PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

382 Chapter 16 Web Application Security
n
Avoid using common names. Large numbers of automated programs out there
look for scripts and programs in obvious subdirectories of our document root,
such as Scripts/, cgi-bin/, bin/, and so on.
Again, reading the documentation for IIS to learn more about recommended security
procedures is highly recommended.
Commercially Hosted Web Applications
There is one group of users for whom the problem of security on virtual servers is a bit
more problematic—those users running their web applications on a commercial
PHP/MySQL hosting service. On these servers, you likely will not have access to
php.ini, and you will not be able to set all the options you would like. In extreme cases,
some services will not even allow you to create directories outside of your document
root directory, depriving us of a safe place to put our include files. Fortunately, most of
these companies want to remain in business, and having an insecure design is not a good
way to keep customers.
To be certain, you can and should do a number of things as you look into a service
and deploy your web applications with them:
n Before you even select the service, look through their support listings. Better services
will have complete online documentation (we even found a few with excellent
dynamic tutorials) that show you exactly how your private space is configured.You
can get a feel for what restrictions and support you will have by browsing
through these.
n Look for hosting services that give you entire directory trees, not just a document
root. Although some will state that the root directory of your private space is
the document root, others will give you a complete directory hierarchy, where
public_html/ is where you place your content and executable PHP scripts. On
these, you could safely create an includes/ directory.This will help us ensure that
people cannot see the contents of our .inc files.
n Try to find out what values they have used in php.ini. Although many will probably
not print these on a web page or email you the file, you can ask their support
personnel questions such as whether safe mode is turned on, and which functions
and classes are disabled.You can also use the ini_get function to see setting values.
Sites not using safe mode or without any functions at all disabled will worry
us more than those with some reasonable sounding configuration.
n Look at what versions of the various pieces of software they are running. Are they
the most recent ones? If you cannot see the output of something such as phpinfo,
use a service such as Netcraft (http://www.netcraft.com), which will tell you
which software a particular site is running. Make sure that they are indeed running
PHP5!