131 reputation
3
bio website phpdeveloper.org
location
age
visits member for 1 year, 9 months
seen Jul 23 at 14:23

Jul
16
comment Is php DOMDocument::loadXML completely secure?
Relevant: websec.io/2012/08/27/Preventing-XXE-in-PHP.html
Jul
16
comment PHP Object Injection Prevention - OWASP
Relevant: websec.io/2014/06/13/… (see the section on "Poor unserialize handling")
May
27
awarded  Editor
May
27
revised Modern, security-conscious, PHP book?
added 150 characters in body
May
27
comment Directory names using extensions a security risk?
I'm not sure I quite understand the question - it looks like you're asking about directory names, but then you mention naming a file with a ".php" extension. Directories named like "something.php" aren't bad, but don't allow users to define actual files with ".php" extensions on them...that's just asking for trouble. If you're going to allow users to define the name of the file for the template, I wouldn't use that directly as a file name. You could also potentially open yourself up to directory traversal or a RFI if you're not careful.
Jan
31
awarded  Supporter
Dec
23
answered PHP Handlers and Caching
Jul
18
answered Modern, security-conscious, PHP book?
Feb
6
awarded  Teacher
Feb
6
answered What unique risks does MVC model binding bring to a website? What additional vigilance is needed?