PHP security question?

Question

I just wanted to know what are some basic PHP security techniques I should use when creating a web page that accepts articles?

I'm fairly new to PHP and was wondering what will hold the fort down until I'm a security expert?

Answer 1

There are two fronts to consider when accepting user-generated text that will later be displayed.

First off, you need to protect your database from injection attacks. There's a simple PHP function for this: mysql_real_escape_string() will usually suffice to protect your database from injection when passing this string in to store as a field value.

From there, you have to be careful about your display, as a user who is allowed to upload HTML code can do nasty things to other users when that code gets displayed. If you're doing plaintext articles, you can simply htmlspecialchars() the resulting text. (you'll also probably want to convert newlines to
tags.) If you're using a formatting solution, such as the Markdown engine used on this site, those solutions will usually provide HTML sanitization as a function of the engine, but be sure to read the documentation and make sure.

Oh, make sure you're also verifying your GET/POST variables used to submit the articles. That goes without saying, and the verification performed is going to need to be tailored to what your site is doing with its logic.

Answer 2

This is to broad, maybe you should try to narrow it a bit.

What kind of security? For passwords? Do you want to restrict some stuff? SQL Injection? HTML Injection? Cross domain security?