views:

78

answers:

3

My client needs a simple database CMS faster than I can tackle the ins and outs and security flaws of register globals, sql injection, and cookie filtering.

I installed phpMyEdit and secured the edit page with .htaccess. For the security experts, does this provide at least a moderate level of security?

A: 

It is a moderate level of security, yes.

The attack you need to be aware of is a brute-force attack where a bad guy tries different username and password combinations over and over. To fix this you can lock a user out after n (10 is reasonable) failed login attempts.

There are lots of ways to configure htaccess files as far as valid users go but depending on the source you are using be extra careful of there being any default or guest-type users that your htaccess would let in.

Collin
A: 

It all comes down to things that no one here has a way of knowing, like whether the passwords are secure or if you've bungled up somehow. If you want assurance that HTTP authenticating works, then yes, it does work. There's also more than way you can set it up, so just calling it "htaccess security" is ambiguous. All in all, simply make sure you haven't left any parts accessible to the public and that the passwords aren't "123" or "qwerty", and you'll be fine (probably).

Reinis I.
A: 

I also recommend to ip protect your protected directories or files for admin. Also I can't be OK with the automated programs, just you need more practice, you have to be aware about most used hacking tricks, just read more and more about sql injection and so forth... Good luck

George Garchagudashvili