PHP is probably the easiest to learn mainstream language available right now. This comes with a price though; poor design and vulnerabilities are to be found on a huge amount of php projects, just because PHP allows you to do so, and because many of the people who are using the language are not (or should not call them selves) professional programmers.
A few of the most important things:
Make sure you have error_reporting to atleast E_NOTICE during development, or even better to the suggested E_STRICT (for PHP5 and above). PHP is very good in warning you about possible bugs of vulnerabilities in your code (check this link: php.net/manual/en/errorfunc.configuration.php#ini.error-reporting) Be careful though: as nice and helpful as it may be to use error reporting during development, make sure NO errors are displayed on the actuall application while live; it can give the person who is currently using it allot of info about your vulnerabilities! So, on the live project, make sure error_reporting is disabled.
Exception handling is a powerful technique to protect your program flow and get running errors php.net/manual/en/language.exceptions.php
cegonsoft








Reply With Quote