Review: Essential PHP Security

phpseccover

Even having being published in 2005, the book “Essential PHP Security” addresses a very up-to-date topic even today. Written by Chris Shiflett the book goes through various security aspects associated with a PHP application, for that reason even to today its content can be considered updated and applicable to various day to day situations faced by developers.

The book has a very easy going and exemplified approach to expose the various aspects presented. Aspects which are very clearly exposed and separated in chapters, going all the way from forms to includes and security in shared hosting environments. Each topic is analyzed in detail and internally divided into exploits and attack strategies for that security flaw, that way the book also becomes a easy to access reference book where its possible to go directly to the chapter that addresses the specific aspect you are coding right now, allowing you to know which flaws to look for. Further the introduction chapter presents Principles and Practice os Security which can be applied in any application and any language, like for example “Defense in Depth”, allowing you to glimpse the fact that security is much bigger than analyzing specific points of you application.

Even having a few years on it, the book addresses topic like XSS that play a important role in the AJAX driven web we observe nowadays. Also old friends like Session Hijacking and SQL Injection are analyzed from various points of view, aligned to the various segments of an application. This structure makes for a very light and enjoyable reading experience which can easily fit into these moments of relaxation or in the waiting room of the occasional visit to the doctor’s office (it worked for me anyway).

This book deserves to be part of any developers history (or shelf), at least to serve as a reminder and inspiration for reflection, even in a world where more and more Frameworks internalize all aspects of security, but as I always say, we developers should always know what goes on behind the curtains.

Essential PHP Security A Guide to Building Secure Web Applications

By Chris Shiflett October 2005 Pages: 124 ISBN 10: 0-596-00656-X | ISBN 13: 9780596006563

comments powered by Disqus

Related Posts

Comunidade PHP no Brasil

Comunidade PHP no Brasil

  • November 20, 2006

A pouco tempo percebi que a comunidade PHP do Brasil estava meio “desunida” e esquecida. Um exemplo claro disso foi o abandono do site PHPBrasil que simplesmente parou no tempo, e ainda carrega o título defasado de maior site de PHP Brasileiro. Ultimamente estou me surpreendendo com muitas novidades na comunidade PHP do Brasil.

Read More
Usando o PHP-SDK para rodar FQL na API do Facebook

Usando o PHP-SDK para rodar FQL na API do Facebook

  • February 15, 2011

Desde a migração do Facebook para a nova Graph API e o protocolo OAuth 2.0, sua documentação para desenvolvedores virou uma grande confusão, sem eira nem beira, de artigos depreciados, e isso se eu for otimista. O problema é que muitos artigos antigos ainda apontam para práticas não mais recomendadas e muitos deles não possuem alertas sobre estas mudanças, em casos extremos funções que em breve serão removidas da API ainda não possuem equivalentes nas novas APIs.

Read More
Optimizing code with __autoload()

Optimizing code with __autoload()

  • March 13, 2007

With the advent of PHP5 a new tool was available to all who wished to optimize their code, its called __autoload. This function can reduce the time lost by having to include object and class files in your code. But how do you proceed in creating an __autoload function to optimize code?

Read More