Question

I am trying to write a website that has user accounts. There isn’t much sensitive information other than the password and email address. But I don’t really understand what I’m doing; I’m kind of hacking it along as I go. Is there anything I should be keeping in mind with respect to security or any other important details?

Answer 1

You should:

• encrypt sensitive data
• avoid:
  • avoid sql injection
  • Session hijacking
  • Session fixation

Recommended Reading:

PHP Security Guide