StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>The solution that PHP experts have come up with is to use unique keys/tokens with each submission of the forms, <strong><a href="http://net.tutsplus.com/tutorials/php/secure-your-forms-with-form-keys/" rel="nofollow noreferrer">have a look at the idea here at net-tutes</a></strong>.</p> <p><strong><a href="http://phpsec.org/projects/guide/1.html" rel="nofollow noreferrer">Don't forget have a look at the PHP Security Guide.</a></strong>. It covers topics including XSS, Form Spoofing, SQL Injection, session hijacking, session fixation and more.</p> <p>Remember, always use proper data types in your queries, for example use the <code>int</code> or <code>intval</code> function before numbers and <code>mysql_real_escape_string</code> function for the string values. Example:</p> <pre><code>$my_num = (int) $_POST['some_number']; $my_string = mysql_real_escape_string($_POST['some_string']); </code></pre> <p><strong><a href="http://php.net/manual/en/function.mysql-query.php" rel="nofollow noreferrer">You may also use the prepend statements for your queries.</a></strong></p> <p><strong>Popular Project To Secure PHP Applications:</strong></p> <ul> <li><strong><a href="http://svn.bitflux.ch/repos/public/popoon/trunk/classes/externalinput.php" rel="nofollow noreferrer">XSS Filtering Functions by Christian Stocker</a></strong> (Also used by <strong><a href="http://kohanaphp.com/" rel="nofollow noreferrer">Kohana framework</a></strong>)</li> <li><strong><a href="http://htmlpurifier.org/" rel="nofollow noreferrer">HTML Purifier</a></strong> (Also used by <strong><a href="http://kohanaphp.com/" rel="nofollow noreferrer">Kohana framework</a></strong>)</li> <li><strong><a href="http://code.google.com/p/osap/" rel="nofollow noreferrer">OSAP PHP Security Project</a></strong></li> </ul>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload