PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

Securing Your Code
367
the security of our system, we have given malicious users a huge helping hand in their
attempts to compromise our system.
If you are going to do it, do it properly.The Internet is particularly unforgiving to
those prone to carelessness or laziness.The hardest part of sticking to this mantra is convincing
a boss or paycheck signer that this is worthwhile. A few minutes teaching them
about the negative effects (including those against the bottom line) of security lapses
should be enough to convince them that the extra effort will be worthwhile in a world
where reputation is everything.
Securing Your Code
Moving on to the next aspect of our approach to security—inspecting each of the components
individually and looking at how to improve their security—we begin in this
section by investigating the things we can do to help keep our code safe. Although we
cannot show you everything you might want to do to cover all possible security threats
(entire tomes have been devoted to these subjects), we can at least give some general
guidelines and point you in the right direction. For some specific technology areas in
PHP that we will use in later chapters, we will point out security concerns for these as
we see them.
Filtering User Input
One of the most important things we can do in our web applications to make them
more secure is to filter all user input.
Application authors must filter all input that comes from external sources.This does
not mean that we should design a system with the assumption that all our users are
crooks.We still want them to feel welcome and indeed encourage them to use our web
application.We just want to be sure that we are prepared at any point for misuse of our
system.
If we do this filtering effectively, we can reduce the number of external threats substantially,
and massively improve the robustness of our system. Even if we are pretty sure
that we trust the users, we cannot be certain that they do not have some type of spyware
program or other such thing that is modifying or sending new requests to our server.
Given the importance of filtering the input we get from external customers, we
should take a look at the ways in which we might do this.
Double-Checking Expected Values
At times we will present the user with a range of possible values from which to choose,
for things such as shipping (ground, express, overnight), state or province, and so on.
Now, imagine if we were to have the following simple form: