-
Website
http://bradshawenterprises.com/blog -
Original page
http://www.bradshawenterprises.com/blog/2008/06/29/5-mistakes-new-web-developers-often-make/ -
Subscribe
All Comments -
Community
-
-
Top Commenters
-
Popular Threads
On production, always disable error output. Send your error messages to logs, but don't ever output them to the browser. Error messages, in addition to being unprofessional, can reveal details about your architecture that no one really needs to know.
Second, ALWAYS filter and validate input. Assume every user is trying to destroy your server. Go with a white-list approach. If an input is supposed to be a numeric ID, make sure it's numeric only. Make sure to run input through sanitizing like mysql_real_escape_string(). And if you're doing queries, make sure that your web user has ONLY the privileges it needs - don't give it drop table access or anything. If you want to go further, use two web users - one for read that only has select access, and the write, which has select, insert, update, and delete. Only use the write user when you actually need it.
Finally, when configuring your server, make the docroot as limited as possible. That is, stuff like include files and template files (if you have them) should not be accessible through the server.
Hope these tips help!
2 months later I get a call, that their guestbook was full of spam, and that it had broken completely recently (a meta redirect inserted in the comment).
I quickly added a captcha and made sure no SQL or Javascript injection was possible etc. This is a given today, no matter how small the project.
Good read.
You do have a point, however poorly written it may be. :p
we would be still using the tyre of rock
Use many functions instead of copy and paste, and use stlye classes instead of coyping single style attributes^^
A point though about naming of include files - the best solution is to place them in a directory that's not directly accessible to the web. Your PHP scripts will still be able to include them just fine.
If you do have to have them in a web-accessible directory for some reason, at least place them in a directory all of their own. Then place a htaccess file in there containing the following:
<Files *>
order allow,deny
deny from all
</Files>
It's a mistake to think that giving your includes .php extensions makes them entirely safe. Should anyone ever try to access them individually (which is fairly unlikely anyway) they might not see your raw PHP code, but that code would be executed, with unknown consequences.
Don't make your section headers smaller and less bold than your section content.
Why it's bad;
Because it's very hard to skim your page for the start of the next section.
its specific for Centos 5.2 but it should give anyone a pretty good idea.
If you have decided that you need a good website for your business,the next step is to decide who should create it.This decision is one that needs a lot of attention because if on the one hand, a well-organized and attractive web design can help you tremendously in making more money; on the other hand,a poorly designed website can cost you money, drive away customers, and can hurt your company reputation.