RssAtom


Categories


Loading feed
Loading feed

PHP Security Tip #15

Security_Tips  
by Cal Evans (editor) | 5 comments | Friday, March 23, 2007

As developers, most of us are very messy. I’ve worked on countless projects and at each either run across or left a trail of diagnostic files laying around. (info.php, test.php, doMe.php, etc.) These tiles, if found by someone with nefarious intent, can leak valuable information about your system.

Today’s Security tip is:

Don’t forget to purge temporary system diagnostic files.

It would be a shame to spend all that time securing your application only to leave info.php or worse yet, a “quick piece of code” in test.php that could potentially leak dangerous information about your system. Don’t help the ad guys any more than you have to.

=C=

p.s. Got a security tip? Post it! If it’s good enough we’ll share it with everybody else. Just log-in and click the contribute link in the upper right corner.

Comments

Add Comment

Friday, March 23, 2007
...
8:05AM PDT · andriesseutens
i'd like to add that it's very important that if you are working with *.ini files, or similar, it is very important to either not store them in your DocumentRoot, but rather a level below it. If this is not possible due to your server setup, you can easily change this behaviour by adding a .htaccess file to the folder where you are storing the sensitive file.

A simple line like this would do: "Deny from all"
THE AD GUYS
10:04AM PDT · pmuellr
You definitely need to watch out for the ad guys. They are even more treacherous than the bad guys. :-)
RESPONSE
7:02PM PDT · Cal Evans (editor)

Andrie:

Good point. Thanks for posting.

pmuellr:

Being an ad guy myself these days, my only comment is to say that it may have been a typo but it’s still valid advice. :) Thanks for posting.

=C=

Sunday, March 25, 2007
A QUICK GOOGLE SEARCH
9:34AM PDT · shahar
A quick Google search will show you how acute the phpinfo() problem is:

http://www.google.com/search?q=phpinfo
Monday, August 20, 2007
RE: ...
5:23AM PDT · stephan_hohmann
I found another way of securing my .ini-files: I store them as .ini.php and let them start with ";<?php /*" and end them with ";*/ ?>". If anyone should happen to find them, all they get displayed is a single ";".

That's a very simple solution and it bears the danger that, should php parsing fail for any reason, all the content will be displayed.