Some time ago I created this LAMP based web. At the time I wrote my own user authentication and access control system. It checks whether the user logged in with a correct password, and whether or not he/she has the correct permission level to access given page. State information is handled via PHP sessions while usernames, salted, hashed passwords and user level are stored in a MySQL back end. All the user inputs are sanitized and etc. Users must access the site wtith SSL.
The problem is that I’m starting to second guess myself and am becoming paranoid about security. So I’m looking for ways to improve it.
Can you give me suggestions for:
- some comprehensive lists of security tests I could implement and run against it
- best practices for implementing this sort of system
Is there a robust open source framework or library set that you could recommend using instead a home grown one? The conventional wisdom is that it is usually better to adopt a mature, tested system than write your own from scratch. What would you recommend?
1) Since you already wrote your own from scratch I would not throught it away and waste your time and effort to integrate a new external open source framework.
Code written by others might not be necessary better than your one, moreover you might not completly understand how to integrate it properly therefor you might add even more secuirty holes to your application.
2) This is a good and short 3 pages guide (unfortunately it’s in italian, but you can use Google translator toolbar to translate the all pages)
Anyway from what you say you don’t seem to be a newby to PHP programming, i would reccomend: