Five PHP security measures

Over the years, PHP has been a stable and inexpensive platform for running web applications. Like most web-based platforms, PHP is vulnerable to external attacks. Developers, database architects, and system administrators should take preventive measures before deploying PHP applications to the server. Most of the preventive actions can be completed through several lines of code or slightly adjusting the application settings.

#1: manage installation scripts

If a developer has installed a PHP script for a third-party application, this script is used to install the working components of the entire application and provides an access point. Most third-party software packages are recommended to delete the installation script contained in this directory after installation. But developers want to keep the installation script. They can create a. htaccess file to control the access directory.

AuthType Basic

AuthName "Administrators Only"

AuthUserFile/usr/local/apache/passwd/passwords

Require valid-user

If an unauthorized user attempts to access a protected directory, a prompt is displayed asking for the user name and password. The password must match the password in the specified "passwords" file.

#2: header file

In many cases, developers can include several scripts distributed in an application into a script. These scripts will contain an "include" command to integrate a single file into the code on the original page. When the "include" file contains sensitive information, including the user name, password, and database access key, the file extension should be named ". php" instead of a typical ". inc" extension. The. php extension ensures that the php engine processes the file and prevents any unauthorized access.

#3: MD5 vs. SHA

In some cases, a user will eventually create his/her username and password, and the website administrator will encrypt the password submitted in the form and save it in the database. In the past few years, developers have used the MD5 (Message Digest algorithm) function to encrypt the code into a 128-Bit String password. Today, many developers use the SHA-1 (Security Hash Algorithm) function to create a 160-Bit String.

#4: Automatic global variables

The setting contained in the php. ini file is called "register_globals ". The P server automatically creates global variables for the server variables and query strings Based on the register_globals settings. When installing third-party software packages, such as content management software such as Joomla and Drupal, the installation script will guide you to set register_globals to "off ". Changing the setting to "off" ensures that unauthorized users cannot access data by guessing the variable name and verification password.

#5: Initialize variables and values

Many developers fall into the trap of not assigning values to instantiated variables because of time constraints or lack of effort. Variables in the authentication process should have a value before the user starts to log on to the program. This simple step prevents users from bypassing the validators or accessing some areas on the site where they do not have permissions