Summary of five PHP security measures. Developers, database architects, and system administrators should take preventive measures before deploying PHP applications to the server. Most of the preventive actions can be taken through several lines of code or before application developers, database architects, and system administrators deploy PHP applications to the server. Most of the preventive actions can be completed through several lines of code or slightly adjusting the application settings.
#1: manage installation scripts
If a developer has installed a PHP script for a third-party application, this script is used to install the working components of the entire application and provides an access point. Most third-party software packages are recommended to delete the installation script contained in this directory after installation. But developers want to keep the installation script. they can create a. htaccess file to control the access directory.
AuthType Basic
AuthName "Administrators Only"
AuthUserFile/usr/local/apache/passwd/passwords
Require valid-user
If an unauthorized user attempts to access a protected Directory, a prompt is displayed asking for the user name and password. The password must match the password in the specified "passwords" file.
#2: header file
In many cases, developers can include several scripts distributed in an application into a script. These scripts will contain an "include" command to integrate a single file into the code on the original page. When the "include" file contains sensitive information, including the user name, password, and database access key, the file extension should be named ". php" instead of a typical ". inc" extension. The. php extension ensures that the php engine processes the file and prevents any unauthorized access.
#3: MD5 vs. SHA
In some cases, a user will eventually create his/her username and password, and the website administrator will encrypt the password submitted in the form and save it in the database. In the past few years, developers have used the MD5 (Message Digest Algorithm) function to encrypt the code into a 128-bit string password. Today, many developers use the SHA-1 (security hash algorithm) function to create a 160-bit string.
#4: automatic global variables
The setting contained in the php. ini file is called "register_globals ". The P server automatically creates global variables for the server variables and query strings based on the register_globals settings. When installing third-party software packages, such as content management software such as Joomla and Drupal, the installation script will guide you to set register_globals to "off ". Changing the setting to "off" ensures that unauthorized users cannot access data by guessing the variable name and verification password.
#5: Initialize variables and values
Many developers fall into the trap of not assigning values to instantiated variables because of time constraints or lack of effort. Variables in the authentication process should have a value before the user starts to log on to the program. This simple step prevents users from bypassing the validators or accessing some areas on the site where they do not have permissions
Bytes. Most of the preventive actions can be performed through several lines of code or the application...
