A
Do I need to filter all the input data?You don't have to trust any data you've received from outside. For example, $_GET, $_POST. php.ini request_order and variables_order This may include bruises, $_SERVER and variable environments, $_COOKIE, $_FILES, downloaded from outside systems (e.g. API). The whole point is, you need to look not for an abstract filter from dangerous data, but to understand what data you're expecting to find in this place and what happens next. The withdrawal of CSV, HTML, or the recording of the CSBD, each requires special treatment.The better use filter_var(), filter_input() etc., or use regular expressions.All that will make sure you're correct. We should start with the white list. Often, you know in advance that, for example, you only have $_GET['index'] foo or bar♪ Here's the two permissible values and check.For example, for e-mail, there's a regular routine hidden in the user's e-mail. filter_var♪ It's a good starting point, and it'll normally work well. Usually because email is a very funny thing. If you read the relevant RFC, it would be easier to check the contents of the symbol @ and to send a letter like that to deal with the variety of possible options. It's almost everything.For example, logina, you may wish to limit the introduction to Latin letters only and some special symbols. It's easier to do regularly.The widest interpretation, usually for free text entry. For example, this is the message. UTF8 symbols are generally acceptable.By the way, when you're talking about this, please don't give a password, except for a minimum length. And only if it clearly requires a substantive area, it's a minimum complexity. But in no case limit the maximum. You're still jashing it, not keeping it, let the user introduce what he likes and the length he likes.What method of authorization on the website can be considered safe?Depending on the safety requirement. It's quite difficult to circumvent the EPZ (north, banking). It is difficult to circumvent if only one specific IP of one specific VPN (corporate data) is allowed. For a site not so sensitive to security, HTTPS. Over the past year, it has become quite simple to incorrectly construct HTTPS, and it will cover MitM adequately and encrypt the data.It's possible to hose the client's original password and send the xash to the server so that the original password is not available online at all.Without HTTPS? Do HTTPS, time of expensive certificates is past.Using PDO, can I not be afraid to connect the variables at once?There's no injection of SQL. And immediately, an important reservation: only if you have a correct coding of the compound or the emulation of prepared expressions is disconnected. https://stackoverflow.com/questions/134099/are-pdo-prepared-statements-sufficient-to-prevent-sql-injection But logical mistakes you must check anyway. For example, do you think using the UPOST['amount'] safe as :amount?UPDATE users SET balance = balance - :amount WHERE id=:user
(approximately, there's going to be a double accountant in this place that checks are further validated on the subway level (especially if the same mysql could actually make a check) but as one DBA says, people understand the money faster.What if I give you 100? Should we get a charge instead of writing off?If I have an HTML (wysiwyg) editor, I need to use the functions before I keep in the OBD system.A very interesting question and conduct depends on the degree of trust. Do you trust someone who uses this editor? So, there's got to be a real HTML on the way out, and it needs to be as HTML? It's a private thing for an adminca of some CMS. Then you mustn't be able to validate this field at all. htmlspecialchars($var, ENT_QUOTES, 'UTF-8') must be summoned for this text in textarea, otherwise the accidental text breaks everything.If you don't believe it, but there's a HTML, you have to do a thorough sweep of the lectures and check the white list of the entire HTML. I don't give you specific tools, I only know that there are. The problem is, for example, you want to be able to make it. <img src>♪ and you'll get some help ♪ <img src='...' onload="alert(document.cookie)"> And that's it. Instead of harmless alert, it might be more interesting. And htmlspecialchars is not possible, or there will be no picture.If HTML is not supposed to be, then htmlspecialchars. It is possible to apply before the entry into the base, and logically, to apply directly to the HTML withdrawal. But not strip_tags. Why are you removing what the user brought? You have to keep it right and show it right, not remove it.If there is, password password password, PASSWORD_DEFAULT is checked;Is that a mistake in the matter? Checks password_verify.Why do you have to do something about not writing a CSPRNG, apparently in a bunch and how you plan to use it, I don't know.CSPRNG is a cryptographically persistent pseudent cell generator.For the sessional authorisation of the session and use it. I recall only one obvious underwater stone that is not always noticed: the session has no time to live. Not at all. There is only a time limit from the last resort to this session, after which the session may remove the garbage collector. And when the trash collector goes down, who knows it. And all this time, the session is still valid. Therefore, if it is necessary for your task to have a handicap of copying an hour after the authorization or after the last application of the user, this logic must be made by you yourself.For long-term authorization, I think that answer is already grotesque. It's rather a separate question.Data filter:See beginning. You need to know what you want to find in these data and where this data goes. The rest is not security, but crutches and security illusions. There's no magical function of doing me right and safe.And, of course, you can't be sure you've got such data at all. First check on isset or, if allowed for values, empty. Or filter_input, he also responds correctly to missing keys.And once CSRF has been reminded, remember that everything that changes the state of the system must be done through POST, PUT, PATCH or DELETE queries (if not API, only POST is normally used) and be covered by a unique token. A question of discussion is unique or unique to the user or to the session. GET needs information only to read. Two identical GET requests should return the same result. This rule sometimes has to be derogated from, for example, to refer to "resigned" in letters (changes signature data), but it's an exception. You don't have to remove anything from the GET Request.
