Securing PHP

Now a days PHP is an essential part of Web Develop environment, so try to secure from a System Admin’s perspective.

Hardening with php.ini

1) open_basedir = /dir

When the open_basedir parameter is enabled, PHP will be able to access only those files, which are placed in the specified directories

2) expose_php = Off

Turning off the “expose_php” parameter causes that PHP will not disclose information about itself in HTTP headers that are being sent to clients in responses to web requests.

3) register_globals = Off

When the register_globals parameter is turned on, all the EGPCS (Environment, GET, POST, Cookie and Server) variables are automatically registered as global variables. Because it can pose a serious security threat, it is strongly recommended to turn this parameter off.

You might see some URLs like http://example.com/index.php?name=yourname

If  “register_globals = On” the value which client is entering will directly pass to the variable name on PHP, so if an attacker enter a XSS script it will get executed.

4) display_errors = Off

If the display_errors parameter is turned off, PHP errors and warnings are not being displayed. Because such warnings often reveal precious information like path names, SQL queries etc., it is strongly recommended to turn this parameter off on production servers.

This is very critical, because one of the first attempt to check a URL is vulnerable to SQL injection is a test like http://example.com/view.php?page=1′

5) magic_quotes_gpc = On

This must be on, because if this is off the “” will read on URL. So if you set this on you can prevent the “admin=1″ type of SQL injections (not completely, because an attacker can convert the string to HEX and inject)