Category:PHP - Revision history

Danehrlich1: minor batch updates

2019-01-18T03:27:19Z

minor batch updates

Danehrlich1: batch of updates

2019-01-18T03:24:29Z

batch of updates

Show changes

Danehrlich1: change

2019-01-02T04:48:30Z

change

Danehrlich1: change

2019-01-02T04:47:13Z

change

Danehrlich1: change

2019-01-02T04:46:54Z

change

Danehrlich1: change

2019-01-02T04:38:41Z

change

Danehrlich1: change

2019-01-02T04:37:26Z

change

Danehrlich1: change

2019-01-02T04:37:14Z

change

Danehrlich1: change

2019-01-02T04:37:00Z

change

Danehrlich1: css

2018-12-25T07:00:01Z

css

@@ Line 41: / Line 41: @@
 == Meta ==
-Last Update: 01/2019
+Last Updated: 01/2019
 <br/>
@@ Line 47: / Line 47: @@
 == Other Resources ==
-[https://paragonie.com/blog/2017/12/2018-guide-building-secure-php-software Best 3rd Party PHP Security Guide]
+[https://paragonie.com/blog/2017/12/2018-guide-building-secure-php-software Ultimate 2018 PHP Security Guide]
 <br/>
 [https://lists.owasp.org/mailman/listinfo/php-project Mailing List]
@@ Line 65: / Line 65: @@
 |}
 =PHP Security Overview=
@@ Line 86: / Line 87: @@
 : * Provides information about the design and architectural considerations for a PHP web application.  Which frameworks to use, which frameworks are dead, and using the various FIGs.
 : * ARCHITECTURE
 = Pages =
 == Resources ==
@@ Line 108: / Line 109: @@
 [https://github.com/google/recaptcha Google PHP recaptcha]
 <br/>
 [https://github.com/paragonie/anti-csrf Paragonie Anti-CSRF Library]
@@ Line 146: / Line 146: @@
 [https://www.owasp.org/index.php/PHP_Security_for_Deployers PHP Security for Deployers]
 <br/>
 <br/>
 [https://www.owasp.org/index.php/PHP_Configuration_Cheat_Sheet PHP Configuration Cheat Sheet]
@@ Line 158: / Line 156: @@
 [https://www.owasp.org/index.php/Log_Injection Log Injection]
 <br/>
 <br/>
@@ Line 166: / Line 163: @@
 [https://www.owasp.org/index.php/Projects/OWASP_PHP_Security_Project/Roadmap OWASP PHP Security Project Roadmap]
 <br/>
 <br/>
@@ Line 179: / Line 175: @@
 [https://www.owasp.org/index.php/WebGoatPHP OWASP WebGoatPHP]
 <br/>
-<br/>
+{| style="padding:0; margin:0; margin-top:10px; text-align:left; width:100%;" |-
 = Get involved =
@@ Line 191: / Line 189: @@
 To get involved join the mailing list: [https://lists.owasp.org/mailman/listinfo/owasp-php OWASP PHP Mailing List]
 == Mailing List ==

@@ Line 66: / Line 66: @@
 It is not easy to produce a PHP application without security vulnerabilities. Most application security [[:Category:Vulnerability|vulnerabilities]] apply to PHP applications just like other environments.
-The goals of this project are to provide information about building, configuring, deploying, operating, and maintaining secure PHP applications. We cover the following topics or pick a topic from the [[OWASP PHP Table of Contents]]
+The goals of this project are to provide information about building, configuring, deploying, operating, and maintaining secure PHP applications
-; [[PHP Security for DevOps]]
+; [[PHP Security for Developers]]
 : * How to secure a PHP application when running on the major cloud providers. How to secure a PHP application if all you've got is an unmanaged Linux server. Harden web server, harden database, and various network defenses such as WAFs, GeoIP, and DNSBL.
 : * How to secure the development environment. Do you have control over the Source code repository? Are commits signed? How do you know which Docker Images to trust? Do you scan containers for vulnerabilities?
-; [[PHP Security for Developers]]
+; [[PHP Security for Software Architects]]
 : * Provides information about the design and architectural considerations for a PHP web application.  Which frameworks to use, which frameworks are dead, and using the various FIGs.

