CMS security issues

Question

I have a desire to make my own CMS , to improve my programming skills. I would use PHP as a server side programming language.

So my question is, on what security issues I must pay attention when programming ?

I am familiar with SQL injection and I'd use PHP prepared statments to resolve this.

Must I pay attention to any other dangeroues/fammiliar issue ?

Thanks

NOTE - I can't put CMS as a tag due to my reputation

Answer 1

The OWASP top ten is an important list to get under control, but it is necessarily a little vague and make be difficult to translate the generalized best-practices into coding suggestions.

A good rule to keep in mind is always assume your input is malicious, no matter where it comes from, as it can be difficult to imagine just how malicious input can be from even the most innocent of sources. Never assume that user-provided values are limited to the options you gave them to choose from, never assume that submitted content is limited to a given character set or content type.

I'd recommend using one of the many MVC frameworks for PHP, since they frequently provide things like modularity, routing, database abstraction, etc., which you would probably have to write yourself, and which are places mistakes frequently are made. At the very least, read other peoples' code and understand why they did what they did, and what sort of mistakes they're avoiding.

In fact, I'd recommend downloading several of these frameworks; CakePHP, CodeIgniter, Kohana, etc., and reading and understanding each component before you attempt to write your own. It may sound like a waste of time, but you'll actually waste less time and learn more and learn better practices if you focus more attention on learning other people's code rather than diving in and figuring it out yourself.

Also, as a bit of editorial addition, I'd really recommend against PHP if you have any other options at all; and this is coming from someone who's been programming in PHP since 1998. In the interest of security, sanity, performance, and maintainability, it's difficult to find a worse option than PHP. This has already been covered ad nauseum, so I'll say no more than just make a note here.

Answer 2

This is too broad to answer fully, but I'd start with everything on the OWASP Top Ten. Then I'd go on and review the entire OWASP web site, and move on to the SANS institute's top 25

After you've read those and have a baseline understanding of all the web application threats and vulnerabilities, THEN start Googling "Secure PHP Coding". This was the first result and it's pretty solid.

I say to know the OWASP lists and the SANS lists first because some of the secure coding principles specific to PHP will make more sense once you understand the severity of the issues.