Web Application Development with PHP 4.0

Security Considerations

Example 1. In early 1999, we performed a Web site audit for a leading online job database. During the analysis, we discovered a security issue that left us speechless. The Web site had an associated online shop where visitors could buy books related to the topic of job hunting. The shop had been developed by an independent contractor who had already built several other online stores based on his Perl scripts and had made available on his Web site a demo including significant parts of the source code. Each time a visitor ordered an item, a plaintext file was generated, containing all order information, even credit card data—all unencrypted. And not only that, the files were stored on a publicly visible directory on the ...