Re: Security Issue Query.......

Saw the article this evening. Thanks for the input and help. Appreciate it. ken Randall Goguen wrote: > > Actualy I posted an article on this August 16 > > Securing file uploads under PHP > http://www.linuxguruz.org/z.php?id=320 > > Contributed by Martin Sarsale (aka runa) > > On Tue, 5 Sep 2000, Rasmus Lerdorf wrote: > > > > Security Issue Query....... > > > > > > Having read the bulk of the posts over the last several days, re: > > > security issues, I find myself in a state of confusion. > > > > > > I've got four sites going up in the next two months and have moved all > > > of them over to php with MySQL. I've taken what I believe are the usual > > > security steps..now what I believe may not be true. > > > > > > My question is: anyone have a url for a site that deals with security > > > issues, particularly as these issues relate to php...I'm working off a > > > hosting service...which may complicate matters. > > > > It all boils down to one thing. Do not trust anything that comes from the > > remote browser. If you are doing anything that could potentially be a > > security problem like calling system(), exec(), popen(), or copy() then > > walk backwards from those calls and check where the argument data is > > coming from. If they are somehow coming from user-supplied data in any > > way, make sure you clean it thoroughly. > > > > The recent file upload issue only applies if you have a script that is > > receiving a file upload and does a copy() of the uploaded file into your > > web space. > > > > Secure examples of how to handle file uploads will be added to > > http://www.php.net/manual/features.file-upload.php soon. > > There is one > > validation check example there already. > > > > -Rasmus > > > > > > -- > > PHP General Mailing List (http://www.php.net/) > > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > > For additional commands, e-mail: php-general-help@lists.php.net > > To contact the list administrators, e-mail: php-list-admin@lists.php.net > >