Matthew Weir O'Phinney has posted one of his own security tips to the Zend Developer Zone today involving the use of a database abstraction layer to help prevent SQL injections in your application.

SQL injections are a common vulnerability in web-based applications that use databases. [...] There are several methods to prevent this type of attack.

He gives three helpful hints for SQL injection prevention:

• Use your database extension's quoting mechanism to quote values prior to executing a query
• Use PDO's prepared statements support
• Use a database abstraction layer (DAL), such as AdoDB, PEAR::MDB2, or Zend_Db.

The latest Security Tip has been posted on the Zend Developer Zone about the importance of the SecurityFocus newsletter.

Today's PHP security tip is short, sweet and easily actionable. It fits in well with the theme of the last one, to stay vigilant. Here's another resource for you to consider: If you are not already subscribed, you should subscribe to the Security Focus newsletter.

He links to their signup page and points out the most useful of their offerings - the BugTraq list.

BugTraq is a full disclosure moderated mailing list for the detailed discussion and announcement of computer security vulnerabilities: what they are, how to exploit them, and how to fix them.

The Zend Developer Zone has posted yet another in their running series of security tips to help you safeguard your applications - Tip #20 concerning security resources to check into.

To paraphrase an American Patriot "The price of security is eternal vigilance". You have to keep watch over your system but you also have to keep learning. Today's security tip is a list of resources to help you keep your security knowledge up to date. I've gathered together several resources for you to consider when looking for PHP Security information.

Resources Cal recommends include Chris Shiflett's book "Essential PHP Security", the APress "Pro PHP Security" from Chris Snyder, and more. Of course, he also recommends their own Security Tips series for helpful hints as well.

The Zend Developer Zone has posted their latest security tip today - this time dealing with the actual connection your application sits on (from Chris Hartjes).

The most secure application is one with no connection to the outside world.

As we've covered, you can't really disconnect the network from your web server if you are building web applications. You can however, carefully consider which servers need to be connected to the outside world and which can be inside your firewall. Beyond that, you can also evaluate how those servers that have to remain outside your firewall communicate with the ones inside.

No, his suggestion is not to take your application "off the grip" but more to limit access to things like database servers to help protect the data that lives inside it.

The Zend Developer Zone continues their great series of security tips with two new posts - one talking about when to focus on security and the other about file uploads.

From the first, top 17:

Application security should not be a "when all else fails" situation. It's not something you can "put in later". As we've mentioned before, there is no single silver bullet to solve your application security issues. Security is something that should be rolling around in the back of your dead in the design phase, the coding phase, the testing phase, even after you've rolled your code into production.

And, from tip #18:

When you allow users to upload files, your system may be at risk. Always restrict the file types that you allow. Don't rely on a blacklist approach. [...] Be careful with file uploads and make sure you protect them with a whitelist policy instead. Make sure that the file that has been uploaded is of the type that you want to allow.

The Zend Developer Zone has their latest security tip posted for all of you eagerly awaiting more words of wisdom. This time, it's on a topic near and dear to Zend's heart - keeping your framework up to date.

Make sure any framework you are using is updated regularly. This is especially important if you are working on a 'one-shot' client project. It is important to think about who is going to maintain the site if (or rather: when) a security patch is issued for any of the 3rd party files.

Using frameworks is generally a good idea '" not only because they take a lot of the work away from you, but also because any potential security issue will (usually) quickly be dealt with.

Cal also talks about the other side of the coin - that the openness a framework can have can allow for would-be attackers to find the holes and issues in your site much easier.

The Zend Developer Zone has posted security tip #15 today, focusing on an easily forgotten aspect of web development (not just in PHP) - forgetting to remove temporary files.

As developers, most of us are very messy. I've worked on countless projects and at each either run across or left a trail of diagnostic files laying around. (info.php, test.php, doMe.php, etc.) These tiles, if found by someone with nefarious intent, can leak valuable information about your system.

Always remember to remove these types of files...as Cal puts it:

It would be a shame to spend all that time securing your application only to leave info.php or worse yet, a "quick piece of code" in test.php that could potentially leak dangerous information about your system. Don't help the ad guys any more than you have to.

The Zend Developer Zone continues their great series of tips today with the latest - #14 - a tip concerning the consideration of the overall security of your application (there's a mouthful).

Almost any application running PHP on the back-end uses web technologies for it's front end. Many developers who think hard on PHP security, don't spend a thought on front-end security for their application.

The specific example they give is a frontend issue, a Javascript cookie. Ensure that any data you put inside a cookie is safe. No matter what, do not put anything sensitive in its contents.

The Zend Developer Zone has posted three new helpful security tips to add to their growing list - one on mailing, one about working with privileges, and the other on the dangers of eval:

• In tip #10, Cal looks briefly at some of the dangers of blindly using form input when sending a mail. One never knows what kind of nasty headers a user might enter.
• Tip #11 recommends the "path of least privileges" when it comes to allowing access to your application. Don't go global when simple will do just fine - even with the best of intentions, the wrong access can lead to big issues.
• Finally, in tip #12, one of the more discouraged functions in PHP is discussed - eval. This one little function, when fed the wrong kind of string, can unravel your application from the inside out and provide a would-be attacker just the opening they might need.

You can check out more great security tips like these on the Zend Developer Zone website.

The Zend Developer Zone has the latest two of their security tips posted today - numer #8 and #9 - in their "PHP Security Tips" series.

• In tip #8, they restate and reinforce a topic that's worth repeating - validating user input. They use the filter_var function as a simple, light way to start filtering your user's input.
• Tip #9 suggests that you keep anything sensitive, anything at all that needs to be kept away from prying eyes, outside of your document root of the site.