Preserved Topic: A tip for security. (Page 1 of 1)

The poster has demanded we remove all his contributions, less he takes legal action.
We have done so.
Now Tyberius Prime expects him to start complaining that we removed his 'free speech' since this message will replace all of his posts, past and future.
Don't follow his example - seek real life help first.

I'll add a few more things to the list:

- When you have sensitive information in GET variables and you have off site links, complete URL (with QUERY STRING, i.e. all GET variables) will appear as HTTP REFERER on those off site links (when someone clicks on them) and that information can be used to hack your web server. Perfect examples for this scenario are forum systems. In QUERY STRING you'll have session id and since anyone can post messages with links, someone can post link to web site that will monitor HTTP REFERER field and use that information (session id from the QUERY STRING) to attempt to hijack sessions (if they are coded poorly) and gain access to the forum system.

- In addition to IP locking, always check HTTP REFERER, so that you can be sure (well, most of the time, at least) that the request cam from pages that are located on your web server.

- Besides showing your server info (which is a bad thing, like InI said), you should also turn off all visible error reporting (PHP outputs all errors directly on pages). Malicious person with help from those error messages can "probe" your web server and find possible exploits that can be used to gain access.

- Read A Study In Scarlet Exploiting Common Vulnerabilities in PHP Applications article for more information about common security mistakes made in PHP scripts...

And the list goes on and on and on...

"the only secure computer is a turned off computer"
- linus thorvalds (if i remember correctly)