PHP security

[fraank]

hi there,
What are some tips you know about adding security to processing forms such as registration forms, generators, login forms, contact forms, etc? This is because I am thinking that a basic PHP form can be too unsecured from exploits such as spam submitting, spam registration, etc. -- This message may have been cut off and the rest will only be shown to members. To become a member, click here --

[sacnite]

Never trust your users, Validate everything, Initialize your variables, Check user privileges on every page if you're using access control, Understand XSS, Understand SQL Injection, Do not display PHP errors to users, Turn off register_globals (defaulted to off in php 4.2.0+), CAPTCHA for spam. -- This message may have been cut off and the rest will only be shown to members. To become a member, click here --

[OMAG]

anytime you use a variable to update a piece of a mysql_query, USE mysql_real_escape_string ON EVERY VARIABLE that the user has an opportunity to manipulate!
IE
mysql_query("SELECT * FROM books WHERE book_title = '".mysql_real_escape_string($_POST['book_title'])."'");
and, also, never output and input variable to the output (like as an error). This opens it up for XSS
bye -- This message may have been cut off and the rest will only be shown to members. To become a member, click here --