Saying “Don’t trust your users” would be a little over statement, but in the world of programming it’s the best mindset. Here are some really basic tips for programming in general (but mostly focusing on PHP).
Validate All Input
It’s very important to check all input to your script; a client could accidentally put a semi-colon in a field and possibly break your code. Always check that the user is posting what you expect. Here are some simple methods to validate input.
<?php
// Input must be a number
if(is_numeric($input)){
echo 'Input is a number';
} else {
echo 'Input is not a number';
}
// Input can only contain numbers and letters.
if(preg_match('/([^A-z0-9])/', $input)){
echo 'Input does not contain only numbers and letters.';
} else {
echo 'Input contains only numbers and letters.';
}
// Input must be an email
if(preg_match('/^([a-zA-Z0-9])+@([a-zA-Z0-9_-])+(\.[a-zA-Z0-9_-]+)+/', $input)){
echo 'Email Is Valid.';
} else {
echo 'Email Is Invalid.';
}
?>
Hash Passwords
Hashing passwords is mostly important from a privacy view point; if a hacker gets in they could sell your users details.
Use Sessions, not cookies
Never set sensitive data in cookies, users could edit them and potentially cause problems on your website. Instead use Sessions; they are a server side solution which is a little more secure.
<?php session_start(); // Start the session. Always put this at the top of your html. // Set some sessions $_SESSION['name'] = 'Example 1'; // echo session data echo $_SESSION['name']; // Would return Example 1 ?>
The phrase “You what now?” comes to mind.
Few users will find this test hard
24/7 support which is offline, this could confuse users.