Business web site - CHAPTER 21 Secure PHP Programming
CHAPTER 21 Secure PHP Programming Any Web server can be thought of as a castle under constant attack by a sea of barbarians. And, as the history of both conventional and information warfare shows, often the attackers victory isn t entirely dependent upon their degree of skill or cunning, but rather on an oversight by the defenders. As keepers of the electronic kingdom, you re faced with no shortage of potential ingresses from which havoc can be wrought, perhaps most notably: User input: Exploiting disregarded user input is perhaps the easiest way to cause serious damage to an otherwise secure application infrastructure, an assertion backed up by the numerous reports of attacks launched on high-profile Web sites in this fashion. Deft manipulation of parameters emanating from Web forms, URL parameters, cookies, and other readily accessible routes enables attackers to exploit a multitude of routes to strike the very heart of your application logic. Software vulnerabilities: Web applications are often constructed from numerous technologies, typically a database server, a Web server, and one or more programming languages, all of which run on one or more operating systems. Therefore, it s crucial to constantly keep abreast of exposed vulnerabilities and take the steps necessary to patch the problem before someone takes advantage of it. The inside job: Shared host servers, such as those often found in ISPs and educational hosting environments, are always susceptible to damage, intentional or otherwise, by a fellow user s actions. Because each scenario poses significant risk to the integrity of your application, all must be thoroughly investigated and handled accordingly. In this chapter, we ll review many of the steps you can take to hedge against and even eliminate these dangers. Specifically, you ll learn about: Securely configuring PHP via its configuration parameters The safe mode security option The importance of validating user data Protecting sensitive data through common sense and proper server configuration PHP s encryption capabilities
Check Tomcat Web Hosting services for best quality webspace to host your web application.