[vc_row][vc_column][vc_column_text]
Disclaimer: Nothing is 100% secure and this article in no ways guarantees the security of your web application.
That being said, I would like to emphasize that even though nothing is 100% secure it is possible to make it harder for the attacker to do any harm. So in this article we’re going to look at some of the good practices to secure your PHP application.
Although it is not possible to cover the entire security aspects of securing a PHP application in a single article, I’ve tried my best to include the overall ideas that need to be implemented. Will write more detailed articles for every point in here in coming days.
[/vc_column_text][/vc_column][/vc_row][vc_row][vc_column][vc_column_text]
1. Sanitize and Validate User Inputs
In my experience majority of the attacks on PHP applications are successful only because the user inputs were not validated and sanitized. It is good to be paranoid and trust absolutely no one when it comes to accepting inputs. Not even in the admin section.
If you’re using any of the PHP frameworks like Laravel, CodeIgniter, PhalconPHP or Zend, there are functions built in to sanitize user inputs. But if you’re building an application using core PHP, it would make sense to write a method to accept raw input string and return sanitized safe string.
Besides sanitizing the user input, perform necessary validations on input strings wherever necessary.
For e.g., ensuring email address is in the for format [email protected] and does not contain any special symbols.
Just by having proper sanitization and validation rules in place, you can make it harder for an attacker to perform following attacks:
- SQL Injection
- Cross Site Scripting (XSS)
- Cross Site Request Forgery (CSRF)
[/vc_column_text][vc_column_text]
2. Secure Query Execution
There are 2 main techniques to securely execute queries and prevent SQL injection:
a. Escape Quotes
It is important that you escape the quotes in inputs passed to the SQL query. If you’re using MySQL, you can use mysqli_real_escape_string() to get a string compatible with MySQL.
b. Prepared Statements
Prepared queries are the best way to avoid SQL injection attacks because prepared statements are like compiled templates to execute a query.
Values are passed into the compiled template and if they don’t match the placeholders in the template, SQL query fails.[/vc_column_text][vc_column_text]
3. File Permissions
Setting proper permissions and ownership to files and folders can prevent them from being accessed by unauthorized user.
- Never ever use 777 for folders containing file uploads. Instead use 755.
- Use 644 for all other (including php) files.
[/vc_column_text][vc_column_text]
4. File Uploads
I believe majority of the PHP applications at some point require file uploads funtionality to be implemented. For e.g., to upload profile picture of a user.
Although it may seem like a fairly simple task, it carries significant security risk if the file is not validated before storing it.
The most basic thing you can do is check if the file extension is valid for a particular file upload or not. For e.g., Only .jpg, .jpeg, .png should be allowed for profile picture and other extensions should be banned.
As a form of additional security measure, create a .htaccess file in your “uploads” folder and put the following content in it. This will prevent any PHP file inside the “uploads” from executing.
<Files *.php> deny from all </Files>[/vc_column_text][vc_column_text]
5. Regenerate Session IDs
[/vc_column_text][vc_column_text]
6. Implement Web Application Firewall
[/vc_column_text][vc_column_text]
7. Activate mod_security module for Apache2
[/vc_column_text][/vc_column][/vc_row]
