Re: Securing PHP or finding PHP alternatives (was: PHP security (or the lack thereof))

[Matthias Kestenholz <lists () spinlock ch>]

* Gezim Hoxha (gezimetc () shaw ca) wrote:
> 1.) If I have to write PHP, how do I write secure PHP? Give me a number
> of ensures that I can follow and check-mark each and live a happy
> life--for the most part.

1. Read the whole PHP security chapter http://www.php.net/manual/en/security.php
2. Read about XSS, CSRF, SQL injections, session hijacking etc.
3. Always initialize your variables
4. Always escape anything going into an SQL query (if you don't use
prepared statements)
5. Do not use shell commands. Be very careful if you need to anyway
6. Never assume anything about input coming from the user.
7. Do not display data coming from the user before you are 100% sure
that the data is cleaned from XSS etc.
8. http://phpsecurity.org/ (perhaps)
9. Do not give in to living a happy life :-) Stay cautious
10. This list is incomplete.

> 2.) From a security standpoint what is a better, open-source replacement
> to PHP?

It's "good enough" for me. Nothing else has the same amount of
installations (which is a problem and a bonus at the same time)