Menu
Community /Pin to ProfileBookmark
@NogDogNov 05.2015 — #Use Laravel as your framework and leverage a lot of its already built-in stuff, perhaps? (E.g. if you use its Eloquent ORM, you don't even have to think about escaping DB inputs -- though if you exclusively use prepared statements with bound parameters in PDO, that takes care of it too.) It also has a number of built-in things for form inputs, HTML output, password hashing, etc. that can help you out.
PS: I was assuming PHP on the server side since you mentioned PDO. @NogDogNov 06.2015 — #It's a trade-off choice only you can make: once you learn a framework, you can build stuff faster by leveraging all its built-in goodies, with the trade-off being that you lose some control of the application's innards. If it's a solidly built framework and you use it correctly, though, you also avoid mistakes and bugs that come with writing everything yourself. I mean, even writing it all from scratch in PHP, you're using the C code that PHP is built upon, and that C is built upon some assembler, which in turn wrote the actual machine language -- so you could cut out all the middle-men and just write raw machine code. ?
General tips on secure developing
I think I understand that this site is primarily focused on software not hardware so I won’t ask about server setup, I’m really trying to get security right before working on larger projects.
I’m switching to PDO
I’m aware of XSS, clickjacking, frame jacking, port 22 brute forcing, parameterized binding…
What else should I think about?
I’ve also been told about using bcrypt and blowfish.
I’d appreciate any help.
Sign in
to post a comment5 Comments(s) ↴
0
@NogDogNov 05.2015 — #PS: I was assuming PHP on the server side since you mentioned PDO.
0
@NogDogNov 06.2015 — #It's a trade-off choice only you can make: once you learn a framework, you can build stuff faster by leveraging all its built-in goodies, with the trade-off being that you lose some control of the application's innards. If it's a solidly built framework and you use it correctly, though, you also avoid mistakes and bugs that come with writing everything yourself. I mean, even writing it all from scratch in PHP, you're using the C code that PHP is built upon, and that C is built upon some assembler, which in turn wrote the actual machine language -- so you could cut out all the middle-men and just write raw machine code. ?