@@ Line 12: / Line 12: @@
 == What Does PHP Security Mean? ==
-* Is my code secure? E.g. am I using the latest version of PHP
+* Is my code secure? E.g. am I using the latest version of PHP?
 * Is my architecture secure? E.g. Have I hardened the web server the application runs on?
 * Is my development infrastructure secure? E.g. Do I have 2FA on my Github account along with all other developers?

@@ Line 68: / Line 68: @@
 The goals of this project are to provide information about building, configuring, deploying, operating, and maintaining secure PHP applications. We cover the following topics or pick a topic from the [[OWASP PHP Table of Contents]]
-; [[PHP Security for Architects]]
+; [[PHP Security for DevOps]]
-: Provides information about the design and architectural considerations for a PHP web application.  Common architectures such as MVC, Ajax, Web Services and PEAR / Zend Frameworks are discussed.
+: * How to secure a PHP application when running on the major cloud providers. How to secure a PHP application if all you've got is an unmanaged Linux server. Harden web server, harden database, and various network defenses such as WAFs, GeoIP, and DNSBL.
 ; [[PHP Security for Developers]]
-: This section covers dangerous calls and common vulnerabilities associated with them, such as system() exec(), eval() and so on. This section will also cover standard security mechanisms available in the standard language, such as cryptography, logging, encryption, and error handling. Securing elements of an application, such as controllers, business logic, and persistence layers will be covered. We'll discuss handling request parameters, encoding, injection, and more.
+: * This section covers dangerous calls and common vulnerabilities associated with them, such as system() exec(), eval() and so on. This section will also cover standard security mechanisms available in the standard language, such as cryptography, logging, encryption, and error handling. Securing elements of an application, such as controllers, business logic, and persistence layers will be covered. We'll discuss handling request parameters, encoding, injection, and more.
-; [[PHP Security for Deployers]]
+; [[PHP Security for Architects]]
-: These articles cover topics specifically related to the PHP hosting environment. We discuss minimizing the attack surface, configuring error handlers, and performing hardening of PHP.
+: * Provides information about the design and architectural considerations for a PHP web application.  Which frameworks to use, which frameworks are dead, and using the various FIGs.
 = Pages =
-== Tool Chain ==
+== Resources ==
-<TBD>
+[https://github.com/guardrailsio/awesome-php-security Awesome PHP Security]
 <br/>
@@ Line 89: / Line 90: @@
 == Libraries ==
-<TBD>
+[https://github.com/google/recaptcha Google PHP recaptcha]
 <br/>

@@ Line 18: / Line 18: @@
 == What Can You Learn Here? ==
 * Fastest way to secure a legacy PHP application
 * What options do I need in my php.ini file for security?
 * How to secure the web server running your PHP
-* How can I check my dependencies for vulnerabilities?
+* How to secure phpmyadmin, MySQL, and Postgres databases
 * How to harden your WordPress or Drupal site

@@ Line 7: / Line 7: @@
 == About ==
-There are 1.8 billion websites on the internet today [Netcraft]. Nearly 80% are powered by the PHP programming language. Democracy, freedom, and a better world are not possible if PHP is insecure. This project seeks to be the clearing house for the best ways of protecting PHP websites, apps, and the data they have. Thank you for reading.
+There are 1.8 billion websites on the internet today. Nearly 80% are powered by the PHP programming language. Democracy, freedom, and a better world are not possible if PHP is insecure. This project seeks to be the clearing house for the best ways of protecting PHP websites, apps, and the data they have. Thank you for reading.
 == What Does PHP Security Mean? ==