Essential PHP Security: A Guide to Building Secure Web Applications

Chris Shiflett

Oct 2005 · "O'Reilly Media, Inc."

About this ebook

Being highly flexible in building dynamic, database-driven web applications makes the PHP programming language one of the most popular web development tools in use today. It also works beautifully with other open source tools, such as the MySQL database and the Apache web server. However, as more web sites are developed in PHP, they become targets for malicious attackers, and developers need to prepare for the attacks.

Security is an issue that demands attention, given the growing frequency of attacks on web sites. Essential PHP Security explains the most common types of attacks and how to write code that isn't susceptible to them. By examining specific attacks and the techniques used to protect against them, you will have a deeper understanding and appreciation of the safeguards you are about to learn in this book.

In the much-needed (and highly-requested) Essential PHP Security, each chapter covers an aspect of a web application (such as form processing, database programming, session management, and authentication). Chapters describe potential attacks with examples and then explain techniques to help you prevent those attacks.

Topics covered include:

• Preventing cross-site scripting (XSS) vulnerabilities
• Protecting against SQL injection attacks
• Complicating session hijacking attempts

You are in good hands with author Chris Shiflett, an internationally-recognized expert in the field of PHP security. Shiflett is also the founder and President of Brain Bulb, a PHP consultancy that offers a variety of services to clients around the world.

Ratings and reviews

I'm a professional PHP developer at an "enterprise level" business. I have been to security-related seminars and receive regular boring lectures on the subject. I try to keep up to date with security-related exploits and always have an eye toward better coding practices to strengthen the code the team is writing. This includes reading various books on the subject. This book really nails it. The subject matter is covered thoroughly and simply. Code examples illustrate common problems in code and Chris writes about how one could implement procedures to make sure that your software stays as secure as possible. It's finally a good book on the topic and I'm really happy I stumbled upon it. It is written with PHP in mind, but all server-side languages are vulnerable to the same exploits listed in here and the development practices that are suggested would apply to your favorite language as well. It's somewhat of a short book and the lessons seem to be repetitious after a while, but since most of the web app security holes are based on improper handling of data, I can see how things start to sound the same after a bit. This isn't a reason to not buy this book! For various attack vectors and because of the same silly holes that people leave in their code, the mistakes that us mere mortals make are also repetitious. I guess we need the lesson really drilled into us before it becomes a core part of our coding practices. I will be recommending this book to people on my team and we will cover lessons from it in our monthly meetings where we can talk about the development procedures we have in place and how to improve code quality overall.