PHP script security resources?

[Douglas Rasor]

I have just recently started playing around with some minor PHP scripts and so far so ok:)

Last month I heard about some PHP forums getting attacked and their databases being comprimised.

While I am not planning on doing a forum it did get me concerned.

Does anybody have any links to articles or resources where I could study up on protecting my PHP scripts and the MYSql database? I am doing a website for a real estate office and want to use the scripts and database for emailed newletters and also for letting the user search for some property listings. Nothing with any type of monetary transactions so it would not be the end of the world if I did get comprimised. Just don't want to lose listings that were put in the database and have any scripts modified by some hacker.

Thanks
Douglas Rasor

[WebSavvy]

Put the mysql connection info into a php page on it's own.

Put the at sign @ in front of the @ mysql connection info.

Put the connection file into a folder that will not be used for anything other than holding the mysql connection codes.

If possible, place this folder above root and call it that way. If it must be in public_html root for lack of access to create folders above root, place an .htaccess file in the folder to prevent average joe from gaining access.

Call the db connection file through an include in your script.

In your forms, make sure you've disallowed special characters to be inserted. If they're necessary for query purposes, use addslashes / stripslashes in the backend before query execution is displayed.

You can add some code to the page itself to get the http referrer. If it's not from the page you've listed, deny access.

There's probably more I can list here later. These are just off the top of my head.

You can read up on different PHP related stuff at devshed, codewalkers, and the official PHP site.

[Douglas Rasor]

Thanks for the tips savvy1, I will research this information. I did find a free set of php scrpts and xml to use as a starting off point. I guess that I will spend a couple of days seeing if I can figure out what it is doing.

:confused:

Thanks