Menu
I am a PHP newbie and a have a php security question. Is it possible for somebody to get the source code of a php script file running on a server with default configuration? If so, what is the best way to be protected? I am asking this because I happened to download a php file when I requested a page from a site and what triggered my concerns. I think that maybe apache configuration was wrong and served that file to me like a simple file but I am not sure. Also what is the best place to keep "sensitive" data such as database or smtp configuration?
Thank you, Alex
279
PHP is as secure as any other major language. PHP is as secure as any major server-side language. With the new PHP frameworks and tools introduced over the last few years, it is now easier than ever to manage top-notch security.
Every server should have an SSL certificate to securely transfer files via HTTPS. However, regularly check your server for outdated SSL certificates or weak ciphers. Often, sysadmins forget to update SSL certificates when they expire. However, an SSL certificate helps your website to better defend against XSS attacks.
However, what is factual is that it has no default security mechanism. Identical PHP applications are often widely deployed, so a vulnerability in a single application can result in a large number of insecure, publicly accessible servers.
Security. Some claim PHP is not secure enough as it is open source. But the truth is that any programming language is prone and vulnerable, it's just a matter of how they are used. The security level depends on the expertise of the developers and their practices.
For the most sensitive information, I'd suggest putting it outside of your web root folder, and including it through "require" or "include". This way, even is some configuration gets botched on the server, the visitor will only get served the line "include('secret_stuff.php');" and not the actual script.
141
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
