* Gezim Hoxha ([EMAIL PROTECTED]) wrote: > 1.) If I have to write PHP, how do I write secure PHP? Give me a number > of ensures that I can follow and check-mark each and live a happy > life--for the most part.
1. Read the whole PHP security chapter http://www.php.net/manual/en/security.php 2. Read about XSS, CSRF, SQL injections, session hijacking etc. 3. Always initialize your variables 4. Always escape anything going into an SQL query (if you don't use prepared statements) 5. Do not use shell commands. Be very careful if you need to anyway 6. Never assume anything about input coming from the user. 7. Do not display data coming from the user before you are 100% sure that the data is cleaned from XSS etc. 8. http://phpsecurity.org/ (perhaps) 9. Do not give in to living a happy life :-) Stay cautious 10. This list is incomplete. > 2.) From a security standpoint what is a better, open-source replacement > to PHP? It's "good enough" for me. Nothing else has the same amount of installations (which is a problem and a bonus at the same time)
