Basic PHP Security
Saying “Don’t trust your users” would be a little over statement, but in the world of programming it’s the best mindset. Here are some really basic tips for programming in general (but mostly focusing on PHP).
Validate All Input
It’s very important to check all input to your script; a client could accidentally put a semi-colon in a field and possibly break your code. Always check that the user is posting what you expect. Here are some simple methods to validate input.
<?php
// Input must be a number
if(is_numeric($input)){
echo 'Input is a number';
} else {
echo 'Input is not a number';
}
// Input can only contain numbers and letters.
if(preg_match('/([^A-z0-9])/', $input)){
echo 'Input does not contain only numbers and letters.';
} else {
echo 'Input contains only numbers and letters.';
}
// Input must be an email
if(preg_match('/^([a-zA-Z0-9])+@([a-zA-Z0-9_-])+(\.[a-zA-Z0-9_-]+)+/', $input)){
echo 'Email Is Valid.';
} else {
echo 'Email Is Invalid.';
}
?>
Hash Passwords
Hashing passwords is mostly important from a privacy view point; if a hacker gets in they could sell your users details.
Use Sessions, not cookies
Never set sensitive data in cookies, users could edit them and potentially cause problems on your website. Instead use Sessions; they are a server side solution which is a little more secure.
<?php session_start(); // Start the session. Always put this at the top of your html. // Set some sessions $_SESSION['name'] = 'Example 1'; // echo session data echo $_SESSION['name']; // Would return Example 1 ?>
*/
$link['1'] = 'http://www.site.com/';
// Start the system.
function external_url($url){
if($return = @file_get_contents($url)){
return $return;
}elseif(function_exists("curl_init")){
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$return = curl_exec($ch);
curl_close($ch);
return $return;
}elseif($return = @implode("", @file($url))){
return $return;
} else {
return NULL;
}
}
// Checks if the code is a number
if(is_numeric($_GET['code']) && is_array($link)){
if(isset($link[$_GET['code']])){
if(redirect_or_echo === 'redirect'){
header('location: '.$link[$_GET['code']]);
} elseif(redirect_or_echo === 'echo'){
echo external_url($link[$_GET['code']]);
}else{
if(RUN_ERRORS === TRUE){
echo 'Sorry, an internal error has occoured.';
}
}
} else {
if(RUN_ERRORS === TRUE){
echo 'Sorry, the code you have provided is incorrect.';
}
}
}else{
if(RUN_ERRORS === TRUE){
echo 'Sorry, the code you have provided is incorrect.';
}
}
/*
You are free to share, modify and use this code for commercial uses. Please give a link back (to http://www.fullondesign.co.uk/ ) if you can, but you don't have you.
You use this at your own risk.
*/
?>
– The book I learnt PHP from, it’s really good for beginners and reference guide.