php页面的安全性[关闭]

Question

If I need to design an interface in php that has to be online and needs a database beside and I am the only one that has to use it. What kind of protection should I implemet more than: - limited the ip address access to the php page - using a login/password with relatives controls - using a session variable

The purpose is to design my own accounting program.

Answer 1

If the DB and Web Server are the same box:

1. Firewall everything so that only Port 80 and Port 443 are open to the public. This way only your PHP Scripts can interact with the DB.
2. Redirect any HTTP traffic to HTTPS to ensure secure connection between Client Browser and Web Server.
3. Store sensitive data in the DB with encryption. This will help ensure that if someone does perform injection, they cannot see plain text info.

If they are on separate servers, do the same things, just make sure there is a secure connection between the two.