bugtraq - Re: Securing PHP or finding PHP alternatives (was: PHP security (or the lack thereof))

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 10 Jul 2006 21:25:53 +0200
From: Matthias Kestenholz <lists@...nlock.ch>
To: Gezim Hoxha <gezimetc@...w.ca>
Cc: "Geo." <geoincidents@....net>, bugtraq@...urityfocus.com
Subject: Re: Securing PHP or finding PHP alternatives (was: PHP security (or	the lack thereof))

* Gezim Hoxha (gezimetc@...w.ca) wrote:
> 1.) If I have to write PHP, how do I write secure PHP? Give me a number
> of ensures that I can follow and check-mark each and live a happy
> life--for the most part.

1. Read the whole PHP security chapter http://www.php.net/manual/en/security.php
2. Read about XSS, CSRF, SQL injections, session hijacking etc.
3. Always initialize your variables
4. Always escape anything going into an SQL query (if you don't use
prepared statements)
5. Do not use shell commands. Be very careful if you need to anyway
6. Never assume anything about input coming from the user.
7. Do not display data coming from the user before you are 100% sure
that the data is cleaned from XSS etc.
8. http://phpsecurity.org/ (perhaps)
9. Do not give in to living a happy life :-) Stay cautious
10. This list is incomplete.

> 2.) From a security standpoint what is a better, open-source replacement
> to PHP?

It's "good enough" for me. Nothing else has the same amount of
installations (which is a problem and a bonus at the same time)