Top 10 PHP best security practices

[Switch] Top 10 PHP best security practices PHP is widely used in a variety of Web development. When the script configuration on the server is incorrect, various problems may occur. Today, most Web servers run in Linux environments (such as Ubuntu and Debian ). This article illustrates the top ten PHP best security practices that allow you to [switch] the top ten PHP best security practices.
PHP is widely used in various Web development scenarios. When the script configuration on the server is incorrect, various problems may occur. Today, most Web servers run in Linux environments (such as Ubuntu and Debian ). This article illustrates the top ten PHP best security practices that allow you to easily and securely configure PHP.



PHP Security settings prompt:

Reference DocumentRoot:/var/www/
Default Web server: Apache

Default PHP configuration file:/etc/php. ini

Default PHP extensions config directory:/etc/php. d/

Our sample php security config file:/etc/php. d/security. ini (you need to create this file using a text editor)

Operating systems: Ubuntu (the instructions showould work with any other Linux distributions such as RHEL/CentOS/Fedora or other Unix like operating systems such as OpenBSD/FreeBSD/HP-UX ).

1. reduce PHP built-in modules

To improve performance and security, we strongly recommend that you reduce the number of modules in PHP. Let's take a look at the module installed by the executed command below.

# Php-m
You will get a similar result:

Reference [PHP Modules]
Apc
Bcmath
Bz2
Calendar
Core
Ctype
Curl
Date
Dom
Ereg
Exif
Fileinfo
Filter
Ftp
Gd
Gettext
Gmp
Hash
Iconv
Imap
Json
Libxml
Mbstring
Memcache
Mysql
Mysqli
Openssl
Pcntl
Pcre
PDO
Pdo_mysql
Pdo_sqlite
Phar
Readline
Reflection
Session
Shmop
SimpleXML
Sockets
SPL
Sqlite3
Standard
Suhosin
Tokenizer
Wddx
Xml
Xmlreader
Xmlrpc
Xmlwriter
Xsl
Zip
Zlib
[Zend Modules]
Suhosin
Delete a module and execute this command. For example, delete the sqlite3 module.

Reference # rm/etc/php. d/sqlite3.ini

Or

Reference # mv/etc/php. d/sqlite3.ini/etc/php. d/sqlite3.disableRestrict
2. minimize PHP information leakage

By default, PHP generates a line between each response at the HTTP header (for example, X-Powered-By: PHP/5.2.10 ). This creates a very valuable information for attackers in the system information.

HTTP example:
Reference
HTTP/1.1 200 OK
X-Powered-By: PHP/5.2.10
Content-type: text/html; charset = UTF-8
Vary: Accept-Encoding, Cookie
X-Vary-Options: Accept-Encoding; list-contains = gzip, Cookie; string-contains = wikiToken;
String-contains = wikiLoggedOut; string-contains = wiki_session
Last-Modified: Thu, 03 Nov 2011 22:32:55 GMT
...
Therefore, we strongly recommend that you disable PHP information leakage. to disable php information, edit/etc/PHP. d/secutity. ini and set the following command:

Reference expose_php = Off

3. minimize PHP loading modules

By default, all modules loaded by RHEL can be found in the/etc/php. d/directory. To disable or enable a specific module, you only need to comment out the module name in the/etc/php. d/directory of the configuration file. To optimize PHP performance and security, we strongly recommend that you enable the extension feature when your application needs it. For example, when the GD extension is disabled, type the following command:

Reference # cd/etc/php. d/

# Mv gd. {ini, disable}

#/Etc/init. d/apache2 restart
To expand the pgp gd module, type the following command:

Reference # mv gd. {disable, ini}

#/Sbin/service httpd restart
4. record PHP error information

To improve the security of systems and Web applications, PHP error messages cannot be exposed. To do this, edit the/etc/php. d/security. ini file and set the following command:

Reference display_errors = Off
To facilitate Bug fixing, all PHP errors should be recorded in the log.

Reference log_errors = On

Error_log =/var/log/httpd/php_scripts_error.log

5. disable remote code execution

If code is remotely executed, PHP code can be used to remotely retrieve data functions, such as FTP or Web-based building functions through PHP. For example, file_get_contents ().

Many programmers use these functions to obtain data remotely through FTP or HTTP. However, this method may cause a large vulnerability in PHP-based applications. Because most programmers do not properly filter the data provided by users, they inject vulnerabilities when opening security vulnerabilities and creating code. To solve this problem, disable _ url_fopen in/etc/php. d/security. ini and set the following command:

Reference allow_url_fopen = Off
In addition, we recommend that you disable _ url_include to improve system security.

Reference allow_url_include = Off
6. disable dangerous functions in PHP

PHP has many dangerous built-in functions. if improperly used, it may cause your system to crash. You can create a PHP built-in function list and disable it by editing/etc/php. d/security. ini.

Reference disable_functions = exec, passthru, shell_exec, system, proc_open, popen, curl_exec, curl_multi_exec, parse_ini_file, show_source
7. resource control

To improve system stability, we strongly recommend that you set the maximum amount of memory that each script may consume to parse request data. Correct configuration of these parameters can prevent any PHP script from consuming too much resources or memory, thus avoiding system insecurity or reducing the security factor.

Reference # set in seconds

Max_execution_time = 30

Max_input_time = 30

Memory_limit = 40 M

8. restrict PHP access to the file system

The directory specified by the open_basedir command allows PHP to access features such as fopen. If any script attempts to access a Path File that exceeds the open_basdir definition, PHP will refuse to open the file. It is worth noting that you cannot use a symbolic link as a work und.
Reference
; Limits the PHP process from accessing files outside
; Of specifically designated directories such as/var/www/html/
Open_basedir = "/var/www/html /"
;------------------------------------
; Multiple dirs example
; Open_basedir = "/home/httpd/vhost/cyberciti. biz/html/:/home/httpd/vhost/nixcraft.com/html/:/home/httpd/vhost/theos.in/html /"
;------------------------------------
9. restrict file/directory access

Make appropriate security settings: ensure that Apache runs as a non-root user, such as www-data or www. Files and directories under/var/www/are also non-root users. To change the owner, run the following command:
Reference
# Chown-R apache: apache/var/www/
10. compile configuration files to protect Apache, PHP, and MySQL

Use the charrt command to compile and protect the configuration file
Reference
# Chattr + I/etc/php. ini

# Chattr + I/etc/php. d /*

# Chattr + I/etc/my. ini

# Chattr + I/etc/httpd/conf/httpd. conf

# Chattr + I/etc/
You can use the charrt command to compile a directory that protects php files or files from/var/www/html:

Reference # chattr + I/var/www/html/file1.php

# Chattr + I/var/www/html/
(Note: This article is compiled by Xia Mengzhu. For more information, see the source .)

Http://sd.csdn.net/a/20120130/311203.html
Http://www.ansoncheung.tk/articles/top-10-php-best-security-practices-sys-admins: