Form security

[adam291086]

Hello,

 

I am creating an app for public use. I was after some advice on form security to prevent code injections and 100% secure.

 

Also what are peoples thoughts on passing information through URL's. i.e www.example.com?id=1. Should this information be encrypted or just left?

 

 

[dzelenika]

Hello,

 

I am creating an app for public use. I was after some advice on form security to prevent code injections and 100% secure.

 

Also what are peoples thoughts on passing information through URL's. i.e www.example.com?id=1. Should this information be encrypted or just left?

 

Anyhow You should use HTTPS to solve encription problems

I recommend PDO (PHP Data Object) for SQL Injection problems solving.

[awpti]

Don't rely on usage of PDO for XSS/Injection/security inspection.

 

You should ALWAYS verify and escape an data about to be hurled into a database.

 

It's fairly safe to run every query through mysql_real_escape_string(), but beyond that, you should always verify incoming data.

 

Should something be only a digit?

 

if(ctype_digit($var))
{
    //yay!
}
else
{
   //oh noes!
}

 

Etc, etc. Make sure the input is exactly what you expect. NEVER EVER trust input. No matter the source (even your own scripts should double and triple check themselves).