Hello all,
I am all set to launch a website on which i have been working from months but now am afraid how safe it might be once it gets attention of hackers . As most of the code in website is in PHP,html,mysql i am posting this in this forum so that i can get suggestions from you all. Websites that are developed by Big companies might undergo testing from various testing tools , tests from hired ethical hackers ,etc, before getting launched where as what about websites that cant afford all those expensive methods. I understand that without undergoing all those procedures no website could be hacker safe but any suggestions about measures to be taken before launching a website would be appreciated.
Thank you all in advance.

Ask your self

1. Did you do everything to prevent SQL injection
2. Do you use id values as indentificators, did you secure option for array exploit
3. Are you using RSS feeds, are they secure
4. Hosting, who is responsible for website security? You or your web hosting company? Are the folder permission set correctly?

That is just few things you should look into...

Take a look here for a couple of small functions that will help you, in terms of handling user input.

Also, if you're passing a variable from $_GET, then you can use a type-finding function to help your security. Eg. if you have something like "?id=53" in your URL, then you can just check it using the isnumeric() function. Then no hackers will have a chance.

Remember, if you have no user input, then you'll be perfectly safe. But if you have input, then remember the number one security rule (well, mine, anyway): you can never trust the user.

hello see this article is really nice:
http://info.ssl.com/article.aspx?id=10068
http://webdesign.about.com/od/ecommerce/a/aa070407.htm
And keep in mind:
->encode and decode your passwords perfectly..
->be careful about using trusted payment gateways...
->be away of sql injections..

Thank you peter_budo, Demiloy and Shanthi for your time.
I shall look into all those security measures now and shall make sure I complete all of them before releasing the site.
If anybody knows some more security measures that are to be taken before launching a website please share them here.
Appreciate your time in advance

Thank you

[QUOTE=peter_budo;666783][list=1]
[*]Do you use id values as indentificators, did you secure option for array exploit


Hi peter_budo,

Can you please tell what are indentificators..

Thanks in advance

I can not remember exactly what was it but it had something to do with "id" passing values in following format WEB_ADDRESS/page.php?id=32, when adding square brackets [] after "id" will show site structure. I will try to find where I read about it and let you know.

Again, I think if you just check it using is_numeric, you should be fine.

thnx Demiloy & Peter_budo I made use of is_numeric().

Now,
when user manipulates the url like,

when the url is www.example.com/xyz.php/userid=22

how to avoid displaying results when user changes the userid from 22 to someother number in the url.

Basically, my site has a search page, when on submitting the username in search, if username exists then linnk is given.

when clicked ,www.example.com/xyz.php/userid=22 appears in the address bar.

how to avoid displaying results when users manipulates the userid there?

Anyhelp is apreciated.

Thankyou all.

You do not want to keep user identification as part of the URL. Put these data into session.