YuCheng Hu
fb7ac409dd
+YUCHENG HU+ git-svn-id: https://svn.code.sf.net/p/hawebs/svn@465 a2543c7e-f6e9-4f8a-8bff-1ffc34733512
90 lines
2.6 KiB
Plaintext
90 lines
2.6 KiB
Plaintext
## PHPSECINFO
|
|
|
|
*Now on GitHub*
|
|
|
|
_see LICENSE for copyright and license info_
|
|
|
|
Mailing List for bug reports, feedback, etc:
|
|
http://lists.phpsec.org/mailman/listinfo/phpsecinfo
|
|
|
|
|
|
### WHAT IS PHPSECINFO?
|
|
PHPSecInfo is a PHP environment security auditing tool modeled after the
|
|
phpsecinfo() function. From a single function call, PHPSecInfo runs a
|
|
series of tests on your PHP environment to identify potential security
|
|
issues and offer suggestions. It can be useful as part of a multilayered
|
|
security approach.
|
|
|
|
|
|
#### WHAT IS PHPSECINFO NOT?
|
|
* It is not a replacement for secure coding practices
|
|
* It does not audit PHP code
|
|
* It is not comprehensive test for either your hosting environment
|
|
or your web application
|
|
* It is not the "final word." PHPSecInfo identifies *potential* problems
|
|
and offers suggestions for improvement. Your environment may _require_
|
|
certain settings that trigger cautions or warnings.
|
|
|
|
|
|
### HOW DO I USE PHPSECINFO?
|
|
|
|
The simplest way:
|
|
|
|
* Uncompress and upload the contents of the archive to your web server's
|
|
document root
|
|
* Open a browser and view the index.php file where you've uploaded the files
|
|
(probably something like http://www.yourdomain.com/phpsecinfo/index.php)
|
|
|
|
|
|
### WHAT DO I DO IF I GET A NOTICE OR WARNING?
|
|
|
|
Read the explanation of the result carefully. Research the issue on-line
|
|
-- resources like the php.net official docs and the PHP Security Guide are
|
|
very useful. Investigate why your environment is set up in such a way. If
|
|
there's not a compelling reason to keep it as-is, you should probably
|
|
|
|
A by no means comprehensive list of resources to get your started:
|
|
|
|
Web Sites:
|
|
http://www.php.net/manual/en/security.php
|
|
http://phpsec.org/projects/guide/
|
|
|
|
Books:
|
|
http://phparch.com/pgps
|
|
http://phpsecurity.org/
|
|
http://apachesecurity.net/
|
|
|
|
|
|
### HOW CAN I CUSTOMIZE THE OUTPUT OF PHPSECINFO?
|
|
|
|
PHPSecInfo is intended to be used as a self-contained tool. However, you
|
|
can obtain the test results in an array and then present this data in your
|
|
preferred format.
|
|
|
|
Example:
|
|
<code>
|
|
require_once('PhpSecInfo/PhpSecInfo.php');
|
|
// instantiate the class
|
|
$psi = new PhpSecInfo();
|
|
|
|
// load and run all tests
|
|
$psi->loadAndRun();
|
|
|
|
// grab the results as a multidimensional array
|
|
$results = $psi->getResultsAsArray();
|
|
echo "<pre>"; echo print_r($results, true); echo "</pre>";
|
|
|
|
// grab the standard results output as a string
|
|
$html = $psi->getOutput();
|
|
|
|
// send it to the browser
|
|
echo $html;
|
|
</code>
|
|
|
|
|
|
### HOW CAN I OFFER FEEDBACK, REPORT BUGS, COMPLAIN, ETC.?
|
|
|
|
The best way is to subscribe to and post on the PHPSecInfo Mailing List:
|
|
|
|
http://lists.phpsec.org/mailman/listinfo/phpsecinfo
|