full-disclosure - How secure is PHP ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b024b3480411021547c400f8e@mail.gmail.com>
From: morgan.s.reed at gmail.com (Morgan Reed)
Subject: How secure is PHP ?

First I'd recommend reading some guides on securing PHP, MySQL and Apache.

PHP itself CAN be (relatively) secure but only if it's configured
correctly, the same goes for Apache, it's like the old saying "never
build a house on shifting sand" (or something to that effect) a the
most secure PHP web application can be compromised by the simplest
mistake in the configuration of the underlying technology.

These articles are all from SecurityFocus, for more I'd suggest
googling around a bit.
Securing PHP Step-by-Step: http://www.securityfocus.com/infocus/1706
Securing MySQL Step-byStep: http://www.securityfocus.com/infocus/1726
Secure MySQL Database Design: http://www.securityfocus.com/infocus/1667
Securing Apache Step-by-Step: http://www.securityfocus.com/infocus/1694

Morgan

-- 
Microsoft Windows:
A 32-bit extension and graphical shell to a 16-bit patch to an 8-bit
operating system originally coded for a 4-bit microprocessor, written
by a 2-bit company that can't stand 1-bit of competition.

On Mon, 1 Nov 2004 17:45:36 +0600, Nayana Somaratna
<npsomaratna@...il.com> wrote:
> Hi everyone,
> 
> I've been tasked with creating a learning management system for my
> University. Given that we're only handling a few handred students, I'd
> typically want to create it using linux/apache/mysql/php.
> 
> However, when browsing the web, I found an article which said that "it
> requires an expert to lockdown php" (Sorry, but I can't quite recall
> the URL).
> 
> While I am not a novice, I am defintely not an expert either -
> expecially on security issues.
> 
> So, I'd like to ask the members of this list - how difficult is it to
> secure php ? Do you really need a security "expert" to do this ?
> 
> P.S. The few hundred students mentioned above are IT students ;-)
> 
> Thanks,
> 
> - Nayana
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>