Safe php coding

[Gazan]

Hey there.

 

Alright, i'm a PHP programmer who needs a lesson or two in programming SAFELY (so hackers can't injure). I've got loads of experience doing PHP scripts such as news system and all that.. But i never found out how to really code safely, so hackers can't get around my systems and such. Does anybody have links og anything to tutorials og walk-troughs that explains safe php coding, or can anybody give me some tips on how to code safely?

 

Thanks

[DeanWhitehouse]

There is one on the main site about security

[Gazan]

I can't seem to find it, woudl you link me?

[DeanWhitehouse]

http://www.phpfreaks.com/tutorial/php-security

[Gazan]

Alright, thanks for that

 

Also got another question.. If you wan't to create a CMS with an install file. How do you insert the input from the person who's going to set it up as the main mysql_connect details? you store the information in, what?

[Cosizzle]

nettuts had another good article on it some time ago

http://nettuts.com/tutorials/tools-and-tips/can-you-hack-your-own-site-a-look-at-some-essential-security-considerations/

 

[DeanWhitehouse]

On my CMS i started i used a file called config.inc.php which just stored variables like the database details.

[Gazan]

and how would i write the $_POST/$_REQUEST details into the .inc.php file?

[DeanWhitehouse]

fread, fwrite, fopen and fclose, but not in that order

[Gazan]

argh, alright. Thanks alot.

[Gazan]

Last question. How would i retrieve the info (db name, pass, user, host) in the .inc.php file from a php file that contains mysql_connect("$dbname, bla bla bla...");

[DeanWhitehouse]

so if the file was like

 

//config.inc.php file 
$db_name = "name";
//etc...

 

then you could do

$file = fopen("config.inc.php");
echo $db_name;

that should do it i think, not 100% so test it out

 

[Gazan]

Yeah, but problem is .. during the install i wan't to write the db name, db pass and db host TO the config.inc.file with a php script. I wan't to store value into the variables..

[redarrow]

look up sessions.

[Philip]

Sessions aren't the answer to everything. As much as you may think so, they aren't.

 

You could use file_get_contents(), perform the search & add in values, then file_put_contents().

 

Search for $db_name, $db_user, $db_pass, $db_table etc...

If the values exist

-change the values to the ones you want to set.

Otherwise (if they messed with the file before hand)

-insert them in

 

[uniflare]

if ur making a config file, just make the first page of the install file -> the creation of the config file...

 

 

Page 1-> Enter Configuration into a form, submit....

Page 2-> Save Configuration silently using fopen/fwrite/fclose, then include() the file, install the script.