PHP Developer - thePHP.cc

7 downloads 116 Views 2MB Size Report
Working with PHP for over a decade. » Security paranoid ;-) ... for the webserver. That includes the index.php ... theseer@nyda ~ $ cat crypt.php.
Things Every

PHP Developer

Should Know About

Arne Blankerts | ConFoo 2014 | February, 26th | Montreal

Security

About: Arne Blankerts »

Working with PHP for over a decade

»

Security paranoid ;-)

»

System Architect

»

Author of phpab and phpDox

»

XML Fan

»

Consultant with thePHP.cc

Where do I place my source files?

No source under the document root

No PHP source for the webserver That includes the index.php

$_POST and $_GET or just $_REQUEST?

Be explicit.

Use dedicated variables based on request method.

Why can type casting be dangerous?

theseer@nyda ~ $ php -r 'var_dump( (int)"123abc" );' int(123)

sharing experience

Do not use type casting to skip on validation

How do I actually handle errors?

Step 1 ini_set('display_errors', 0);

Step 2 error_reporting(0);

Step 3 set_error_handler();

Step 4 (bonus!) set_exception_handler();

Step 4 (gold bonus!) register_shutdown_function();

Why is using sha1($passwd) not good enough for savely storing password?

PHP < 5.5 crypt(

$password, $blowfish . $cost . $randomBytes

);

theseer@nyda ~ $ cat crypt.php