The secure-coding tag has no wiki summary.
-3
votes
0answers
44 views
User entered Javascript security implications [duplicate]
I'm creating a web site that lets people create their own site using a subdomain. Are there any security implications by letting people add custom javascript to their pages? If so, which ones? XSS? ...
-4
votes
3answers
88 views
Database connection from front end
I want to know why calling a database from the front end is considered a bad practice for security.
It is really so bad as to justify building an application layer with all its drawbacks: costs, ...
-1
votes
0answers
34 views
How to block WCF services using Firewall or any other security setting
For an application testing purpose I want to know how to block applications that are trying host http WCF host services. Could someone please point me the right place to block? I've been guessing and ...
0
votes
2answers
100 views
Does excluding username letters from passwords increase security?
Recently I was asked to change a password, along with a password policy which reqires you to use a digit, a special character and a letter, but forbids any letter from you log in name to be used for ...
-1
votes
1answer
144 views
can someone break my anti dom based xss from the window location? [closed]
can someone break my anti dom based xss from the window location ?
function parseparameters()
{
var href = window.location.href;
var id = href.indexOf('#');
if (id ...
6
votes
3answers
220 views
Setting a limit on password recovery attempts
in a setting where one has forgotten their password, I'd like to be able to limit the attempts of entering in email addresses to something like 10. My first thought was to use a cookie.
$attempts = ...
2
votes
3answers
143 views
is it safe to allow external images to be attached to Blog or any Web content?
I am filtering all images that attached to any content of my blog:
Check for file extension.
Check content type using $finfo = finfo_open(FILEINFO_MIME_TYPE);
I also save the image temporary on my ...
4
votes
1answer
151 views
What are possible consequences for applications that depends on Safe Mode for security?
PHP finally removed safe_mode feature:
Safe Mode
Warning
This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP
5.4.0.
The PHP safe mode is an attempt to solve the ...
1
vote
5answers
293 views
Can hackers find secret tokens passed to HTTP GET requests?
I have some code like this in index.php:
if(isset($_GET['something'])){
//do something
}
Can hackers find this and request index.php?something, or is this sufficient for security?
0
votes
2answers
192 views
CMS security issues
I have a desire to make my own CMS , to improve my programming skills. I would use PHP as a server side programming language.
So my question is, on what security issues I must pay attention when ...
