Re: Security Issue Query.......

Actualy I posted an article on this August 16 Securing file uploads under PHP http://www.linuxguruz.org/z.php?id=320 Contributed by Martin Sarsale (aka runa) On Tue, 5 Sep 2000, Rasmus Lerdorf wrote: > > Security Issue Query....... > > > > Having read the bulk of the posts over the last several days, re: > > security issues, I find myself in a state of confusion. > > > > I've got four sites going up in the next two months and have moved all > > of them over to php with MySQL. I've taken what I believe are the usual > > security steps..now what I believe may not be true. > > > > My question is: anyone have a url for a site that deals with security > > issues, particularly as these issues relate to php...I'm working off a > > hosting service...which may complicate matters. > > It all boils down to one thing. Do not trust anything that comes from the > remote browser. If you are doing anything that could potentially be a > security problem like calling system(), exec(), popen(), or copy() then > walk backwards from those calls and check where the argument data is > coming from. If they are somehow coming from user-supplied data in any > way, make sure you clean it thoroughly. > > The recent file upload issue only applies if you have a script that is > receiving a file upload and does a copy() of the uploaded file into your > web space. > > Secure examples of how to handle file uploads will be added to > http://www.php.net/manual/features.file-upload.php soon. There > is one > validation check example there already. > > -Rasmus > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > For additional commands, e-mail: php-general-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net >