A great (and simple) way to prevent session hijacking is to record the IP address of the user when they login in the session alongside the other data you want to store.

Every time a user visits a page, compare their IP address to the one stored in the session. If they dont match then destroy the session and let them know what's happened.

This can prevent 99.9%(*) of session hijacks.

(* 56.8% of all statistics are made up on the spot)

Comment on Writing Secure PHP, Part 4

2008-09-29T22:12:11+01:00

Comment by O. Soteland ( )

Wow. So many things I had to fix. Fortunately, I mostly just added a few lines of code to some files.

And the idea of putting a blank index.html in all folders was nice.

Thanks!

Comment on Writing Secure PHP, Part 4

2008-09-25T14:21:40+01:00

Comment by Anonymous ( http://www.highforce.com )

Thank you for the insite into cross-site forgery, it is a pity we have to protect so much against people that are bored with there lives and want to disrupt others.
Thanks for your hard work keep it up..
All the best from Alan