When you start tinkering always have a two thoughts in mind: security of your applications and usability for the end user. Too many programmers think, "build it first, cash the check, then make it secure, let the designers worry about all that other stuff." Somehow they never seem to get around to point #3 until it's too late, and many don't even bother with #4.
The documentation on making your applications secure is in the billions, I think, there is no one resource.
here's one [webmasterworld.com] that touches on it, but if I were to boil it down to two items:
In the words of Selena Sol,
every user input is a potential hack. This means query strings, form input, or Javascript used to do either, treat incoming data like the poison it is. Filter it well, and thoroughly.
So how do you begin to do that?
Allow only the input you expect, and throw everything else away. This concept is deceptively simple, but it's often incredibly tedious or in cases of multiple language support with variable data content, incredibly complex. But it must be done, don't short cut it.
An example, if you expect
query-database.php?article=1234
Accept data only from $_GET, not $_POST or $_REQUEST, and make sure it's a number. If it has other restrictions, like
user-private-details.php?user=1234
You should have other internal devices (sessions, cookies, lookups) that verify this is not an attempt to access someone else's account.
"None of our users will do any of that, it won't be a problem." It's not your ordinary users you have to worry about. There are people on the 'net who have nothing better to do than ruin your day, just because
they can. The last bit of advice,
make your applications valid and usable. Check your output against a validator, this really is important.
An example of "usable": instead of
- accept input
- cleanse input
- if error, echo and quit, forcing use of the back button
- sent email
- redirect to "thankyou.html"
A better experience for the end user is something like
- accept input
- cleanse input
if error,
return to form with a helpful error message and all form values retained - send email
- output a personalized email directly from this script, with helpful links to continue exploring the site.
Good server side programming is not just about learning PHP, it's an understanding of web standards, cross browser compatibility, usability, and accessibility. Explore them all.
