Re: PHP security
| From: | Ron Brogden | Date: | Tue, 20 Feb 2001 20:50:21 +0000 |
| Subject: | Re: PHP security | ||
| References: | 1 | Groups: | php.db |
| Request: | Send a blank email to php-db+get-6793@lists.php.net to get a copy of this message | ||
At 01:50 PM 2/20/2001 -0600, you wrote:
As far as I know, you can not download PHP programs without access to download them. Meaning you need an account on the webserver, so they would need your account user and pass before they could steal your mysql user and pass.The main issue is that (especially under Unix), the Front Page server extensions are notoriously poorly written and in most cases leave massive security holes wide open. Try doing a Google search for "hacking frontpage" to see some examples. The real solutions are: do not host with a provider that supports Front Page do not use Front Page as your HTML editor If you do decide to use Front Page as your editor make sure that you do not let it (or immediately remove them) the "shadow" directories of _vti_cnf (there are others too which I forget) that it likes to include with uploads. As long as you avoid that pitfall and the server does not have the server extensions installed you should be safe. You should also place your sensitive values in a separate file that is located in a non-web accessible directory or if you are running under "safe mode", in a protected sub-directory. Under Apache you would just have to create a directory called something like "./include" and in it place a .htaccess file with the following line: deny from all This makes it so that the only way to access the file is via an include command within PHP. This won't save you from local users viewing the file but that is a different sack of nuts. Cheers -----------------------------------------------------------------------------
Island Net AMT Solutions Group Inc. Telephone: 250 383-0096 1412 Quadra Toll Free: 1 800 331-3055 Victoria, B.C. Fax: 250 383-6698 V8W 2L1 E-Mail: support@islandnet.com Canada WWW: http://www.islandnet.com/-----------------------------------------------------------------------------