Question

Does anyone know of a good security checklist before launching a CodeIgniter application.
We have tested for known PHP security flaws and are wondering if there are any measurements to be taken when launching a CodeIgniter app.

We’ve been specifically asked by the client to build the application based on the CI framework and we have done decent PHP security testing.

Basically, is there a list of things we should check which might cause a problem if there’s a configuration in our CI config setup?

Answer 1

The main three attacks are:

1. SQL injection attacks: make sure you don’t use non-parametrized SQL queries
2. XSS attacks: make sure that all user contents that are eventually echo-ed back anywhere have their tags stripped properly (for example use xss_clean as a format modifier).
3. CSRF attacks: Use CI’s CSRF protection token for all forms that gets sent

Also make sure the authentication mechanism is in place.

If they are fine, then check the known bugs for your version of PHP, and probably upgrade your server to use the latest available.