[PHP-Security] #PHP #Security

php-security.md

PHP-Security

you are uploading the file use below code.

$file = basename(realpath($_GET['file']));

Avoid using mysql(i)_ extensions use PDO

filter_var($_REQUEST['search'], FILTER_SANITIZE_FULL_SPECIAL_CHARS);

use password_hash and password_verify

$hash = password_hash($password, PASSWORD_DEFAULT);
password_verify($password, $hash);

In php.ini change expose_php to Off

In php.ini change mail.add_x_header to Off

In php.ini change session.cookie_httponly to On session.cookie_httponly = On

In php.ini change session.cookie_secure to On session.cookie_secure = On

In php.ini change session.use_strict_mode to On session.use_strict_mode = 1

allow_url_fopen = Off    allow_url_include = Off

In php.ini change open_basedir open_basedir = /var/www/html/ // Multiple directories can be specified with the ":" delimiter open_basedir = /var/www/html/:/var/www/html2/:/var/www/html3/

In php.ini change upload_temp_dir upload_tmp_dir = /var/www/html/tmp/

filter_var($email_address, FILTER_VALIDATE_EMAIL)

filter_var($ip_address, FILTER_VALIDATE_IP)

filter_var($url, FILTER_VALIDATE_URL)

<a href="http://example.com" target="_blank">Click here</a>

Do This Instead
<a href="https://example.com" target="_blank" rel="noopener noreferrer">Click here</a>```