Menu
Community /Pin to ProfileBookmark
@NogDogNov 11.2014 — #Start by reading this short book (maybe twice?): [url=http://phpsecurity.org/]Essential PHP Security[/url] @NogDogNov 11.2014 — #PS: For all database interactions, use PDO or MySQL[b]i[/b] (not the deprecated MySQL extension), using prepared statements and bound parameters for all external inputs into the queries.@NogDogNov 11.2014 — #Well, it seems that many just hope things will be okay: http://www.cmswire.com/cms/web-cms/serious-drupal-flaw-may-have-compromised-thousands-of-sites-027049.php ?@NogDogNov 11.2014 — #I believe there are services out there you can pay to try to crack your site. I do not personally know, however, which ones give you a good return on your investment.
One downside to working as a one-person freelance "shop" is that doing code reviews is usually not part of the process, which is often the first line of defense on any project to make sure you haven't done anything obviously stupid security-wise (not to mention other non-security issues it can turn up).
Handling security on a custom built site?
I’m an entry level web dev, and have some basic chops in PHP, HTML, CSS, JS, and the LAMP stack. I would like to go freelance eventually, and am wondering how freelancers handle security.
Do MVC platforms handle this generally? Does CakePHP have something for this? Or should it just be built into your know-how for building websites? Also, how does the client verify that their site is indeed secure against attacks? Do they even care about this? Should I contract out to a freelance QA, that can tell me if the site I’ve developed is vulnerable or not?
Any other info along these lines would be greatly appreciated. Thanks!
Sign in
to post a comment7 Comments(s) ↴
0
@NogDogNov 11.2014 — #Start by reading this short book (maybe twice?): 0
@NogDogNov 11.2014 — #PS: For all database interactions, use PDO or MySQL[b]i[/b] (not the deprecated MySQL extension), using prepared statements and bound parameters for all external inputs into the queries.0
@NogDogNov 11.2014 — #Well, it seems that many just hope things will be okay: 0
@NogDogNov 11.2014 — #One downside to working as a one-person freelance "shop" is that doing code reviews is usually not part of the process, which is often the first line of defense on any project to make sure you haven't done anything obviously stupid security-wise (not to mention other non-security issues it can turn up).