Some PHP security tips for programmers & non-programmers

[Halfdeck]

Originally Posted by rich06

well i'm currently running a couple of domains off a single set of php code and that can be extended to multiple domains easily.

Yeah, I had the same set up and I had no problems till I tried moving servers. One big advantage of having my scripts inside the domain is - as superficial as it sounds - the ability for me to edit the php files, html and graphic layout of my sites in Dreamweaver without having to keep reconnecting.

Also, each of my domain requires a variant of the basic classes I use across all domains, so it's easier for me to use a set per domain instead of set per server.

[raymor]

More PHP security advice:

ALL PHP scripts have security issues, including
the following script, which lets any visitor to the
site upload any file they want to your server:

PHP Code:

<?php ?>

Even a totally empty PHP file with no code lets
people uploaded files to your server due to the
design (or rather lack of design) of PHP itself.

To improve PHP security turn register_globals off,
fopen_url off, open_basedir on, and except
for directories that hold scripts which accept
file uploads turn file uploads off.

[oast]

Another option is to deter the 'hackers' in the first place by:
1) disguising the fact you use scripting by renaming your .php files to .htm and adding the following to your .htaccess

AddType application/x-httpd-php .htm

Using .htm istead of .html will let you have static files without putting undue load on the server.

2) hiding all file extensions using mod_rewrite so that they appear to be directories.

I do that at my TopSites list at topsites.allyoursex.com


Option 1 would be the easiest for most, I expect, but I mentioned option 2 as an alternative for those in position to use it.