Learn hosting environments for security critical applications how it works

When you write PHP applications and general guidelines for writing secure Web applications apply. The most important rule is to take care of all user input. Before this entry is used by the application must be carefully validated.

With the built-in PHP session, it is important to properly manage to prevent session fixation attacks. Moreover, the default method to store session data in the file system must be replaced by custom methods that store data in a database.

A problem that is not directly in the area of responsibility of the PHP developer of web applications is security in shared hosting scenarios. Usually, it is advisable to use PHP shared hosting environments for safety-critical applications.

Especially when the PHP interpreter runs as an Apache module, all scripts run with the techniques of the web server user. Therefore, all scripts have potential access to all virtual hosts with all the directories in the system. Thus, it is possible to access files on other hosting customers. Now we should know the PHP safe mode;

PHP safe mode is an attempt to solve this problem. However, approaches the problem with PHP, not the operating system. So the problem could be open, depending on what other languages are allowed in the housing system.

The following configuration directives can be used for configuring Safe Mode restrictions:

1. safe_mode – Turns Safe Mode on and off.

2. safe_mode_gid – By default Safe Mode limits access to those files that have the same owner as script file. This option relaxes this restriction to files that have the same group owner.

3. safe_mode_include_dir – This option defines a list of directories. For in-clued files within these directories the owner and group owner restrictions do not apply.

4. safe_mode_exec_dir – This option defines a list of directories. Functions like system () that call system function, can only execute files that reside in the defined directories.

5. safe_mode_allowed_env_vars – This option defines a prefix for environment variables. PHP scripts can only set variables with this prefix.

6. safe_mode_protected_env_vars – This option defines a list of environment variables PHP scripts are not allowed to change.

7. open_basedir – This option defines a path prefix. If defined, PHP scripts can only access files with a path that begins with the defined prefix.

8. disable_functions – This option defines a list of PHP functions that are disabled and cannot be executed by PHP scripts.

9. disable_classes – This option defines a list of disabled PHP classes. These classes cannot be accessed by scripts.

Although based on a conceptual error safe mode it operates on the wrong layer, it can help reduce risk. This is true not only for shared hosting scenarios, as well as dedicated web servers that host a single application.

For example, by restricting access to files of a specific path and debilitating act as a system () can help limit damage when a hacker finds a way to inject code.

Recommendations:

 Do not use PHP Safe Mode as an substitute for proper programming and input validation.

 Only use it as an additional line of defense.

 Consider the usage of Safe Mode even on dedicated web servers that host a single application.

The configuration options are most important to the PHP interpreter is Register Globals. This function must be turned off and the applications should never use this feature. Moreover, the error reporting functionality of the PHP interpreter must be configured correctly. Error messages should never be displayed to the user. They must be written in local newspapers. For all relevant information to the extent of reported error messages should be lowered.

To know more about company click: Developer and programmers, Php Development Company, Php Development India, Php Developer India, Php Web Development Company, Php Web Development India

Related Links: Hire Php Web Developer they can help and maintain your website. Php Web Development, Php Website Developer, Php Web Developer India, Hire Php Programmer India, Php Programmer

How PHP application accepts data from HTML and MYSQL

A typical Flash application, like a simple HTML web page, does not collect and store data on the server computer.  To store information, you need to use a file or a database and connect to the file or database using so-called server-side or middleware software.

Similarly, a typical PHP application accepts form data from a HTML and produces an HTML document. This example demonstrates using Flash and PHP to store data in and extract data from a MYSQL database.  Both PHP and MYSQL are considered Open Source tools. 

The PHP web application keeps track of votes cast for 4 choices.  It is intended to represent a polling application, not a voting application.  Please note that a real voting application would need to incorporate features to allow only legitimate voters to vote and to only vote once.

 A debate is going on now concerning various systems for electronic voting.  One feature considered critical by many, though not all, is that the system produce a paper trail for each vote.  This toy application does not include any of these features.  The intent is to demonstrate how Flash can connect to a PHP script.

Generally   A basic contract with an Internet Service Provider generally would not include support of PHP scripts or MYSQL (or any other) database.  This application and tutorial assumes PHP and MYSQL support and, moreover, assumes that a table has been created and initialized to hold the polling data.

The php file must take the data, access and update the appropriate record in the MYSQL database, then access all the records in the database, format the results, and return this string of characters to the Flash program.  Structured Query Language, SQL, is used to access the database.

The table in the database is named votes. Each record has two fields (actually, each record has an id field, but that is not used.): candidate and votes cast. In php, variable names start with dollar signs. 

Here is the code (with my user name, password and database name replaced by question marks.  You will need to change this to values for your account):

     <?php

// Incoming Variables..

 $data = $HTTP_POST_VARS['data'];

$host="localhost";

$user="????";

$password="?????";

$DBname="??????";

$link=mysql_connect($host,$user,$password);

print "&display=";

$query = "UPDATE votes SET votescast = votescast+1 WHERE candidate = '" .$data . "'";

$result = mysql_db_query($DBname,$query,$link);

$query = "SELECT * FROM votes";

$result = mysql_db_query($DBname,$query,$link);

while ($row=mysql_fetch_array($result)) {

print  "<br>";

print $row["candidate"];

print ": ";

print $row["votescast"];

print " <br>";

}

?>

This coding can help to solve this kind of concerns.

To upgrade your website Hire expert PHP Developer