Re: [PHP] PHP Security: Best Practices

2011-08-08 Thread Richard Quadling
On 8 August 2011 15:08, Jen Rasmussen wrote: > Hello all, > > > > I am currently researching security best practices/methods. Can anyone offer > any current resources/recommendations? > > My research thus far has included password hashing with salting/stretching, > session hash defaults, session m

Re: [PHP] PHP Security: Best Practices

2011-08-08 Thread Fredric L. Rice
> I am currently researching security best > practices/methods. Can anyone offer > any current resources/recommendations? That is a huge arena and the question can not be answered very well without describing what you are needing to protect. Security in debth depends upon what you are protecting a

RE: [PHP] PHP Security: Best Practices

2011-08-08 Thread Jen Rasmussen
Thanks, Andrew! I am unfortunately not even running 5.2..so that helps. Jen -Original Message- From: Andrew Ballard [mailto:aball...@gmail.com] Sent: Monday, August 08, 2011 9:57 AM To: j...@cetaceasound.com Cc: php-general@lists.php.net Subject: Re: [PHP] PHP Security: Best Practices

Re: [PHP] PHP Security: Best Practices

2011-08-08 Thread Andrew Ballard
On Mon, Aug 8, 2011 at 10:08 AM, Jen Rasmussen wrote: [snip] > > On a side note, PHP versions prior to 5.3+ do not allow to set the httponly > flag as a cookie parameter, is there any acceptable alternative for this? I believe that has been supported since 5.2.0. As for a workaround for versions