Re: Anyone have some basic security tips for PHP-programmers?

[Härnhammar, Ulf <Ulf.Harnhammar.9485 () student uu se>]

Quoting Andreas <exon () home se>:

> On a side-note:
> It's ofcourse never a good idea to pass user-supplied data to a program, 
> but that doesn't necessarily involve bugs for it to be exploitable. I 
> thought this was self-explanatory, but apparently I was wrong.

SQL Injection and Cross-site Scripting are excellent examples. Neither requires 
bugs in any external software.

It could also be noted that lots of tasks in common computer programs in fact 
require passing user-supplied data to external programs, so it is often hard to 
avoid.

-- 
Ulf Härnhammar, student, Uppsala universitet

"Jag är en tvivelaktig figur / Duger ej mycket till"
-- Cornelis Vreeswijk, "Somliga går med trasiga skor"

Uggs != Cmectbb