Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a desire to make my own CMS , to improve my programming skills. I would use PHP as a server side programming language.

So my question is, on what security issues I must pay attention when programming ?

I am familiar with SQL injection and I'd use PHP prepared statments to resolve this.

Must I pay attention to any other dangeroues/fammiliar issue ?

Thanks

NOTE - I can't put CMS as a tag due to my reputation

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

The OWASP top ten is an important list to get under control, but it is necessarily a little vague and make be difficult to translate the generalized best-practices into coding suggestions.

A good rule to keep in mind is always assume your input is malicious, no matter where it comes from, as it can be difficult to imagine just how malicious input can be from even the most innocent of sources. Never assume that user-provided values are limited to the options you gave them to choose from, never assume that submitted content is limited to a given character set or content type.

I'd recommend using one of the many MVC frameworks for PHP, since they frequently provide things like modularity, routing, database abstraction, etc., which you would probably have to write yourself, and which are places mistakes frequently are made. At the very least, read other peoples' code and understand why they did what they did, and what sort of mistakes they're avoiding.

In fact, I'd recommend downloading several of these frameworks; CakePHP, CodeIgniter, Kohana, etc., and reading and understanding each component before you attempt to write your own. It may sound like a waste of time, but you'll actually waste less time and learn more and learn better practices if you focus more attention on learning other people's code rather than diving in and figuring it out yourself.

Also, as a bit of editorial addition, I'd really recommend against PHP if you have any other options at all; and this is coming from someone who's been programming in PHP since 1998. In the interest of security, sanity, performance, and maintainability, it's difficult to find a worse option than PHP. This has already been covered ad nauseum, so I'll say no more than just make a note here.

share|improve this answer
    
+1. I couldn't agree more. –  David Stratton Jan 22 '13 at 5:47
    
Thanks for such a detailed answer. I will look at the OWASP top 10 and the frameworks you recommended. What server side language would you advice me to use , based on your long programming experience ? I said PHP because it's is the most easiest to learn (I had some experience with C/C++ + MySQL and thats why i said PHP ). –  user19775 Jan 22 '13 at 8:01
add comment

This is too broad to answer fully, but I'd start with everything on the OWASP Top Ten. Then I'd go on and review the entire OWASP web site, and move on to the SANS institute's top 25

After you've read those and have a baseline understanding of all the web application threats and vulnerabilities, THEN start Googling "Secure PHP Coding". This was the first result and it's pretty solid.

I say to know the OWASP lists and the SANS lists first because some of the secure coding principles specific to PHP will make more sense once you understand the severity of the issues.

share|improve this answer
    
Thanks for the answer. I will look at OWASP and SANS link you gave me. And thanks for the "Secure PHP coding" link, I googled a lot but I didn't find that detailed page to explain PHP security. I would gave you +1 but my reputation is to low. When it increase, I will raise it! :) –  user19775 Jan 22 '13 at 8:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.