PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

Using Secure Sockets Layer (SSL)
413
If installation and configuration are part of your role, you do need to worry about the
way software is installed and configured. Many mistakes made in security are a result of
not following the warnings in the documentation or involve general system administration
issues that are topics for another book.We suggest you buy a good book on administering
the operating system you intend to use or hire an expert system administrator.
One specific issue to consider when installing PHP is that installing PHP as a SAPI
module for your web server is generally more secure, as well as much more efficient,
than running it via the CGI interface.
The primary point you need to worry about as a web application developer is what
your own scripts do or not do.What potentially sensitive data does your application
transmit to the user over the Internet? What sensitive data do you ask users to transmit
to you? If you are transmitting information that should be a private transaction between
you and your users or that should be difficult for an intermediary to modify, you should
consider using SSL.
We already discussed using SSL between the user’s computer and the server.You
should also think about the situation in which you are transmitting data from one component
of your system to another over a network. A typical example arises when your
MySQL database resides on a different machine from your web server. PHP connects to
your MySQL server via TCP/IP, and this connection is unencrypted. If these machines
are both on a private local area network, you need to ensure that the network is secure.
If the machines are communicating via the Internet, your system will probably run slowly,
and you need to treat this connection in the same way as other connections over the
Internet.
It is important that when your users think they are dealing with you, they are, in fact,
dealing with you. Registering for a digital certificate protects your visitors from spoofing
(someone else impersonating your site), allows you to use SSL without users seeing a
warning message, and provides an air of respectability to your online venture.
Do your scripts carefully check the data that users enter? Are you careful about storing
information securely? We answer these questions in the next few sections of this
chapter.
Using Secure Sockets Layer (SSL)
The Secure Sockets Layer protocol suite was originally designed by Netscape to facilitate
secure communication between web servers and web browsers. It has since been adopted as
the unofficial standard method for browsers and servers to exchange sensitive information.
Both SSL versions 2 and 3 are well supported. Most web servers either include SSL
functionality or can accept it as an add-on module. Internet Explorer and Firefox have
both supported SSL from version 3.
Networking protocols and the software that implements them are usually arranged as
a stack of layers. Each layer can pass data to the layer above or below and request services
of the layer above or below. Figure 18.2 shows such a protocol stack.