[How-To] PHP Security

[robmiller]

You could stick this in too:

if(!preg_match('#^/index.php.*#', $_SERVER['REQUEST_URI'])) {
    die('You cannot view this page directly.');
}

but this all seems like a lot of hassle when you could just use Smarty/include a header and footer.

 

[robmiller]

Well the slashes actually get added to content, so you end up seeing things like

Hello, I\'m Rob!

getting written on pages and stuff. The headache comes in when you try and deal with them, since you have to do different things to your input depending on whether magic quotes is on or not.

 

[robmiller]

Turn it off if you possibly can, it makes life much easier.

 

[robmiller]

Can this get archived since it's not a sticky anymore please?

Cheers