Web Application Security

This is a list of common security concerns for web applications that can be or should be solved at the application development level with a focus on PHP solutions.

See Security relating to Shared Hosts or Compromised Systems for information on securing PHP application in shared hosting situations.

• A Catalog of Security Vulnerabilities - Bad Security Smells.
• A Catalog of Security Attacks - Attacks against PHP Applications and how to foil them.
• A Catalog of Security Sensitive Functions - A List of PHP functions and their security implications.
• A Catalog of Secure Practices - Best practices for secure applications.

• PHP Security Workbook
• PHPSecure:Security
• PHP Manual:Security
• A Study in Scarlet (French Translation)
• PHP and the OWASP Top Ten Security Vulnerabilities
• PHP Security, Part 1
• PHP Security, Part 2
• PHP Session security
• The Truth about Sessions
• Web Security - Angriffsmethoden und ihre Folgen (German)
• SecurePHP - A PHP security wiki

• Best Practices in Managing HTTP Based Client Sessions
• OWASP Guide to Building Secure Web Applications
• Best Practices for secure development (PDF)
• Anti intrusion detection tactics
• Improving web application security:threats and countermeasures (PDF)
• Best Practices on Securing Custom HTML Authentication Procedures
• Url Encoded Attacks
• Passive Information Gathering - analysis of leaked security information
• Header Based Exploitation: Web Statistical Software Threats
• ISO 17799 Security Development Wiki
• Security at the next level
• Know Your Enemy - The Tools and Methodologies of the Script Kiddie
• MSDN - Improving Web Application Security
• Making Sense of Security
• Best Practices for Securing Your Backup Data