Re: Security?
At 19:05 7/4/2001, sterling hughes wrote the following:
--------------------------------------------------------------
>On 03 Jul 2001 19:13:20 -0700, Rasmus Lerdorf wrote:
>> On 4 Jul 2001, sterling hughes wrote:
>> > Ah well, I'm guessing most people have already seen this, still, I
>> > couldn't help passing it along... There are some good points (nothing
>> > we haven't discussed before) and some pretty bad points as well.
>>
>> A lot of these are rather silly and are actually present in other
>> scripting languages when they are used in a web environment. Most of it
>> boils down to the fact that you cannot trust user data. The fact that
>> user data is easier to get at in PHP doesn't really change the model.
>> Making it harder to get the user data doesn't help if this data is still
>> not checked and used incorrectly once you do get it.
>>
>> But, I do think it would be worthwhile to go through these and add a
>> section to the documentation highlighting the pitfalls and explaining how
>> to avoid them.
>>
>
>I think the main point I agree with is that since many beginning users
>use PHP to implement there websites, PHP should be more secure than
>other languages, and have less places where the user can mess up. I
>think the security section to the documentation is a superb start,
>however, I also think that PHP5.0 since we are breaking language compat,
>perhaps we should turn off register_globals by default? I just see to
>many chances for fscking up things big time when using that
>functionality....
I think the comment in php.ini could stress the security threat more.
St. like "Setting this on is a huge security risk." in all-caps. Plus
it should mention that requiring register_globals on makes the code
non-portable.
cynic@mail.cz
-------------
And the eyes of them both were opened and they saw that their files
were world readable and writable, so they chmoded 600 their files.
- Book of Installation chapt 3 sec 7
Thread (11 messages)