Question

I am nearly finished a web application. I need to test it and find the security issues before it release. Is there any methods / guideline to do this kind of testing? Or is there any tools to help me check my application is ready to go online? Thank you.  

Answer 1

I would say:

1. check that there are no warnings or errors even in strict mode (error report).
2. In case you store any sensitive data (as passwords, credit cards, etc.) be sure they are encrypted with non-standard algorithms. Use SSL and try to be somehow paranoid with it.
3. Set your database with specific accesses by action and hosts, and do not use root account.
4. Perform exhaustive testing (use unit test when possible). Involve as many people you can.
5. Test it under the main browsers (Firefox, Chrome, Opera, Safari, IE) and if have time in others.
6. Validate all your HTML/CSS against standards (W3C). (recommendable)
7. Depends on the platform you are using, there are profilers which can help you identify bottlenecks in your code. (can be done in later stages).
8. Tune settings for your web server / script language.
9. Be sure it is search-engine friendly.
10. Pray once is online 🙂

This is not a complete list as it depends in:

• which language/platform/web server you are using.
• what kind of application you developed (social, financial, management, etc.)
• who will use that application (the entirely world, an specific company, your family or just you).
• are you going to sell it? then you must have at least most of the previous points.
• is your application using very sensitive information (as credit cards)? if so, you should pay for some professional (company?) to check your code, settings and methods.

This is just my opinion, take it as it is. I would also like to hear what other people suggests.

Good Luck