Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #11658

Re: Secure website

Show all headers | View raw

On 30/10/13 15:47, Graham Hobbs wrote:


> Thanks for that info. It seems I need to learn the comcepts behind
> post/get/database etc .. is this how one codes for a dialogue with my
> site? Besides the PHP manual, might there be such things as 'template'
> examples?

The exmples at php.net are just basic ones to show how the function 
works, I suggest you read comments and look for those who talk about 
security and injection prevention and avoid examples made by Indian 
developers, those generally are prone for header/sql injections and has 
poor security awarness.

Remember to always check user generated data (say name, email and other 
things they might enter in a form, or is used in an URL), have white 
lists which contains which type of data you allow, for example you may 
only allow names written with latin characters, then regexp so it only 
contains lating characters and if there is something else, just throw 
out an "invalid data" error or ask the user to enter proper data and do 
not process anything futher untill you have OK data.

-- 

  //Aho

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Secure website Graham Hobbs <ghobbs@cdpwise.net> - 2013-10-29 23:02 -0400
  Re: Secure website Denis McMahon <denismfmcmahon@gmail.com> - 2013-10-30 03:26 +0000
  Re: Secure website "J.O. Aho" <user@example.net> - 2013-10-30 06:52 +0100
    Re: Secure website Graham Hobbs <ghobbs@cdpwise.net> - 2013-10-30 10:47 -0400
      Re: Secure website "J.O. Aho" <user@example.net> - 2013-10-30 18:03 +0100
        Re: Secure website Graham Hobbs <ghobbs@cdpwise.net> - 2013-10-30 19:18 -0400
  Re: Secure website Jerry Stuckle <jstucklex@attglobal.net> - 2013-10-30 14:56 -0400
    Re: Secure website Graham Hobbs <ghobbs@cdpwise.net> - 2013-10-30 19:15 -0400
      Re: Secure website Jerry Stuckle <jstucklex@attglobal.net> - 2013-10-30 23:03 -0400
        Re: Secure website Graham Hobbs <ghobbs@cdpwise.net> - 2013-10-31 10:27 -0400
          Re: Secure website Jerry Stuckle <jstucklex@attglobal.net> - 2013-10-31 11:24 -0400
            Re: Secure website Graham Hobbs <ghobbs@cdpwise.net> - 2013-10-31 12:47 -0400
              Re: Secure website Jerry Stuckle <jstucklex@attglobal.net> - 2013-10-31 20:36 -0400
  Re: Secure website David Quinton <usenet_2005D_email@REMOVETHISBITbizorg.co.uk> - 2013-10-31 10:24 +0000
    Re: Secure website Graham Hobbs <ghobbs@cdpwise.net> - 2013-10-31 10:28 -0400

csiph-web