Basic PHP-security must knows?

[MrApples]

Anyone have a link to, or have in mind a list of the basic PHP must knows when it comes to security? I'm not even sure what 'injections' are but I know they have something to do with forms.

[Guest190829]

Adrian has written a really nice article here:

https://vborg.vbsupport.ru/showthread.php?t=154411&highlight=Security

This keeps vBulletin specifics in mind.

You can always check the PHP manual as well:

http://www.php.net/manual/en/security.php

[Andrew Green]

Anyone have a link to, or have in mind a list of the basic PHP must knows when it comes to security? I'm not even sure what 'injections' are but I know they have something to do with forms.

Injections are not "really" php, but SQL.

A rather simple way of understanding what a SQL injection is: http://xkcd.com/327/ :D

Basically it comes down to never trusting the user, meaning having a very strong filter in between anything they can input and what gets sent to the database.

[Marco van Herwaarden]

Hehe, that comic is spot on.

[MrApples]

Thanks. That clears up the whole how they can break in thing big time.

[Adrian Schneider]

love the comic :D