Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: "J.O. Aho" Newsgroups: comp.lang.php Subject: Re: Secure website Date: Wed, 30 Oct 2013 18:03:24 +0100 Lines: 26 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Trace: individual.net r5PJpjzdGGP+WIIlUjAaHAMznvB+AbmodD+f5Ty0EFxBGzsBnJ Cancel-Lock: sha1:STH2wp/ZyYi1a+Jc0RjbWokiWQM= User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.0 In-Reply-To: Xref: csiph.com comp.lang.php:11658 On 30/10/13 15:47, Graham Hobbs wrote: > Thanks for that info. It seems I need to learn the comcepts behind > post/get/database etc .. is this how one codes for a dialogue with my > site? Besides the PHP manual, might there be such things as 'template' > examples? The exmples at php.net are just basic ones to show how the function works, I suggest you read comments and look for those who talk about security and injection prevention and avoid examples made by Indian developers, those generally are prone for header/sql injections and has poor security awarness. Remember to always check user generated data (say name, email and other things they might enter in a form, or is used in an URL), have white lists which contains which type of data you allow, for example you may only allow names written with latin characters, then regexp so it only contains lating characters and if there is something else, just throw out an "invalid data" error or ask the user to enter proper data and do not process anything futher untill you have OK data. -- //Aho