Hi,
Developing a website is not as easy as it may look or sound. Every time you write a code you need to keep two things in mind. Most important performance and security. In my earlier posts(also see compression and caching) I had discussed about performance. In this I will explain the most common security failures in a life of a programmer.
To start with, no one or nothing can teach you how to create a hack proof system. Here is the fact. Everything is hackable, every security can be breached. But what best you can do is to mislead the hacker. There is always someone somewhere who knows more than you, and can break into your system. So the best plan is to stick to few basic rules.
HTACCESS - Security
1. Never use actual URL's.
Always try to mask the URL using htaccess. For example you have an image:
<img src="img/logo.jpg" /> now, instead of "img", keep the "logo.jpg" in some other directory with a name not easily identifiable, such as "assets/image_lib", where assets is a directory and images_lib the subdirectory. Now to make "images/logo.jpg" point to "assets/image_lib/logo.jpg", create a .htaccess in root directory with the following URL rewrite:
RewriteEngine on
RewriteRule ^img/(.*).(jpg|png|gif|jpeg)$ assets/image_lib/$1.$2 [L]
2. Forbid Directory
Even if someone gets to know the actual directory, prevent from seeing the content of the directory, for this create a new .htaccess file inside the directory whose access you want to forbid with the following:
Developing a website is not as easy as it may look or sound. Every time you write a code you need to keep two things in mind. Most important performance and security. In my earlier posts(also see compression and caching) I had discussed about performance. In this I will explain the most common security failures in a life of a programmer.
To start with, no one or nothing can teach you how to create a hack proof system. Here is the fact. Everything is hackable, every security can be breached. But what best you can do is to mislead the hacker. There is always someone somewhere who knows more than you, and can break into your system. So the best plan is to stick to few basic rules.
HTACCESS - Security
1. Never use actual URL's.
Always try to mask the URL using htaccess. For example you have an image:
<img src="img/logo.jpg" /> now, instead of "img", keep the "logo.jpg" in some other directory with a name not easily identifiable, such as "assets/image_lib", where assets is a directory and images_lib the subdirectory. Now to make "images/logo.jpg" point to "assets/image_lib/logo.jpg", create a .htaccess in root directory with the following URL rewrite:
RewriteEngine on
RewriteRule ^img/(.*).(jpg|png|gif|jpeg)$ assets/image_lib/$1.$2 [L]
2. Forbid Directory
Even if someone gets to know the actual directory, prevent from seeing the content of the directory, for this create a new .htaccess file inside the directory whose access you want to forbid with the following:
