It no longer is a question of whether you should care or not, internet security and hacking have become a global phenomenon; with all the world leaders getting involved in the discussion. But, the hard part comes down to developers and programmers themselves, the very people who create and build applications and projects.
Groups like Lizard Squad are calling the shots on every major industry out there, and it goes to show just how much power a single individuality can hold over other businesses, corporations, or simply web applications.
Here is a small report on how to choose a programming language that’s secure, but why swap a programming language if you’re accustomed to PHP? Frankly, you’ve learned the ins and outs of your the language you work with.
Check out this article from 2012 to see how you can apply a special technique when it comes to checking your code against security issues, but if that doesn’t work out..here is a set of libraries and tools that you can use to check your code and projects immediately.
1. TCrypto
TCrypto is a simple and flexible PHP 5.3+ in-memory key-value storage library. By default, a cookie will be used as a storage backend.
TCrypto has been designed from the ground up with security in mind. Safe algorithms and modes. Automatic and safe initialization vector creation. Encryption and authentication key creation (Keytool) using strong randomness. Key rotation (versioned keys).
2. HTML Purifier
What is PHP without HTML, right? Well, HTML has got problems on its own, particularly in the field of malicious code execution, otherwise known as XSS (Cross-Site Scripting), so by using this library you’re not only getting rid of all the possibilities of having your HTML injected, you also get an automatic transformation of your code to be compliant with the latest W3C standard. How great is that?
3. PHP-Intrusion Detection System
PHPIDS might have a comprehensive name for itself, but it’s actually a very easy to use library that can check your PHP built web application against common and not so common security problems. The idea is that PHPIDS helps you to see exactly who is attacking your site, and how he is doing it. Avoid having to go through logs manually for hours upon hours, use PHPIDS to see the stuff that matters.
4. SensioLabs Security Check
Composer is already a part of every PHP developers ecosystem, so this tool is almost essential to both beginners and experienced PHP coders. The way it works is quite simple, you upload your .lock file and it does the rest for you. If you look at the stats, the numbers of vulnerabilities found is quite staggering, don’t be surprised if your own projects might output some nasty stuff that you have missed.
5. OWASP Zed Attack Proxy Project
The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing.
If you’re security conscious, then you will already know how experienced the OWASP security group is, and their testing tool is no exception. It was also recognized as one of the leading security tools that you can find on the web right now.
6. SecurityMultiTool
This is another major library that doesn’t necessarily work with PHP directly, but does work on several important issues, including: HTML Output Escaping, Sanitization, Sanitized Markdown and BBCode Parsers, Anti Timing-Attack String Comparison and more.. Give it a go at least once to make sure that you see what it can do for your code.
7. phpseclib
Need to encrypt a lot of stuff, but need a variety of encryption methods to do it? phpseclib is an amazing project that will allow you to encrypt and protect all parts of your code in a matter of minutes. Easy to use and configure, literally just works.
Keeping Your PHP Projects Secure
That is a fair amount of tools for any developer to be working with, but we highly encourage that you check out at least some of them, and do some scans on your past projects; perhaps to learn what better measures could be taken in terms of having a better code base.
Every library on this list is going to improve your code by at least a small margin, and like we talked about at the beginning of the post; internet security is a pretty big thing now, make sure you’re educated.
Alex, useful post and thanks for the call out. We’re keen to to build a great service for Nodies from enthusiast to hard-core pros. Do let us know if we can do to make the service even better for you.
We are a small company doing Xen Orchestra, and we **love** Node! It radically changes our way to build a software: everything is faster and easier to maintain than before.