php - Website security - help me suck less -

php - Website security - help me suck less -

i'm bit behind times when comes website security. know basics - validate incoming data, escape info beingness saved db, utilize salt passwords, etc. sense there's lot i'm missing can bite me in butt. true slow migration .net. i'm not sure how replicate know in php in .net. so, below things i've been thinking i'm sure need help with.

problem: securing sessions php: utilize session_regenerate_id() whenever user important. .net: no thought how replicate here. general: else missing?

problem: xss php: utilize htmlentities() convert potentially unsafe code can rendered (mostly) harmlessly. .net: believe in mvc, using <%: %> tags in view same thing. general: there more can block javascript? denying html entirely? how 1 secure textarea?

problem: remote execution php: utilize regex find , remove eval() function calls. .net: unsurprisingly, no idea. general: again, there more should for?

problem: directory traversal (probably related above) i'm not sure how worried should this. nor sure how block it.

suggestions, links articles (with code examples), etc. welcome, , appreciated.

session_regenerate_id

i don't think there equivalent. sessions short lived, if attacker session in time, should happen after alter access level.

something additional sessions aren't meant authenticate user in asp.net. when using custom authentication utilize forms authentication.

above said, subject man in middle attack. case lots of sites, cookie hijacking problem around.

when doing special, require user come in password 1 time again / should done on https. if need series of special operations, can 1 time on requests/cookies need sent on https. in context, emit modified forms authentication cookie, allows access special operations , has require https on.

i believe in mvc, using <%: %> tags in view same thing.

yes, that's kind of equivalent <%= html.htmlencode(somestring) %> / prevent double encoding (should that).

use regex find , remove eval() function calls.

in .net don't have such shorthand broad access. if not explicitly doing out of ordinary, ok.

directory traversal (probably related above)

use mappath , similar. prevents going outside of site folder. said, avoid receiving paths altogether, can still give unintended access special files within asp.net folder. in fact, part of happened microsoft handler in padding oracle vulnerability out there - more on my blog

you can add together csrf list.

use anti forgery token: http://blog.stevensanderson.com/2008/09/01/prevent-cross-site-request-forgery-csrf-using-aspnet-mvcs-antiforgerytoken-helper/

padding oracle attack:

apply work arounds & patch out.

learn mention here: asp.net padding oracle: how relates getting web.config, forging authentication cookies , reading other sensitive data. understanding that's in there important, specially if utilize of features i.e. don't want 1 putting sensitive info in view state :)

php .net security