security code

betacrash

hello everyone,

where can i find examples to secure my website (input forms,...)?

and what are the important things to do when securing it?

thx in advance!

greetz,

beta!

Natty_Dreadlock

there are lots of ways to secure a website... If u wanna encrypt the connection, use https - if your hoster offers it or if u have your own box and the necessary certificates. If u cannot use it, I think there's some javascript/php solution that sends all passwords encryted using some client-side md5-hashing (called fastlogin, go to http://www.publicator.no/php_net/login/ , login with the credentials given on the page and download the script).
If u want to restrict access to certain directories/pages, search on google for .htaccess-Tutorials or check php's session functions - there is really a lot of information on this page and everywhere else on the net.
Hope that helps

betacrash

yes, this helps. 🙂

are there also ways to prevent that the logged in user cannot write javascript and other code in text boxes?

can any code damages the database when they are intered in a textbox?

Natty_Dreadlock

if you are experienced with regexps, u can write one to filter all dynamic elements of textfield data - pls ask again in that forum, cause i have no idea how to do that at the moment - I had to look it up, but lack the time to do it.
Yeah, it's possible to send malicious code to a database via a textfield... Imagine someone puts e.g. MyName;DELETE FROM myDatabase; into some textfield of your webapp. If u use this in your query like this: UPDATE myDatabase SET name=$myName WHERE id=$id this would result in the following query sent to mysql:
UPDATE myDatabase SET name=MyName; DELETE FROM myDatabase; WHERE id=12;
See the problem?!
So u should pass all params your script processes through http://www.php.net/manual/en/function.mysql-escape-string.php
Hasta siempre

jayant

Originally posted by betacrash
yes, this helps. 🙂

are there also ways to prevent that the logged in user cannot write javascript and other code in text boxes?

see [man]strip_tags/man function