diff --git a/_includes/input-filtering.md b/_includes/input-filtering.md deleted file mode 100644 index 5102abc..0000000 --- a/_includes/input-filtering.md +++ /dev/null @@ -1,15 +0,0 @@ -# Input Filtering - -Never ever (ever) trust foreign input introduced to your PHP code. That leads to dark and dangerous places. Instead, always filter foreign input before you use it in your code. - -PHP provides the `filter_var` and `filter_input` functions to help you do this. These two functions can sanitize text, verify formats (e.g. email addresses), and escape characters. - -For example, if you accept code from an HTML form, you'll want to use `filter_input` before inserting the input into a database or inserting the input into an HTML response. - -* [Learn about `filter_var`][1] -* [Learn about `filter_input`][2] - -[Back to Top](#top){.top} - -[1]: http://php.net/manual/en/function.filter-var.php -[2]: http://www.php.net/manual/en/function.filter-input.php diff --git a/_includes/popular-frameworks.md b/_includes/libraries-and-frameworks.md similarity index 90% rename from _includes/popular-frameworks.md rename to _includes/libraries-and-frameworks.md index e8ea6d0..ba32489 100644 --- a/_includes/popular-frameworks.md +++ b/_includes/libraries-and-frameworks.md @@ -1,10 +1,12 @@ -# Popular Frameworks +# Libraries and Frameworks + +## Web Frameworks Rather than re-invent the wheel, many PHP developers use _frameworks_ to build out web applications. Frameworks abstract away many of the low-level concerns and provide helpful, easy-to-use interfaces to complete common tasks. _You do not need to use a framework for every project_. Sometimes, plain PHP is the right way to go. But if you do need a framework, here are a few of the most popular ones (in alphabetical order): -## Full-Stack Frameworks +### Full-Stack Frameworks * [CakePHP](http://cakephp.org/) * [CodeIgniter](http://codeigniter.com/) @@ -16,11 +18,10 @@ _You do not need to use a framework for every project_. Sometimes, plain PHP is * [Yii](http://www.yiiframework.com/) * [Zend](http://framework.zend.com/) -## Micro Frameworks +### Micro Frameworks * [Fat-Free](http://bcosca.github.com/fatfree/) * [Limonade](http://limonade-php.github.com/) * [Silex](http://silex.sensiolabs.org/) * [Slim](http://www.slimframework.com/) -[Back to Top](#top){.top} diff --git a/_includes/passwords.md b/_includes/passwords.md deleted file mode 100644 index efe1b78..0000000 --- a/_includes/passwords.md +++ /dev/null @@ -1,17 +0,0 @@ -# Password Hashing with Bcrypt - -Eventually everyone builds a PHP application that relies on user login. Usernames and (hashed) passwords are stored in a database and later used to authenticate users upon login. - -It is important that you properly _hash_ passwords that are stored in a database. If passwords are not hashed, and your database is hacked or accessed by an unauthorized third-party, all user accounts are now compromised. - -**Hash passwords with Bcrypt**. It's super simple, and (for all intents and purposes) Bcrypt makes it impossible for someone to reverse-engineer the plain-text version of a password should the database be compromised. - -There are several Bcrypt libraries for PHP that you may use. - -* [Read "How to Safely Store a Password" by Coda Hale][1] -* [Use Bcrypt with PHPAss][2] (odd name, I know) - -[Back to Top](#top){.top} - -[1]: http://codahale.com/how-to-safely-store-a-password/ -[2]: http://www.openwall.com/phpass/ diff --git a/_includes/links-and-resources.md b/_includes/resources.md similarity index 90% rename from _includes/links-and-resources.md rename to _includes/resources.md index 249b512..e9e22c3 100644 --- a/_includes/links-and-resources.md +++ b/_includes/resources.md @@ -1,6 +1,4 @@ -# Links and Resources - -Here are some miscellaneous resources that are worth a read. +# Resources ## From the Source diff --git a/_includes/security.md b/_includes/security.md new file mode 100644 index 0000000..6938b6d --- /dev/null +++ b/_includes/security.md @@ -0,0 +1,43 @@ +# Security + +## Web Application Security + +There are bad people ready and willing to exploit your web application. It is important that you + take necessary precautions to harden your web application's security. Luckily, the fine folks at [The Open Web Application Security Project][1] (OWASP) have compiled a comprehensive list of known security issues and methods to protect yourself against them. This is a must read for the security-conscious developer. + +* [Read the OWASP Security Guide][2] + +[1]: https://www.owasp.org/ +[2]: https://www.owasp.org/index.php/Guide_Table_of_Contents + +## Password Hashing with Bcrypt + +Eventually everyone builds a PHP application that relies on user login. Usernames and (hashed) passwords are stored in a database and later used to authenticate users upon login. + +It is important that you properly _hash_ passwords that are stored in a database. If passwords are not hashed, and your database is hacked or accessed by an unauthorized third-party, all user accounts are now compromised. + +**Hash passwords with Bcrypt**. It's super simple, and (for all intents and purposes) Bcrypt makes it impossible for someone to reverse-engineer the plain-text version of a password should the database be compromised. + +There are several Bcrypt libraries for PHP that you may use. + +* [Read "How to Safely Store a Password" by Coda Hale][3] +* [Use Bcrypt with PHPAss][4] (odd name, I know) + +[3]: http://codahale.com/how-to-safely-store-a-password/ +[4]: http://www.openwall.com/phpass/ + +## Input Filtering and Sanitizing + +Never ever (ever) trust foreign input introduced to your PHP code. That leads to dark and dangerous places. Instead, always filter foreign input before you use it in your code. + +PHP provides the `filter_var` and `filter_input` functions to help you do this. These two functions can sanitize text, verify formats (e.g. email addresses), and escape characters. + +For example, if you accept code from an HTML form, you'll want to use `filter_input` before inserting the input into a database or inserting the input into an HTML response. + +* [Learn about `filter_var`][5] +* [Learn about `filter_input`][6] + +[5]: http://php.net/manual/en/function.filter-var.php +[6]: http://www.php.net/manual/en/function.filter-input.php + +[Back to Top](#top){.top} diff --git a/_includes/web-application-security.md b/_includes/web-application-security.md deleted file mode 100644 index 8619d74..0000000 --- a/_includes/web-application-security.md +++ /dev/null @@ -1,11 +0,0 @@ -# Web Application Security - -There are bad people ready and willing to exploit your web application. It is important that you - take necessary precautions to harden your web application's security. Luckily, the fine folks at [The Open Web Application Security Project][1] (OWASP) have compiled a comprehensive list of known security issues and methods to protect yourself against them. This is a must read for the security-conscious developer. - -* [Read the OWASP Security Guide][2] - -[Back to Top](#top){.top} - -[1]: https://www.owasp.org/ -[2]: https://www.owasp.org/index.php/Guide_Table_of_Contents diff --git a/_layouts/default.html b/_layouts/default.html index e8b67aa..ff07627 100644 --- a/_layouts/default.html +++ b/_layouts/default.html @@ -35,14 +35,12 @@
  • Code Style Guide
  • Namespaces
  • Dependency Management
    • -
  • Input Filtering
  • Databases and PDO
    • -
  • Password Hashing with Bcrypt
    • -
  • Web Application Security
    • +
  • Security
  • Testing
  • Command Line Interface
    • -
  • Popular Frameworks
    • -
  • Links & Resources
    • +
  • Libraries and Frameworks
    • +
  • Resources
    • Tweet diff --git a/index.html b/index.html index 8733799..e4e4fa8 100644 --- a/index.html +++ b/index.html @@ -14,26 +14,20 @@ layout: default {% capture dependencies_content %}{% include dependency-management.md %}{% endcapture %} {{ dependencies_content|markdownify }} -{% capture inputfiltering_content %}{% include input-filtering.md %}{% endcapture %} -{{ inputfiltering_content|markdownify }} - {% capture databases_content %}{% include databases.md %}{% endcapture %} {{ databases_content|markdownify }} -{% capture security_content %}{% include web-application-security.md %}{% endcapture %} +{% capture security_content %}{% include security.md %}{% endcapture %} {{ security_content|markdownify }} -{% capture passwords_content %}{% include passwords.md %}{% endcapture %} -{{ passwords_content|markdownify }} - {% capture testing_content %}{% include testing.md %}{% endcapture %} {{ testing_content|markdownify }} {% capture cli_content %}{% include command-line-interface.md %}{% endcapture %} {{ cli_content|markdownify }} -{% capture frameworks_content %}{% include popular-frameworks.md %}{% endcapture %} +{% capture frameworks_content %}{% include libraries-and-frameworks.md %}{% endcapture %} {{ frameworks_content|markdownify }} -{% capture links_content %}{% include links-and-resources.md %}{% endcapture %} -{{ links_content|markdownify }} +{% capture resources_content %}{% include resources.md %}{% endcapture %} +{{ resources_content|markdownify }}