Re: Security Issue Query.......

> Security Issue Query....... > > Having read the bulk of the posts over the last several days, re: > security issues, I find myself in a state of confusion. > > I've got four sites going up in the next two months and have moved all > of them over to php with MySQL. I've taken what I believe are the usual > security steps..now what I believe may not be true. > > My question is: anyone have a url for a site that deals with security > issues, particularly as these issues relate to php...I'm working off a > hosting service...which may complicate matters. It all boils down to one thing. Do not trust anything that comes from the remote browser. If you are doing anything that could potentially be a security problem like calling system(), exec(), popen(), or copy() then walk backwards from those calls and check where the argument data is coming from. If they are somehow coming from user-supplied data in any way, make sure you clean it thoroughly. The recent file upload issue only applies if you have a script that is receiving a file upload and does a copy() of the uploaded file into your web space. Secure examples of how to handle file uploads will be added to http://www.php.net/manual/features.file-upload.php soon. There is one validation check example there already. -Rasmus