Hi,
Just wanted to know what could be the security cautions I should know about PHP Hosting?
Thanks
+4
A:
Here are some of the things:
- Disable functions like
eval,passthru,shell_exec,etc - Remote url injection, disable
allow_url_fopen - Disable
register_globals
And don't forget:
- You are responsible too. Write secure code, read security tutorials out there.
Finally as suggested by Rook, you should run:
PHPSecInfo script to see security settings of your host.
Sarfraz
2010-05-16 07:21:36
Those are only useful if you are a bad developer
kemp
2010-05-16 07:29:43
@kemp: When it comes to security no one is a perfect developer, everyone could try his best as per his knowledge to avoid any mishaps. And if you search on SO, even the most experienced developers have been compromised due to bad settings on the hosting which was not the fault of them (and yes they should have taken this in account too). Also hundreds of sites have been hacked due to `eval` functions being active through a php shell 99 malacious script. Finally, in my last list item, i have said, **You are responsible too**
Sarfraz
2010-05-16 07:34:16
Depends on what side the OP is on: my point is that if you are a developer you'd better not rely on server settings for your own security. If you are a hosting provider then it's another matter.
kemp
2010-05-16 07:48:29
@kemp: and i agree to that too.
Sarfraz
2010-05-16 07:49:37
@Sarfraz +1 you totally are correct, however you should tell people to run PHPSecInfo (http://phpsec.org/projects/phpsecinfo/) because there are other nasty configuration issues.
Rook
2010-05-16 08:07:21
+2
A:
If you speak as developer (and not as hoster), then don't rely on the server -- write secure code and you won't be harmed by any php configuration directive ever.
kemp
2010-05-16 07:29:09
@kemp: see this please: http://www.topwebhostreview.net/security-cautions-for-php-hosting/
Sarfraz
2010-05-16 07:37:11
register_globals will probably make a secure application vulnerable to attack. Here is an exploit that i have written which is an a good example: (http://milw0rm.com/exploits/7909).
Rook
2010-05-16 08:09:28