information security question

dirTdogE

alright, so i want visitors to be able to email without the risk of email harvestors getting ahold of the addresses. so i created a form and use php to mail the thing.

my question is, is there any way that the email addresses in the php file can be read? i keep seeing stuff about encrypting and obscurifying php so people cant steal it,, but i dont even know how people are able to view it??? when i view the source it just shows the html

please advize

thank you

MarkR

dirTdogE wrote:
my question is, is there any way that the email addresses in the php file can be read?

Not unless someone compromises your server, or a bug in your code accidentally displays the email address to an attacker.

i keep seeing stuff about encrypting and obscurifying php so people cant steal it,,

Even doing that would not do anything to protect an email address in the code from a determined attacker.

However, they'd need to compromise your site first anyway.

but i dont even know how people are able to view it??? when i view the source it just shows the html

Absolutely. Nor can a would-be attacker view it, unless they gain access to the hosting box or exploit a bug in your code or something else.

I recommend
- Use dedicated hosting (If you're on shared hosting, you're at the mercy of whatever flawed vulnerable apps the other users are deploying)
- Hire a competent sysadmin who will secure the machine adequately
- Don't run dodgy third party apps (e.g. phpbb, *Nuke)

Mark

dirTdogE

thanks for the help

i am not overly concerned about email harvestors hacking my host though

im curious, why do you say that phpbb is 'dodgy'?

MarkR

dirTdogE wrote:
im curious, why do you say that phpbb is 'dodgy'?

Because it has a very poor security record. Many remote exploits have existed, most of which allowed an attacker to compromise the database, however a few allowed an attacker to run arbitrary code, which would definitely allow them to get your email addresses.

However, if your server was compromised that way, your email address would be the least of your worries.

Mark