PHP systems and security

Question

As a web developer, I use PHP and I know that I need to worry about security, but when you use the framework, there is a lot of code and design that you relay, but that you did not code or design, and for example, I use CakePHP.

• so in this case with frameworks, how much should I worry about security?

Answer 1

You must always respect the basic safety principles:

• do not trust the user
• never trust the user

What kind means:

• filter / check everything that comes to your application.
• print any output.

, , :

• ,
• /; ; -)
• ; .

: :

, ,

, , , , , /, , ; -)

open-source, : , , - , .

Answer 2

, . , , .

, CakePHP.

. , - - , . :

• , , . , . , .
• SQL Injection . , . CakePHP . http://book.cakephp.org/view/153/Data-Sanitization
• URL- . , . , , /show _user/2098, - show_user/2097, . CakePHP UUID, .

-, , . :

• eval() system() , . , Perl, - .
• . , . CakePHP , apache app/webroot. , tmp apache, .

-, .

• CakePHP Auth Acl, , . Cake Sessions, , PHP .

, , . , : http://book.cakephp.org/view/170/Core-Components

Answer 3

ESAPI: http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#tab=PHP

, , .