|
|
Website Security:
As the internet grows programming knowledge becomes more and more common. Many programmers develope applications or websites professionally or contribute to open source projects but there are some that use their skills to damage computers and/or deface websites.
For this reason it is important to take whatever measures that are available to insure the security of your website. If not to avoid having your website defaced, then at least to protect your users from having sensitive information fall into the wrong hands.
On pages that collect a person's personal information or credit card number should be transmitted using a secure connection and any database you store this information in should be locked down tight. Use solid encription on fields that are very sensitive and take all of the scripting precautions to insure that noone else can get access to the database without using your web application.
In web applications, make sure that people can't tweak how your script is supposed to work by putting variables in the url. It is also a good idea to make sure each seperate script file will only run within the script that calls it. That way people won't be able to find the seperate pieces of your scripts and create some gnarley errors and possibly fowl up your database.
Make sure your site isn't set up to server out a list of files in the current directory if there is no index or default file. This gives a potential hacker knowledge about the different files on your server which may help them in their quest to cause trouble.
Another important thing to do is make sure administration areas of your site are secure. Don't give someone the chance to run a password cracker against your login page. Build provision into your web applications to catch that. Make sure your passwords are well picked and not easy to guess.
Always make sure the code that processes your forms is well thought out and robust. It is not uncommon for someone to use a simple feedback form that sends an email to the webmaster to mass email thousands of people by means of header injection. This can very easily get your site and email accounts banned as it is considered your responsibility to make sure this doesn't happen.
As a general rule, code defensively. Don't just trust that every stranger that comes to your site has good intentions and will use the site how it was designed to be used.
|
|
|
|
|
