Five PHP security measures

Over the years, PHP has been a stable and inexpensive platform for running web applications. Like most web-based platforms, PHP is vulnerable to external attacks. Developers, database architects, and system administrators should take preventive measures before deploying PHP applications to the server. Most of the preventive actions can be completed through several lines of code or slightly adjusting the application settings.

1: manage installation scripts

If a developer has installed a PHP script for a third-party application, this script is used to install the working components of the entire application and provides an access point. Most third-party software packages are recommended to delete the installation script contained in this directory after installation. But developers want to keep the installation script. They can create a. htaccess file to control the access directory.

AuthType Basic AuthName "Administrators Only" AuthUserFile/usr/local/apache/passwd/passwords Require valid-user

If an unauthorized user attempts to access a protected directory, a prompt is displayed asking for the user name and password. The password must match the password in the specified "passwords" file.

2: header file

In many cases, developers can include several scripts distributed in an application into a script. These scripts will contain an "include" command to integrate a single file into the code on the original page. When the "include" file contains sensitive information, including the user name, password, and database access key, the file extension should be named ". php" instead of a typical ". inc" extension. The. php extension ensures that the php engine processes the file and prevents any unauthorized access.