Comments on: PHP Security Guide & Checklist for Websites and Web Applications – Bottom Line for Every Good PHP Developer http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html Just another dumbass webmaster, goofing around... Wed, 08 Feb 2012 09:57:05 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Anonymous http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html/comment-page-1#comment-16403 Anonymous Mon, 02 Jan 2012 11:20:14 +0000 http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html#comment-16403 [...] [...] [...] [...]

]]> By: rajesh singh http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html/comment-page-1#comment-15612 rajesh singh Wed, 12 Oct 2011 06:00:58 +0000 http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html#comment-15612 thank you very much i have got very important things about PHP from you thank you, thank you and thank you thank you very much

i have got very important things about PHP from you thank you, thank you and thank you

]]> By: Sboniso http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html/comment-page-1#comment-15518 Sboniso Wed, 31 Aug 2011 11:07:38 +0000 http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html#comment-15518 Thank you man. Now my application will be more secure. Thank you man. Now my application will be more secure.

]]> By: Elumar http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html/comment-page-1#comment-14656 Elumar Fri, 08 Apr 2011 03:43:36 +0000 http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html#comment-14656 This post is fantastic, thanks! This post is fantastic, thanks!

]]> By: Jae http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html/comment-page-1#comment-11574 Jae Fri, 10 Dec 2010 13:08:20 +0000 http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html#comment-11574 Excellent Post! This is exactly what I was looking for. Thanks for sharing! Excellent Post! This is exactly what I was looking for. Thanks for sharing!

]]> By: Grace Roberts http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html/comment-page-1#comment-11273 Grace Roberts Tue, 16 Nov 2010 16:32:29 +0000 http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html#comment-11273 This is awesome, thanks! If any of you PHP geniuses are ever looking for PHP jobs check out http://www.technojobs.co.uk/jobs/php This is awesome, thanks!

If any of you PHP geniuses are ever looking for PHP jobs check out http://www.technojobs.co.uk/jobs/php

]]> By: R.J. http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html/comment-page-1#comment-10993 R.J. Mon, 20 Sep 2010 13:25:19 +0000 http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html#comment-10993 Great summary of security threats and nice presentation of concepts. Thanks for sharing! Great summary of security threats and nice presentation of concepts. Thanks for sharing!

]]> By: Panda http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html/comment-page-1#comment-10821 Panda Wed, 01 Sep 2010 10:36:59 +0000 http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html#comment-10821 Fantastico Post!!! God Bless !! Fantastico Post!!!

God Bless !!

]]> By: Links recomendados AVLog | AVLog - AgeValed http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html/comment-page-1#comment-10196 Links recomendados AVLog | AVLog - AgeValed Fri, 16 Jul 2010 16:27:16 +0000 http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html#comment-10196 [...] PHP Security Guide & Checklist for Websites and Web Applications – Bottom Line for Every Good ... [...] [...] PHP Security Guide & Checklist for Websites and Web Applications – Bottom Line for Every Good … [...]

]]> By: Nicolas http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html/comment-page-1#comment-9901 Nicolas Thu, 20 May 2010 15:28:34 +0000 http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html#comment-9901 Awesome post! Exactly what every PHP programmer should know and follow, thanks for sharing your thoughts. Nicolas. Awesome post!
Exactly what every PHP programmer should know and follow, thanks for sharing your thoughts.

Nicolas.

]]> By: Useful Security Pages | Toby's Development Blog http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html/comment-page-1#comment-9860 Useful Security Pages | Toby's Development Blog Wed, 05 May 2010 08:43:18 +0000 http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html#comment-9860 [...] Web App security checklist [...] [...] Web App security checklist [...]

]]> By: Yang Yang http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html/comment-page-1#comment-9753 Yang Yang Tue, 06 Apr 2010 15:41:34 +0000 http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html#comment-9753 Never use numerable values such as natural numbers to externally identify something though they are so easy to use in many cases. For example, better not use the ID of a record in any URL of your site. Instead, generate something that's not numerable so the attackers cannot jeopardize your site by both knowing something about its internal structure thus fabricating operations by unexpected input values and committing exhaustion attacks by navigating through all possible combinations of URL. Never use numerable values such as natural numbers to externally identify something though they are so easy to use in many cases. For example, better not use the ID of a record in any URL of your site. Instead, generate something that’s not numerable so the attackers cannot jeopardize your site by both knowing something about its internal structure thus fabricating operations by unexpected input values and committing exhaustion attacks by navigating through all possible combinations of URL.

]]> By: Yang Yang http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html/comment-page-1#comment-8599 Yang Yang Wed, 10 Mar 2010 03:58:45 +0000 http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html#comment-8599 Thanks for the very useful contribution. This guide serves as but a starting point of PHP security that doesn't intend to elaborate on each of the practices for potentially unlimited scenarios. But that's for sure a really nice tip for escaping strings to be used in html attributes! Good lesson I've learnt. Thanks! Thanks for the very useful contribution. This guide serves as but a starting point of PHP security that doesn’t intend to elaborate on each of the practices for potentially unlimited scenarios.

But that’s for sure a really nice tip for escaping strings to be used in html attributes! Good lesson I’ve learnt. Thanks!

]]> By: MugeSo http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html/comment-page-1#comment-8598 MugeSo Wed, 10 Mar 2010 03:03:06 +0000 http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html#comment-8598 when you use escaped string as html attribute, you should supply 2nd argument to htmlentities, like: htmlentities($str, ENT_QUOTES); without 2nd argument, htmlentities won't escape single quote. see: http://php.net/htmlentities And if you want to support i18n, the 3rd argument is also required. without that, htmlentities treat input string as ISO-8859-1. So you must supply correct encoding. when you use escaped string as html attribute, you should supply 2nd argument to htmlentities, like:
htmlentities($str, ENT_QUOTES);
without 2nd argument, htmlentities won’t escape single quote.
see: http://php.net/htmlentities

And if you want to support i18n, the 3rd argument is also required.
without that, htmlentities treat input string as ISO-8859-1. So you must supply correct encoding.

]]> By: Yang Yang http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html/comment-page-1#comment-8559 Yang Yang Tue, 09 Mar 2010 07:26:33 +0000 http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html#comment-8559 Thanks, wensheng. :) Thanks, wensheng. :)

]]>