Essential PHP Security

The book is only 85 pages long (if you take out the Appendices and filler material). That alone gets it four out of five stars. Well... not really... but there's a lot to be said for producing a book that will actually get read. You can read the whole thing in one bathroom sitting, assuming you just returned from Mexico. By comparison, similar books like "Pro PHP Security" by Chris Snyder and Michael Southwell (also a very good book) are more along the lines of 500 pages and such books are intended as comprehensive reference books rather than tutorials. You'd have to eat at a restaurant in North Korea to get all the way through the Pro PHP Security book. Seriously though - the criticisms of this book primarily pretain to its lack of detail - but I'd rather actually finish a high level book than have a detailed book sit on my shelf unread. Chris' book is great. It's chocked full of easy to understand explanations and little five line code fragments to demonstrate what he's explaining. Sure enough, if you read the whole thing, you'll understand the essentials of PHP Security. Hey - perhaps that explains the title? Do I need this book if my company already uses web scanning security software? Yes - you won't understand the problems that those products identify if you don't understand PHP security basics. If you don't understand reported errors, You'll be tempted to ignore or suppress warnings that you don't understand. Chris' book will give you the knowledge that you need in a few easy to follow pages. There are a few ommissions. They include: OMISSION #1: The book should mention somewhere that many of the security vulnerabilities it describes are not unique to PHP - especially big ones like cross-site scripting and SQL injection. While PHP has some vulnerabilities that other languages do not (and vis-versa), Java, C#, Ruby, and all the other server-side languages can also be attacked with cross-site scripting, SQL injection, session spoofing, cookie theft, backdoor URLs, etc., etc. OMISSION #2: The book would have benefited from the addition of a page of system administration best practices to improve security rather than confining itself only to coding best practices. For example, it's easy for developers to accidentally open security holes by making very small changes to the PHP.ini file. A good best practice is to use the operating system to restrict access to that file in the production environment. Or it would have good to see Chris distill role-based security administration policies, logging, or remote procedure call policies down to just the most important principles. He has a knack for filtering out the noise, and if he had added that additional 86th page, I swear I would have read it too. OMISSION #3: It's worth mentioning how modular design has a very big impact on the number of vulnerabilities inside an application. This is especially important for PHP, because PHP code is often a little more haphazard than

Provides a good practical overview of common website attacks and how to handle them. Each type of attack is explained before showing the defence. By understanding how the attacks work you are less likely to implement the defences incorrectly. This book helped me understand the important security issues when developing websites in php, however much of the information is applicable in any web development language. The book is only around 100 pages, but if you consider the title of the book then this is fine. You won't find information about securing a web server for example, but that is not what this book is for. The only specific attack missing which I would like to have seen information about is email spamming through website forms. However the general principles described in the book will help prevent these attacks as well. I highly recommend this book to any PHP developer who is looking for a concise guide on how to secure their websites.

I found this book very helpful. The language is easy to understand and the examples are clear and concise. The mantra 'filter input, escape output' is repeated throughout the book but is accompanied by examples of attacks and preventions. I found that repetition helpful. It is much easier to take the advice and apply it to my own needs than having a book with a finite list of applications and their possible holes.

This is the first technical book that I have read that doesn't obscure the topic with trivial details or complicated sentence structures with phrasing that is hard to follow. The thing I like best about the book is that it introduces a technique in detail and uses it throughout the book. Because every chapter refers back to the original "filter input, escape output" theme coupled with defense in depth, it forces the user to concentrate on a single, simple method and apply it to many different situations. The example code segments in the book illustrate specific points described in the copy very well. Keeping the code examples simple only strengthens its meaning since the reader is not forced to analyze the code. Additional comments in the examples may be helpful for inexperienced developers. In addition providing insight on filtering input and escaping output, Chris also gives the reader insight to a very helpful way of dealing with the filtered/escaped data within the code. This method is illustrated in all the examples, and as the reader notices it used throught the book they can learn its usefulness by example.

This book helped me identify and report a critical security vulnerability in a commercial third party PHP application we were planning to deploy in a business-critical fashion. For that alone, it was worth its weight in gold. This books is the antidoe to the common misperception that PHP applications fall short on security. With sparkling clarity, Chris demystifies dozens of attacks and provides both solid theoretical and practical bases for coding securely in PHP. Throughout his work as a PHP security consultant, and culminating in this book, Chris has defined the lexicon for web security -- telling us precisely what it means to filter input, and precisely what it means to escape output -- as well as when, how and why. This is nothing short of a defining work on web application security as it applies specifically to PHP. While this book does not cover using encoders (like the Zend Encoder or IonCube Encoder) to heighten security in a plain-text scripting language, every other topic you would expect to be covered is treated -- above all -- with accuracy, and all in just over a hundred pages. Where other authors might potificte to fill pages, Chris crafted this book to live up to its title -- it is indeed essential, distilled, and precise. Therefore there is little excuse from this point on to not have read it at least once, and thumb through it from time to time when developing or auditing a PHP application. I intend to make it required reading in my department, and recommend it highly to colleagues in other companies developing web applications in PHP.