Main Content
Learning to write secure, maintainable PHP Archive - Originally posted on "The Horse's Mouth" - 2007-01-25 07:59:41 - Graham Ellis
We're running a PHP course this week, and as ever I went around the room on the first day checking with the delegates what their "hot points" were, noting them on a board to the side to ensure that all the points ARE covered.
Security and maintainabily came up. And came up strong. Duly noted on the board, and aspects were covered right from the start of the course. These are vital subjects and it's no good at all learning just the mechanisms of PHP without being aware of these issues. You can write a dog's dinner in which all manner of traps could lurk, or you can produce a Picasso - and you should plan which from the very first paint stroke on the canvas!
So I'm delighted that my delegates are concerned about ... security, maintainability, fitness for purpose, usability, extensability. It tells me that they're on the right PHP course , and it's a pleasure to have their early inputs.
Some other articles
H117 - Security in PHP A small teaching program - demonstration of principles only Injection Attacks - PHP, SQL, HTML, Javascript - and how to neutralise them An easy way to comply with the new cookie law if your site is well designed How to stop forms on other sites submitting to your scripts Catchable fatal error in PHP ... How to catch, and alternative solutions such as JSON Protecting your images from use out of context Security considerations in programming - what do we teach? An example of an injection attack using Javascript Injection Attack if register_globals in on - PHP Injection Attacks - avoiding them in your PHP Who is watching you? Defensive coding techniques in PHP? PHP - Sanitised application principles for security and useability Are nasty programs looking for security holes on your server? A story about benchmarking PHP Using PHP to upload images / Store on MySQL database - security questions Error logging to file not browser in PHP Easy handling of errors in PHP Injection attacks - safeguard your PHP scripts This article What is an SQL injection attack? A lion in a cage - PHP Robust checking of data entered by users Spotting a denial of service attack H115 - Designing PHP-Based Solutions: Best Practice Real life PHP application using our course training MVC example Using an MVC structure - even without a formal framework Learning to program - comments, documentation and test code We not only teach PHP and Python - we teach good PHP and Python Practice! Even early on, separate out your program from your HTML! Filtering PHP form inputs - three ways, but which should you use? PHP sessions - a best practice teaching example Injection Attacks - PHP, SQL, HTML, Javascript - and how to neutralise them Separating program and artwork in PHP - easier maintainance, and better for the user How to build a test harness into your PHP Not just a PHP program - a good web application Adding a newsfeed for your users to a multipage PHP application Improving the structure of your early PHP programs Refactoring - a PHP demo becomes a production page Defensive coding techniques in PHP? PHP Techniques - a workshop Short and sweet and sticky - PHP form input Software to record day to day events and keep an action list Efficient PHP applications - framework and example A story about benchmarking PHP Ordnance Survey Grid Reference to Latitude / Longitude Converting from postal address to latitude / longitude Controlling and labelling Google maps via PHP Using a MySQL database to control mod_rewrite via PHP Easy handling of errors in PHP Resetting session based tests in PHP Drawing hands on a clock face - PHP Painting a masterpiece in PHP Good Programming practise - where to initialise variables Back button - ensuring order are not submitted twice (PHP) This article Maintainable code - some positive advice Code quality counts Global, Superglobal, Session variables - scope and persistance in PHP PHP - good coding practise and sticky radio buttons Reporting on the 10 largest files or 10 top scores Giving the researcher power over database analysis Merging pictures using PHP and GD Robust checking of data entered by users A year on - should we offer certified PHP courses Code and code maintainance efficiency Putting a form online Crossfertilisation, PHP to Python Short underground journeys and a PHP book