The first time you sign into developerWorks, a profile is created for you. Select information in your profile (name, country/region, and company) is displayed to the public and will accompany any content you post. You may update your IBM account at any time.

All information submitted is secure.

The first time you sign in to developerWorks, a profile is created for you, so you need to choose a display name. Your display name accompanies the content you post on developerworks.

Please choose a display name between 3-31 characters. Your display name must be unique in the developerWorks community and should not be your email address for privacy reasons.

All information submitted is secure.

My developerWorks:

My notifications:

Sign out

Select a language:

Locking down your PHP applications

Four security rules you can't violate

Thomas Myer (tom@tripledogs.com), Top Dog, Triple Dog Dare Media

Thomas Myer is the founder and top dog of Triple Dog Dare Media, an Austin, Texas, Web consultancy that specializes in information architecture, Web application development, and XML consulting. He is the author of No Nonsense XML Web Development with PHP, published by SitePoint.

Summary: You know security is important, but the tendency is to put off adding security until the last minute. It's impossible to secure a Web application completely -- so why bother, right? Wrong. You can take some easy steps to make your PHP Web application orders of magnitude more secure.

Date: 23 May 2006
Level: Intermediate
PDF: A4 and Letter (354 KB | 19 pages)Get Adobe® Reader®

Activity: 35625 views
Comments:

Before you start

In this tutorial, you'll learn how to add security to your PHP Web applications. It is assumed that you've been coding PHP Web applications for at least a year, so it won't cover the basics of the language (either conventions or syntax). The goal is to make you more aware of what you should be doing to secure the Web applications you're building.

Objectives

This tutorial teaches you how to guard against the most common security threats: SQL injections, the manipulation of the GET and POST variables, buffer overflow attacks, cross-site scripting attacks, data manipulation inside the browser, and remote form posting.

Prerequisites

This tutorial is written for PHP developers with at least one year of programming under their belts. You should know the syntax and the conventions of PHP coding; these won't be explained here. Some developers with experience in other languages -- such as Ruby, Python, and Perl -- can benefit from this tutorial because many of the precepts discussed here also relate to other languages and environments.

System requirements

You need an environment running PHP V4 or V5 and MySQL. You can use Linux®, OS X, or Microsoft® Windows®. If you're on Windows, download the WAMPServer binaries to install Apache, MySQL, and PHP on your machine in one package.

Comments