PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

380 Chapter 16 Web Application Security
Compile
1. built server
2. build PHP
3. set up
configuration
files
4. configure
docments
Test
1. verify basic
operation
2. run test suites
3. run unit tests
4. perform
stress testing
Deploy
1. copy to server
2. verify basic
operation
3. run test suites
4. run unit tests
5. perform some
ad hoc testing
Figure 16.2
The process of upgrading server software.
Browse the php.ini file
If you have not yet spent much time browsing through the php.ini, now is a good time
to load it into a text editor and look through its contents. Most of the entries in the files
have adequate comments above them describing their use.They are also organized by
feature area/extension name; all mbstring configuration options have names starting
with mbstring, whereas those pertaining to sessions (Chapter 23,“Using Session
Control in PHP”) have session prefixed.
There are a large number of configuration options for modules that we do not ever
use, and if those modules are disabled, we do not have to worry about the options—they
will be ignored. For those modules we do use, however, it is important to look through
the documentation in the PHP Online manual (http://www.php.net/manual) to see
what options that extension offers and what the possible values are.
Again, it is highly recommended that we either make regular backups of our php.ini
file or write down what changes we have made so that when we install new versions, we
can be sure that the correct settings are still there.
The only trick to these settings it that if you choose to use legacy software written in
PHP, it may very well require that register_globals and/or register_long_arrays
be turned on. In this case, you must decide whether using the software is worth the
security risk.You can mitigate this risk by checking frequently for security patches and
other updates for such software.
Web Server Configuration
After we are comfortable with the way we have configured the PHP language engine,
we look next at the web server. Each server tends to have its own security configuration
process, and we list those for the most popular two servers: Apache HTTP Server and
Microsoft IIS.
Apache HTTP Server
The httpd server tends to come with a reasonably secure default installation, but there
are a few things we will want to double-check before running it in a production environment.The
configuration options all go in a file called httpd.conf, which tends to be
in the /conf subdirectory of the base installation of httpd (that is, /usr/local/apache/