Enter your mobile number or email address below and we'll send you a link to download the free Kindle App. Then you can start reading Kindle books on your smartphone, tablet, or computer - no Kindle device required.
To get the free app, enter your mobile phone number.
Essential PHP Security Paperback – October 20, 2005
|New from||Used from|
The Amazon Book Review
Author interviews, book reviews, editors picks, and more. Read it now
Frequently bought together
Customers who bought this item also bought
You've heard the nasty stories about PHP sites being wiped off the web by evil hackers? Sadly it's not scare-mongering as it does happen, and as much as we love PHP it needs proper security to keep your site safe from harm. Plenty of PHP books have the odd chapter on security but at last O'Reilly have published a whole volume dedicated to the cause, with all the code you'll need to keep everything in order. Each chapter covers a different aspect of the application, from form processing to database programming and session management. Written in a straight forward style, it's ideal for every PHP user, but at GBP20 you might expect a little more than just 100 pages." .NET, November 2005 "If you write PHP scripts, get a copy" - Alain Williams, news@UK, March 2006
About the Author
Chris Shiflett, an internationally recognized expert in the field of PHP security, is the founder and President of Brain Bulb, a PHP consultancy. Chris has been developing web applications with PHP for several years and regularly speaks at OSCON, ApacheCon, and PHP users conferences in North America. He is the author of the HTTP Developer's Handbook (Sams) and writes frequently about web application security. As an open source advocate, he maintains several open source projects and is a member of the PHP development team.
Top customer reviews
Chris' book is great. It's chocked full of easy to understand explanations and little five line code fragments to demonstrate what he's explaining. Sure enough, if you read the whole thing, you'll understand the essentials of PHP Security. Hey - perhaps that explains the title?
Do I need this book if my company already uses web scanning security software? Yes - you won't understand the problems that those products identify if you don't understand PHP security basics. If you don't understand reported errors, You'll be tempted to ignore or suppress warnings that you don't understand. Chris' book will give you the knowledge that you need in a few easy to follow pages.
There are a few ommissions. They include:
OMISSION #1: The book should mention somewhere that many of the security vulnerabilities it describes are not unique to PHP - especially big ones like cross-site scripting and SQL injection. While PHP has some vulnerabilities that other languages do not (and vis-versa), Java, C#, Ruby, and all the other server-side languages can also be attacked with cross-site scripting, SQL injection, session spoofing, cookie theft, backdoor URLs, etc., etc.
OMISSION #2: The book would have benefited from the addition of a page of system administration best practices to improve security rather than confining itself only to coding best practices. For example, it's easy for developers to accidentally open security holes by making very small changes to the PHP.ini file. A good best practice is to use the operating system to restrict access to that file in the production environment. Or it would have good to see Chris distill role-based security administration policies, logging, or remote procedure call policies down to just the most important principles. He has a knack for filtering out the noise, and if he had added that additional 86th page, I swear I would have read it too.
OMISSION #3: It's worth mentioning how modular design has a very big impact on the number of vulnerabilities inside an application. This is especially important for PHP, because PHP code is often a little more haphazard than code written in other languages - primarily because of the culture that surrounds PHP but also for a few other reasons (we cover those reasons in the PHP Chapter of our own book on the strengths and weaknesses of various technologies).
These criticisms are very minor. The book is short, easy-to-read, and filled with information that is absolutely essential to know if you are to responsibly deploy a server-side PHP application. Look at the table of contents. If you're not familiar with those terms, you'd better get the book.
Web Service and SOA Technologies
It was a shorter book than I was expecting (yes, that's my goof for not noticing the page count when I purchased it) however I'm glad that I didn't notice that fact before purchasing otherwise I might have overlooked it as more of a reference book rather than a teaching book. I was very happy with the book and would recommend it to anyone interested in some solid best practices for PHP security.
At best, the whole book feels like a quickly written computer magazine article, not a good, comprehensive book.
Not worth the money. Just do a search for "PHP Security" on the internet and read a few articles and you will know more than this book.
Unfortunately, during the interim, a set of "best practices" emerged that involved doing things like salting passwords and using a function named "mysql_real_escape_string" (so named because "mysql_escape_string" and similar functions were found to be inadequate protection.) Indeed, while these were the best ideas at the time when the language lacked a lot of features, they are now considered *worst* practices, and are of little use. Instead, programmers should use parametric queries with bound parameters and bcrypt-style hashing of passwords - but the book barely mentions them at all, and relegates these superior practices to mere footnotes.
Burn this book. The author is ignorant of real security threats and is 15 years out of date.