3 ms·
Many of my affiliate based site don't use any frameworks. Just a couple of php lines to get the data and voila. It really depends of your needs. In this case, t
by decasoft 16y ago
Many of my affiliate based site don't use any frameworks. Just a couple of php lines to get the data and voila. It really depends of your needs. In this case, there is not even security needs...! Why bother?
- thaumaturgy 16y agoSo if I request '/../../../etc/passwd' on one of your sites, it won't work? (Just curious. I've found it really hard to get chroot'd php/apache working in all but the simplest of use cases.)
- pzb 16y agoYou shouldn't need to chroot apache to avoid serving /etc/passwd. I have never worked on a site with chroot'd Apache, and have never run into these kind of issues. Are you setting your Apache configuration to only allow reading certain directories?
- DCoder 16y agoIt's not just Apache you need to configure - PHP ignores Apache's directory access configurations entirely, you need open_basedir and preferably something like suPHP. Disabling shell functions (system, exec, etc.) is also a good idea, unless the application itself requires them (e.g. if the host is too stupid/lazy to have the imagick extension installed and tells you to call /usr/bin/imagick instead...).