在找 PDO 在 SQL injection 方面的資料時找到的網站Cluesheet.com，裡面有許多關於PHP的tips。
以下為摘錄資安與效能部份，完全內容請至Cluesheet.com。雖然 PHP開發人員必須知道的一些技巧 裡有翻譯一些，但第一句好像就翻錯了(也許是原站有改過也說不定)？所以我想試著翻譯看看。
Security
- 使用 PDO parameters 來傳遞 SQL 值以避免 SQL injection 。
- 使用 htmlspecialchars/htmlentities and/or strip_tags to escape html and JavaScript 以避免 XSS 攻擊。
- 使用 sessions 與 secure sockets to 避免 session hijacking. Use md5 檢查碼去檢證 session ids. Store a special token md5(uniqueid(rand(),time)) in the session and bump it against a hidden field in the post form. eg. $_SESSION["token"]===$FORM["token"].
- 使用 escapeshellarg/escapeshellcmd 在你呼叫 exec 函式前以避免command injection。
- Do remove linebreaks from incoming headers to prevent early header termination and injection. Fixed >PHP5.1
- 使用 md5 檢查 serialized (序列化)的值與 sessionid 是否完整。
- 用 === 來確認輸入的值是否連型態都正確。[譯註：由於PHP不是強制型別的語言，如使用==來比較的話，就不能確定使用者輸入的是ture、1、-1還是"1"？請參考the type comparison tables。]
- Do use security through obsurity:
- ini_set("display_errors",false);
- ini_set("log_errors",true);
- ini_set("error_log","path/to/php.log");
- ini_set("session.save_path","path/above/www"); or "mm" session module or store in a sqllite db
- php.ini expose_php=off
- php.ini register_globals=off
- Apache servertokens=prod
- Use session_regenerate for any user privledge escalation in application.
- Use secure sockets SSL for commerce transactions.
Performance
- 使用單引號取代雙引號。[譯註：雙引號要檢查裡面是否有變數如 "He drank some $beers."。]
- 使用switch 取代大量的 if 句法。[譯註：可以配常數來使用。]
- 避免在每次都重覆的情況下，使用函式來測試迴圈條件 for($i=0;i<=count($x);$i++){...[譯註：可以先決定值的話，就移到迴圈外吧，$cntX = count($x); for($i=0;i<=$cntX;$i++){...]
- Do use foreach for looping collections/arrays.
- PHP4 items are byval
- >PHP5 items are byref
- 當你在建立複雜的 PHP classes時，考慮一下使用 Singleton Method 。
- Do use POST over GET for all values that will wind up in the database for TCP/IP packet performance reasons. 基於效能的理由，使用 POST 取代 GET 傳遞所有的值對於資料庫傳遞 TCP/IP 封包有顯助的提升。
- 基於效能的理由，使用 ctype_alnum,ctype_alpha 和 ctype_digit 取代 regular expression 來測試表單數值的類型。
- Do use full file paths in production environment over basename/fileexists/open_basedir to avoid performance hits for the filesystem having to hunt through the file path. Once determined, serialize and/or cache path values in a $_SETTINGS array. $_SETTINGS["cwd"]=cwd(./);
- Do use require/include over require_once/include_once to ensure proper opcode caching.
- Do use tmpfile or tempnam for creating temp files/filenames
- Do use a proxy to access web services (XML or JSOM) on foreign domains using XMLHTTP to avoid cross-domain errors. eg. foo.com<-->XMLHTTP<-->bar.com
- Do use error_reporting (E_ALL); during debug.
- Do set Apache allowoverride to "none" to improve Apache performance in accessing files/directories.
- Do use a fast fileserver for serving static content (thttpd). static.mydomain.com, dynamic.mydomain.com
- Do serialize application settings like paths into an associative array and cache or serialize that array after first execution.
- Do use PHP output control buffering for page caching of heavilty accessed pages
- Do use PDO prepare over native db prepare for statements. mysql_attr_direct_query=>1
- Do NOT use SQL wildcard select. eg. SELECT *
- Do use database logic (queries, joins, views, procedures) over loopy PHP.
- Do use shortcut syntax for SQL insers if not using PDO parameters parameters. eg. INSERT INTO MYTABLE (FIELD1,FIELD2) VALUES (("x","y"),("p","q"));
![works-on-my-machine-stamped[2]](http://farm1.static.flickr.com/185/429397700_5ca469d7db_o.png)
