Re: I hate PHP & SQL!
A few basic security thoughts...
--make sure any input field processing protects against sql injection. there are a number of techniques for this.
--make sure directories that store things like templates and code at the very minimum are exluded in robots.txt
--better yet, any directory that doesn't HAVE to be accessible via the web should be .htaccess protected or stored outside your web path
--chmod is your friend. directories should be 755, files should be 644.
--patch early patch often. when a security patch for any script is released, everyone can immediately see where the holes are in the previous version and script kiddies will go looking for installations that haven't been upgraded.
--for the reason above, do not let version numbers of scripts display publicly.
--use strong passwords on all your admin areas, always use SSH and secure FTP
|