PHP Security Validator

thompeanio

Hi,
I am currently new to PHP and have just started a project to create a PHP security validator....

Can anyone please give me sum advice on...
1. What does a validator actually do in simple terms,
2. What security issues arise with php programming,
3. Any useful links that may help me with this project.

Many thanks for all your time and help. 🙂

Thompeanio

hadoob024

here's a good guide that i'm reading right now:

http://phpsec.org/projects/guide/

basically, validate all info coming and going from your site. be strict when filtering data. i use the following functions: trim(), strip_tags(), eregi(), str_replace(), and htmlspecialchars() to make sure that data entered is in exactly the format that i expect it to be.

also, make sure info being submitted by a form is actually coming from YOUR form. there's other stuff too, but that's a good start.

tony_l

thompeanio wrote:
Hi,
I am currently new to PHP and have just started a project to create a PHP security validator....

Can anyone please give me sum advice on...
1. What does a validator actually do in simple terms,
2. What security issues arise with php programming,
3. Any useful links that may help me with this project.

Many thanks for all your time and help. 🙂

Thompeanio

Not quite sure what a security validator is either... I am assuming that you are trying to create a username/password validation scheme?
If you are using a database - several issues arise when using PHP. You need to filter data like the previous poster states, you also need to use an escaping string, such as with mysql - you would use mysql_real_escape_string() function. You also need to get familiar with MD5() encoding and using what they call a "salt" - whih is a hidden password that is combined with the password the user submited. Of course, these are just a few items to consider.
Here are some good articles to read -

http://www.devshed.com/c/a/PHP/PHP-Security-Mistakes/
http://shiflett.org/articles/security-corner-apr2004