Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

First time posting here; apologies for any mistakes I've made, please edit, retag, migrate as appropriate.

I have a simple homepage whose purpose is (essentially) to contain my contact info and some pdf's. Over time this has become a bit of a side project for me, adding content and making it fancier with Javascript and PHP, though only using a microscopic piece of what they can do: include one file in another file, change this div's background, get the current date, etc. I recently used my first $_GET.

In the interests of documenting my work, satisfying the curiosity of anyone who wants to look at my amateur code, possibly getting feedback on how to improve things, and just general openness, I am thinking of discussing, or otherwise making visible,

  • the PHP code I've used
  • the inner structure of my public_html folder on my department's server
  • (am I correct that any Javascript I use is necessarily going to be visible?)

However, I am concerned that this would open my website, or the server overall, to attack. Since my website does not take user input anywhere, I feel secure, but I'd like to be sure before proceeding.

If it would help in your analysis, I can give a list of the PHP and Javascript functions I have used so far.

share|improve this question
1  
I don't have the time to formulate a full answer right now, but the better way to share your code will be to use a service like GitHub. –  Terry Chia Aug 18 '13 at 15:26
add comment

1 Answer

You have made a small mistake. Your web server does take user input. In the URL bar. If you have not configured PHP securely then this is a serious security issue.

Risks include having your code compromised or website defaced.

share|improve this answer
    
+1: Thanks for your answer, and I do see your point. Though I have my permissions set in my public_html folder, I am not sure what I can do to make my code secure. Would you recommend any resources for a novice like me that give tips or list common mistakes? –  Zev Chonoles Aug 18 '13 at 15:53
    
(I have looked around, but many resources are aimed at sites that are doing much more advanced things than I am, and it's difficult to distill any information to how it would apply to me.) –  Zev Chonoles Aug 18 '13 at 16:04
    
PHP is securable, but it is quite difficult as it was not designed to be secure but easy to use. I don't think we have a php hardening question here yet. –  Rory Alsop Aug 18 '13 at 16:24
    
Related PHP security bug: eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823 –  Evan Teitelman Aug 19 '13 at 0:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.