PHP Coding Good Practice - Info

[mds1256]

Hi

 

I am looking to develop a public facing website and would like some good practice info on php, what you should and shouldnt do and which way to do things, e.g. for security and efficiency, etc.

 

I have read through the PHP security guide from the PHP Security Consortium and was really good, does any one have any more info like this regarding PHP and general good practice

 

Thank you

[cyberRobot]

Utilize comments throughout your code.

Comments can be very helpful when editing the code down the road. I don't know how many time I've come across code and thought "OK, what was I doing here?" Comments also make it easier for others to understand your code if the website gets turned over to someone else.

 

 

Take care with naming your variables, database tables, filenames, etc.

Let's say you wanted to name something class. If you every need to search for all mentions of "class", you'll likely get a lot of bad matches. Especially since the class attribute is commonly utilized if you're using CSS.

 

 

Don't be afraid to ask for help.

PHP Freaks is an excellent resource if you have any questions.

[KevinM1]

Hi

 

I am looking to develop a public facing website and would like some good practice info on php, what you should and shouldnt do and which way to do things, e.g. for security and efficiency, etc.

 

I have read through the PHP security guide from the PHP Security Consortium and was really good, does any one have any more info like this regarding PHP and general good practice

 

Thank you

 

Do you have any specific questions?  Or anything you're lacking confidence in?

 

Good rule to follow: never use the 'global' keyword.

[fugix]

always validate forms that will have user input...to protect against SQL injection

[mds1256]

Do you have any specific questions?  Or anything you're lacking confidence in?

 

Good rule to follow: never use the 'global' keyword.

 

 

Was just looking for generic should know stuff.

 

Had a question around mysql queries, one of the things I have to implement is to log all access attemps to an audit table within the database.

 

So from the login page the php will run 2 queries, one checking (selecting) the details against the ones in the database and also at the same time logging them details (username, attempt time, ip address and authentication result).

 

The only way I can see to do this is to have multiple mysql_query()'s happening.

 

Is this ok to do or is there a better way of doing this?

 

Thanks you for all the replies! Will all come in handy

[fugix]

there are probably ways to combine the queries...but i would use two as to not confuse one from the other

[mds1256]

there are probably ways to combine the queries...but i would use two as to not confuse one from the other

 

Ok thanks.

 

Also what about mysql_connect(), should i open a connection at the top of each page or open and close in each function?

 

I have read that once the page has loaded any way that the connection ends?

[fugix]

i find it to be a good practice to use mysql_close() at the end of each page for better security..i suppose that you could also close it after the each coding line that you are finished using it..seems a bit tedious though

[KevinM1]

Connections are closed at the end of script execution automatically.  This generally means at EOF.  For more, see: mysql_close

[PFMaBiSmAd]

And closing a connection has nothing to do with security, better security, worse security, or any other kind of security.

[mds1256]

What about sessions?

 

My idea is that when someone logs in it keeps there details in a session, which will be used for queries.

 

e.g.

 

username so when I select i can use the username from the session in the where clause.

 

What about storing passwords (Salted and md5 hash) in a session, should I be doing this?

 

And is it ok to pass user details like the above into my custom functions e.g.

 

function getDetails($username, $password)
{
       .............................
}

[cssfreakie]

I can really recommend a little booklet by Chriss Shiflett.

http://www.amazon.com/Essential-PHP-Security-ebook/dp/B0026OR358/ref=sr_1_6?ie=UTF8&qid=1303986860&sr=8-6

 

It's a book abut php and security. worth the read!

[mds1256]

I can really recommend a little booklet by Chriss Shiflett.

http://www.amazon.com/Essential-PHP-Security-ebook/dp/B0026OR358/ref=sr_1_6?ie=UTF8&qid=1303986860&sr=8-6

 

It's a book abut php and security. worth the read!

 

Thanks!

 

Have ordered it, will give it a read

[cssfreakie]

nice! will be worth it