Search code examples
phpsecuritymembership

what security features of a php membership system

just like the title says, what are the most common security features of a php based membership system. A few I know:

  • mysql injections
  • secured connection
  • encrypted password(s) and other sensitive data.

What else?

Solution

  • Some other things to think about:

    • Session security (How are session variables set? Can someone's session ID be stolen? Is session fixation possible?)
    • Are your forms protected against XSS?
    • Do you have any mechanism to prevent brute-force attacks, like locking out an IP address after X failed attempts? Do you need to keep track of who logs into a given account? (e.g., should you be notified if someone logs into an administrator account from an IP address in southeast Asia if your site is run solely by people who live in the US?)