PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

410 Chapter 18 Implementing Secure Transactions with PHP and MySQL
User’s
Browser
Internet
Web
Server
PHP
Engine
MySQL
Engine
Stored
Pages &
Scripts
Data
Files
MySQL
Data
Figure 18.1
User information is stored or processed by these elements of a
typical web application environment.
The details of each transaction occurring in your system will vary, depending both on
your system design and on the user data and actions that triggered the transaction.You
can examine all of them in a similar way. Each transaction between a web application
and a user begins with the user’s browser sending a request through the Internet to the
web server. If the page is a PHP script, the web server will delegate processing of the
page to the PHP engine.
The PHP script might read or write data to disk. It might also use the include() or
require() constructs to include other PHP or HTML files. It also sends SQL queries to
the MySQL daemon and receives responses.The MySQL engine is responsible for reading
and writing its own data on disk.
This system has three main parts:
n The user’s machine
n The Internet
n Your system
The following sections describe security considerations for each separately, but obviously
the user’s machine and the Internet are largely out of your control.
The User’s Machine
From your point of view, the user’s machine is running a web browser.You have no control
over other factors such as how securely the machine is set up.You need to bear in
mind that the machine might be very insecure or even a shared terminal at a library,
school, or café.
Many different browsers are available, each having slightly different capabilities. If you
consider only recent versions of the most popular two browsers, most of the differences
between them affect only how HTML will be rendered and displayed, but you also need
to consider security or functionality issues.