5 PHP Security Measures

For many years, PHP has been a stable, cheap platform on that to control web-based applications. Like most web-based platforms, PHP is liable to external attacks. Developers, database architects and system administrators ought to take precautions before deploying PHP applications to a live server. Most of those techniques will be accomplished with a couple of lines of code or a small adjustment to the applying settings.

#1: Manage Setup Scripts :

If the developer has put in a collection of PHP scripts from a third-party application, the scripts the application uses to put in the operating parts can even offer an access point to unscrupulous users. Most suppliers of third-party packages suggest removing the directory containing the setup scripts shortly when installation. For developers who want to retain the setup scripts, they will produce an .htaccess file that controls access to the administrative directories.

AuthType Basic
AuthName “Administrators Only”
AuthUserFile /usr/local/apache/passwd/passwords

Require valid-user


Any unauthorized user who makes an attempt to observe a protected directory can see a prompt for a username and password. The password should match the allotted password laid out in the “passwords” file.

#2: include Files

In several instances, developers might use a private file in many parts of an application. These scripts can contain an “include” directive that includes the code of the individual file into that of the originating page. once the “include” file contains sensitive info, as well as usernames, passwords or database access keys, the file ought to have a “.php” extension, instead of the everyday “.inc” extension. The “.php” extension insures that the PHP engine can process the file and stop any unauthorized views.

#3: MD5 vs. SHA

In things wherever finish users produce their own usernames and passwords, website administrators can usually embrace include to encode the parole password before the shape submits the form field entry to the database field. In past years, developers have used the md5 (Message Digest algorithm) function to encode passwords into a 128-bit string. Today, several developers use the SHA-1 (Secure Hash Algorithm) function to form a 160-bit string.

#4 Automatic global Variables

The php.ini file contains a setting referred to as “register_globals”. once the register_globals setting is on, the PHP server can produce automatic global variables for several of the server’s variables and query strings. once putting in third-party packages, like content management software system like Joomla and Drupal, the installation scripts can direct the user to line register_globals to “off”. dynamic  the setting to “off” insures that unauthorized users cannot access data by dead reckoning the name of the variable that validates passwords.

#5 Initialize Variables and Values


Many developers have fallen into the lure of instantiating variables while not process their values, either because of time constraints, distractions, or lack of effort. Variables that validate the authentication method ought to have values instantiated before the login procedure begins. this easy step will forestall users from bypassing the verification routine or accessing areas of the site to that their privileges don't entitle them.