php|architect / February 2007

Security Corner: CSRF

In this month's edition of Security Corner, security expert Chris Shiflett discusses cross-site request forgeries (CSRF, pronounced "sea surf"), an attack that we'vediscussed here before, and one that continues to hover just below the radar of many developers. In a recent poll among Web application security professionals, CSRF was ranked as one of the greatest concerns for the upcoming year. CSRF also recently made the OWASP Top Ten, a well-recognized list of the current security problems in Web applications. This article explains CSRF, provides a few examples, and discusses some strong safeguards you can use to protect your applications.

Cleaning up with SOAP and the NDNC Registry

The National Do Not Call Registry has been growing in size as well as popularity among both the United States Government and the individual state powers in America. What does this mean for you? Author Chad R. Smith shows you how to make your system NDNC compliant and avoid costly fines and penalties--automatically.

Test Pattern: Object Serialization

Serialization is a means of transferring data values between address spaces. In this month's Test Pattern, Jeff Moore explores some of the fundamental issues with serialization across several different serialization formats in PHP.

Addressing Web Application Security with Cryptography

While developing PHP applications, you've probably already faced some situations where it would be good to increase the level of security of your application. For instance, consider the scenario of two PHP applications exchanging data, when each needs to be sure that the other is authenticated and that the data exchanged is only known between them. This can only be achieved through strong cryptographic processes. In this piece, author Carlos Serr

A Custom Markup Parser with PCRE

You don't want your site users uploading a wide range of HTML tags to format their contributions, but XML is overkill for your needs, and str_replace() just isn't sophisticated enough to cope with them. In this piece, Jolyon Ralph introduces a generic solution he came up with for his own special-interest site, using preg_replace_callback().

FileMaker for PHP Developers

FileMaker is a popular and powerful desktop database application toolkit. Recently, FileMaker, Inc. released a beta version of the FileMaker API for PHP, which allows PHP to more easily talk to the FileMaker Server Advanced product. Join author Jonathan Stark in learning how to leverage FileMaker