1

First time posting here; apologies for any mistakes I've made, please edit, retag, migrate as appropriate.

I have a simple homepage whose purpose is (essentially) to contain my contact info and some pdf's. Over time this has become a bit of a side project for me, adding content and making it fancier with Javascript and PHP, though only using a microscopic piece of what they can do: include one file in another file, change this div's background, get the current date, etc. I recently used my first $_GET.

In the interests of documenting my work, satisfying the curiosity of anyone who wants to look at my amateur code, possibly getting feedback on how to improve things, and just general openness, I am thinking of discussing, or otherwise making visible,

  • the PHP code I've used
  • the inner structure of my public_html folder on my department's server
  • (am I correct that any Javascript I use is necessarily going to be visible?)

However, I am concerned that this would open my website, or the server overall, to attack. Since my website does not take user input anywhere, I feel secure, but I'd like to be sure before proceeding.

If it would help in your analysis, I can give a list of the PHP and Javascript functions I have used so far.

2
  • 2
    I don't have the time to formulate a full answer right now, but the better way to share your code will be to use a service like GitHub.
    – user10211
    Aug 18, 2013 at 15:26
  • A good example of what could go wrong would be a directory traversal attack.
    – forest
    Nov 29, 2017 at 23:38

2 Answers 2

13

You have made a small mistake. Your web server does take user input. In the URL bar. If you have not configured PHP securely then this is a serious security issue.

Risks include having your code compromised or website defaced.

4
  • +1: Thanks for your answer, and I do see your point. Though I have my permissions set in my public_html folder, I am not sure what I can do to make my code secure. Would you recommend any resources for a novice like me that give tips or list common mistakes? Aug 18, 2013 at 15:53
  • (I have looked around, but many resources are aimed at sites that are doing much more advanced things than I am, and it's difficult to distill any information to how it would apply to me.) Aug 18, 2013 at 16:04
  • PHP is securable, but it is quite difficult as it was not designed to be secure but easy to use. I don't think we have a php hardening question here yet.
    – Rory Alsop
    Aug 18, 2013 at 16:24
  • Related PHP security bug: eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823
    – user22208
    Aug 19, 2013 at 0:45
0

If you have phpMyAdmin or cPanel on your site, there's a (un)surprising number of vulnerabilities found in many of those versions. Keep them up to date.

It's possible that exposing your folder structure and PHP source may expose some vulnerabilities that you've introduced or made available, and if a malicious individual found it before a benevolent one, your site could be compromised.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .