craeonics
Member
OP
Lemme think these ones over. <br /> <br />1. "all included files below root" - Would work, though I think there´s no real need for it. PHP files are secure enough, since they will always be parsed, unless someone hack into your ftp. <br /> <br />2. "never send datbase modifying request in query strings" - I suppose you mean in an url. Certainly wise. <br /> <br />3. "register_globals off" - Something which should not be necessary if you make sure you initialise all your potentially dangerous variables before use. <br /> <br />4. "special requests via $_POST" - Good. I handle almost requests via POST. Note that $_POST can be simulated, so always check what´s coming in. <br /> <br />5. "password protecting the admin dir" - Another good decision. <br /> <br />Another thing you could do is to check if someone has the correct privileges to do what he or she is planning on doing. Say you have a block of code that deletes something, always check if the user that is trying to delete something is entitled to do so. This of course would require some kind of user system, with login and so on.
