views:

221

answers:

2

Know any good courses, online or perhaps otherwise, you'd recommend to a relatively new PHP/MySQL web developer to get her up to speed on security vulnerabilities? It would be nice if it was fairly thorough and went beyond basic stuff like sql injection. Ideas?

Edit: Thanks for the really great links and information, but I'm also looking for a course, something to give her a running start. Courses? I've looked at the Zend Security Training online course specifically, but I wonder if there are other ones as well.

+2  A: 

This is your guide: http://www.owasp.org/index.php/Top_10_2007

cherouvim
+2  A: 

I would recommend that you take a look at this question on PHP security issues.

phpsec.org is pretty thorough in the sense that you can gain a good sense of what vulnerabilities are native to developing in the PHP environment.

The PHP Security Manual is also a good beginning point.

Depending on what web server stack you're developing on (LAMPP, ISS, or other) you'll want to investigate how to properly secure files so that your PHP files can only be executed and not downloaded as well as ensure that other files (like config files) are in directories that cannot be read publicly.

I just ran this search for information on securing Apache and got back a number of promising results.

Edit: Any of the Zend courses is going to provide a great head start. In fact, if you're seriously considering that direction then I would strongly recommend that you consider the Zend PHP Certification and the Zend Framework Certification as the most solid training courses a PHP developer can attain. In case you're not familiar with the relationship, getting a Zend certification for anything PHP related is like getting a Microsoft certification for C# or VB.net.

That said, there's a certain amount of debate on the actual end value of certifications. I would strongly recommend that you purchase Chris Shiflett's Essential PHP Security. He's lovingly touted by many PHP developers as the guy who has done more than anyone else to dispel the “don’t use PHP because it’s insecure” myth.

Noah Goodrich