diff --git a/lang/en/docs/coding.html b/lang/en/docs/coding.html index 725371c9c48..8983869a63b 100755 --- a/lang/en/docs/coding.html +++ b/lang/en/docs/coding.html @@ -220,6 +220,45 @@ GOOD: $assignments (for an array of objects)
  • Most tables should have a timemodified field (INT10) which is updated with a current timestamp obtained with the PHP time() function.
    • +

     

    +

    Security Issues (and handling form and URL data)

    +
      +
    1. Do not rely on 'register_globals'. Every variable must be + properly initialised in every code file. It must be obvious where the variable + came from
      2. +
    2. Initialise all arrays and objects, even if empty. $a = array() + or $obj = new stdClass();.
      3. +
    3. Do not use the optional_variable() function. Use the optional_param() + function instead. Pick the correct PARAM_XXXX value for the data type you expect. To check and set an optional + value for a variable, use the set_default() function.
      4. +
    4. Do not use the require_variable() function. Use the required_param() + function instead. Pick the correct PARAM_XXXX value for the data type you expect.
      5. +
    5. Do not use $_GET, $_POST or $_REQUEST. Use the + appropriate required_param() or optional_param appropriate to your need.
      6. +
    6. Do not check for an action using something like if (isset($_GET['something'])). + Use, e.g., $something = optional_param( 'something','',PARAM_ALPHA ) and test with + empty() function
      7. +
    7. Wherever possible group all your required_param(), optional_param() + and other variables initialisation at the beginning of each file to make them easy to find.
      8. +
    8. Use 'sesskey' mechanism to protect form handling routines from attack. When form is generated, + include <input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />. + When you process the form check with if (!confirm_sesskey()) {error('Bad Session Key');}.
      9. +
    9. All filenames must be 'cleaned' using the clean_filename() function, if this + has not been done already by appropriate use of required_param() or optional_param() +
      10. +
    10. Any data read from the database must have addslashes() applied to it before it + can be written back. A whole object of data can be hit at once with addslashes_object().
      11. +
    11. Wherever possible, data to be stored in the database must come from a POST + data (ie, data from a form) as opposed to GET data (ie, data from the URL line).
      12. +
    12. Do not use data from $_SERVER if you can avoid it. This has portability + issues.
      13. +
    13. If it hasn't been done somewhere else, make sure all data written to the database has + been through the clean_param function using the appropriate PARAM_XXXX for the datatype.
      14. +
    14. If you write custom SQL code, make very sure it is correct. In particular watch out for + missing quotes around values. Possible SQL 'injection' exploit.
      15. +
    15. Check all data (particularly that written to the database) on every + page it is used. Do not expect or rely on it being done somewhere else.
      16. +

    Moodle Documentation

    Version: $Id$