[RESOLVED] How php is secure

praveenp

Hi All

I have to build one web site using PHP but i have few doubts, please any one can clarify me.

Below are my doubts.

How php is secure.
How it will provide security while transferring data.
Why do i need to select PHP for developing a web site.

My main doubt is how PHP is secure.

Thanks
Praveen.P

laserlight

praveenp wrote:
1. How php is secure.

What exactly do you have in mind with respect to security? For example, you could be talking about security bugs in the PHP interpreter, or about whether the language itself facilitates the avoidance of bugs that can compromise security, etc.

praveenp wrote:
2. How it will provide security while transferring data.

It does not. You should use say, SSL/TLS for this.

praveenp wrote:
3. Why do i need to select PHP for developing a web site.

You don't, but chances are PHP will be available on a web host that you wish to use for deployment.

ixalmida

Just to add my 2 cents, PHP is generally as secure as YOU make it. That means not only securing your PHP code but implementing other secure technologies, such as SSL - which you'd need with any scripting language to make secure connections. If you start out with a good understanding of potential security challenges and structure your code around them, then you should be fine.

As to why you'd want to use PHP...
1) It is a mature language
2) It is geared primarily toward web development
3) It is easy to learn and read
4) It is free! You may or may not be planning to host your own site but if you do, then your expense can be very minimal. My company hosts their customer portal for the price of the hardware and the SSL certificate. We haven't paid a dime for anything else. If you don't plan to host, you'll probably notice that PHP hosts are often less expensive than .NET hosts.

praveenp

laserlight;10944534 wrote:
What exactly do you have in mind with respect to security? For example, you could be talking about security bugs in the PHP interpreter, or about whether the language itself facilitates the avoidance of bugs that can compromise security, etc.

Thank you lot. I am talking about security bugs in php interpreter and language bugs that can compromise security, these kind of doubts i have.

praveenp

ixalmida;10944592 wrote:
Just to add my 2 cents, PHP is generally as secure as YOU make it. That means not only securing your PHP code but implementing other secure technologies, such as SSL - which you'd need with any scripting language to make secure connections. If you start out with a good understanding of potential security challenges and structure your code around them, then you should be fine.

As to why you'd want to use PHP...
1) It is a mature language
2) It is geared primarily toward web development
3) It is easy to learn and read
4) It is free! You may or may not be planning to host your own site but if you do, then your expense can be very minimal. My company hosts their customer portal for the price of the hardware and the SSL certificate. We haven't paid a dime for anything else. If you don't plan to host, you'll probably notice that PHP hosts are often less expensive than .NET hosts.

Thank you ixalmida for explanation.

Ashley_Sheridan

As everyone else has said above, PHP is as secure as you make it. If this is your first time using PHP, I'd guess that you know of the best ways to keep your PHP application completely secure, so I'd suggest seeing what systems that are already built that you could use. For example, if you need to build an online shop, there's systems like Magento built in PHP that have a whole community behind them. Likewise, WordPress is great for blogs, Drupal and Joomla are great for CMS sites, and the list goes on.

If you choose something already built with PHP then you can have a look at how things are done with PHP to help you learn the language. And then when you feel your skills are ready, you can change the code to suit your own specific needs.

ixalmida

praveenp;10944698 wrote:
Thank you lot. I am talking about security bugs in php interpreter and language bugs that can compromise security, these kind of doubts i have.

From my point of view, there are no notable language bugs in version 5+. However, ignorance of security risks and failure to compensate will usually end up compromising security. If you just take the time to carefully read the PHP manual page for the functions you use, you should be in pretty good shape. If there's a security risk, there's usually a warning about it in the manual and a suggestion on what to do instead.

Google a function if you're not familiar with it. The php.net manual page is usually at the top (though occasionally the w3schools version is more popular). Google should be your best friend and constant companion. 😃

Weedpacket

When a PHP-based site is hacked, it usually turns out not to be due to an exploit on PHP itself, but rather on vulnerable scripts.

Sites have to be written to defend themselves against all the usual categories of attacks that all web sites face whatever they're running on. Off-the-shelf PHP applications may also contain vulnerabilities and exploits may be developed targeting specific weaknesses in those.

A list of known PHP-related vulnerabilities (including historic ones dating back to PHP/FI) is maintained by MITRE. Note that virtually all entries refer to third-party apps. All of the vulnerabilities that apply to PHP itself have been addressed in current versions (at time of writing those are 5.2.13 and 5.3.1).

halojoy

Two main 'doors' into your php and your website
for hackers and for anyone are
1. URL Request strings
2. Form Inputs

So, in order to make more secure website
we should be very careful & restrictive with how open we have these doors.

Simple & bad PHP code just accepts whatever is coming via URL & Forms.

Good pogramming filters out only very specific requests = Valid Request.

🙂

praveenp

Thank you all , great support

I got solution and i will start work on my project using php. I will post thread again if I have any doubts or question.

this is very good forum giving answer quickly very helpfull .

Thanks
Praveen

Ashley_Sheridan

If your question is answered, please mark the thread as resolved so that other people can easily benefit if they have the same question.

igorek

halojoy;10944799 wrote:
Two main 'doors' into your php and your website
for hackers and for anyone are
1. URL Request strings
2. Form Inputs

So, in order to make more secure website
we should be very careful & restrictive with how open we have these doors.

Simple & bad PHP code just accepts whatever is coming via URL & Forms.

Good pogramming filters out only very specific requests = Valid Request.

🙂

which functions would you suggest to tighten each door?

Ashley_Sheridan

Before inserting data into a database, use the mysql_real_escape_string() function. Before displaying data to a page, use strip_tags().

Generally these should do the trick. If you want more control, consider filtering variables individually.

http://www.ashleysheridan.co.uk/coding_php_validation.php

That's something I wrote a couple of years back. It needs a bit of update work, but should be enough to get you started.

igorek

thanks Ashley, btw i was just browsing your site very nice job!

Ashley_Sheridan

Thanks, I try to keep it up-to-date with posts and code snippets I think are useful 😉

praveenp

Ashley Sheridan;10946216 wrote:
Thanks, I try to keep it up-to-date with posts and code snippets I think are useful 😉

Thanks Ashley, your website is nice, good job it will help lot for php developers