Before you start

In this tutorial, you'll learn how to add security to your PHP Web applications. It is assumed that you've been coding PHP Web applications for at least a year, so it won't cover the basics of the language (either conventions or syntax). The goal is to make you more aware of what you should be doing to secure the Web applications you're building.

Objectives

This tutorial teaches you how to guard against the most common security threats: SQL injections, the manipulation of the GET and POST variables, buffer overflow attacks, cross-site scripting attacks, data manipulation inside the browser, and remote form posting.

Back to top

Prerequisites

This tutorial is written for PHP developers with at least one year of programming under their belts. You should know the syntax and the conventions of PHP coding; these won't be explained here. Some developers with experience in other languages -- such as Ruby, Python, and Perl -- can benefit from this tutorial because many of the precepts discussed here also relate to other languages and environments.

Back to top

System requirements

You need an environment running PHP V4 or V5 and MySQL. You can use Linux®, OS X, or Microsoft® Windows®. If you're on Windows, download the WAMPServer binaries to install Apache, MySQL, and PHP on your machine in one package.

1 of 12 | Next

Comments

Back to top

Table of contents

• Before you start
• Quick introduction to security
• Web security 101
• Avoid SQL injection attacks
• Keep users from manipulating GET variables
• Buffer overflow attacks
• Cross-site scripting attacks
• Data manipulation inside the browser
• Remote form posting
• Summary
• Resources
• About the author

---

1 of 12 | Next

Next steps from IBM

With the no-charge DB2 Express-C, Zend Core PHP, and Java you can develop advanced Web 2.0 applications quickly that matter.

---

• Try: Download a free trial version of DB2 Express-C, which includes Zend Core PHP and pureXML technology that is ideally suited for managing both XML and relational data and powering a new breed of SOA and Web 2.0 solutions.
• Article: This IBM Redbook shows how to port PHP apps from MySQL to DB2, and includes code samples for creating Zend Core PHP applications.
• Tutorial: In this Mastering Facebook app development tutorial series, you will use Java and PHP in parallel to build a Facebook interface for an online stock trading J2EE application using the Spring framework.
• Buy: DB2 9 for Linux, UNIX and Windows

Dig deeper into Open source on developerWorks

Try IBM PureSystems. No charge.

Experience today!

---

Get started with the cloud-based trial and pattern development kit.