php - Website security - help me suck less -
php - Website security - help me suck less - i'm bit behind times when comes website security. know basics - validate incoming data, escape info beingness saved db, utilize salt passwords, etc. sense there's lot i'm missing can bite me in butt. true slow migration .net. i'm not sure how replicate know in php in .net. so, below things i've been thinking i'm sure need help with. problem: securing sessions php: utilize session_regenerate_id() whenever user important. .net: no thought how replicate here. general: else missing? problem: xss php: utilize htmlentities() convert potentially unsafe code can rendered (mostly) harmlessly. .net: believe in mvc, using <%: %> tags in view same thing. general: there more can block javascript? denying html entirely? how 1 secure textarea? problem: remote execution php: utilize regex find , remove eval() function calls. .net: unsurprisingly, no idea. general: again, there more should for? prob...