PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

Securing Your Code
377
n
n
Have your developers use some sort of testing methodology.This might not help
us find all the bugs that a tester would, but this will definitely help the product
from regressing—a phenomenon in which problems or bugs that were fixed some
time ago are reintroduced because of other code changes. Developers should not
be allowed to commit recent changes to the project unless all the unit tests continue
to succeed.
Monitor the application as it runs after it is deployed. By browsing regularly
through the logs, looking at user/customer comments, you should be able to see if
any major problems or possible security holes are cropping up. If so, you can act to
address them before they become more serious.
Execution Quotes and exec
We briefly mentioned a feature previously called the shell command executor or execution
quotes.This is basically a language operator via which you can execute arbitrary commands
in a command shell (some flavor of sh under UNIX-like operating systems or
cmd.exe under Windows) by enclosing the command in back quotes (`)—notice that
they are different from regular single quotes (').The key is typically located in the
upper-left of English-language keyboards and can be quite challenging to find on other
keyboard layouts.
Execution quotes return a string value with the text output of the program executed.
If we had a text file with a list of names and phone numbers in it, we might use the
grep command to find a list of names that contain “Smith” .grep is a UNIX-like command
that takes a string pattern to look for and list of files in which to find it. It turns
those lines in those files that match the pattern to find.
grep [args] pattern files-to-search...
There are Windows versions of grep, and Windows does in fact ship with a program
called findstr.exe, which can be used similarly.To find people named “Smith”, we could
execute the following: