Looking for general advice on security


I'm designing a survey form page that will be fairly complex and am
becoming confident enough with PHP now to tackle most things.
(Thanks to everyone here who has helped)

Before I go too far with this I was wondering if anyone could perhaps
offer advice or point me to any documents/web pages that could help with
ensuring the security of the form/page and site. It is likely that the
form will come under attack I expect.

Even comments about the best chmod settings are welcome.

I'd rather not have to wade through another history of the internet book
with the words "and be security conscious by using SSL" on the last page
which is what most adviice I've found so far boils down to.

I've located standard advice such as using PHP strip-tags on input fields
and other PHP specific stuff but was wondering how best to get
interactive with the security.

Are there any PHP libraries perhaps that help with this?

I'm thinking of things like verifying users ID while they are online
without having them email and preventing bots from getting in and things
like that.

Any input on this would be most welcome.

thanks

tony
.

Relevant Pages

  • TSLSA-2005-0059 - multi
    ... Affected versions: Trustix Secure Linux 2.2 ... PHP is an HTML-embedded scripting language. ... use of Rest with FTP servers and Range with HTTP servers to retrieve files ... - New Upstream and Multiple Vendor Security Fixes ...
    (Bugtraq)
  • [NEWS] PHP Security Vulnerability in Multipart FORM Data Handling
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The PHP Group has learned of a serious security vulnerability in PHP ... code with the privileges of the web server. ...
    (Securiteam)
  • TSLSA-2007-0017 - multi
    ... Affected versions: Trustix Secure Linux 2.2 ... PHP is an HTML-embedded scripting language. ... SECURITY Fix: Arnaud Giersch has reported a weakness in ELinks, ... The Common Vulnerabilities and Exposures project ...
    (Bugtraq)
  • Re: Securing an Email script
    ... request to our sales office. ... Since you do ZERO checking on the values it's nothing BUT security issues. ... very powerful PHP function to validate form fields and other strings - ...
    (comp.lang.php)
  • [Full-disclosure] [ GLSA 200511-08 ] PHP: Multiple vulnerabilities
    ... PHP suffers from multiple issues, resulting in security functions ... bypass, local Denial of service, cross-site scripting or PHP variables ...
    (Full-Disclosure)