https://github.com/funkatron/phpsecinfo
PhpSecInfo provides an equivalent to the phpinfo() function that reports security information about the PHP environment, and offers suggestions for improvement.
https://github.com/funkatron/phpsecinfo
Last synced: over 1 year ago
JSON representation
PhpSecInfo provides an equivalent to the phpinfo() function that reports security information about the PHP environment, and offers suggestions for improvement.
- Host: GitHub
- URL: https://github.com/funkatron/phpsecinfo
- Owner: funkatron
- License: other
- Created: 2009-02-11T03:26:44.000Z (over 17 years ago)
- Default Branch: master
- Last Pushed: 2011-09-11T16:13:45.000Z (almost 15 years ago)
- Last Synced: 2024-10-12T07:43:08.409Z (over 1 year ago)
- Language: PHP
- Homepage: http://phpsecinfo.com
- Size: 318 KB
- Stars: 46
- Watchers: 10
- Forks: 11
- Open Issues: 1
-
Metadata Files:
- Readme: README
- Changelog: CHANGELOG
- License: LICENSE
Awesome Lists containing this project
README
## PHPSECINFO
*Now on GitHub*
_see LICENSE for copyright and license info_
Mailing List for bug reports, feedback, etc:
http://lists.phpsec.org/mailman/listinfo/phpsecinfo
### WHAT IS PHPSECINFO?
PHPSecInfo is a PHP environment security auditing tool modeled after the
phpsecinfo() function. From a single function call, PHPSecInfo runs a
series of tests on your PHP environment to identify potential security
issues and offer suggestions. It can be useful as part of a multilayered
security approach.
#### WHAT IS PHPSECINFO NOT?
* It is not a replacement for secure coding practices
* It does not audit PHP code
* It is not comprehensive test for either your hosting environment
or your web application
* It is not the "final word." PHPSecInfo identifies *potential* problems
and offers suggestions for improvement. Your environment may _require_
certain settings that trigger cautions or warnings.
### HOW DO I USE PHPSECINFO?
The simplest way:
* Uncompress and upload the contents of the archive to your web server's
document root
* Open a browser and view the index.php file where you've uploaded the files
(probably something like http://www.yourdomain.com/phpsecinfo/index.php)
### WHAT DO I DO IF I GET A NOTICE OR WARNING?
Read the explanation of the result carefully. Research the issue on-line
-- resources like the php.net official docs and the PHP Security Guide are
very useful. Investigate why your environment is set up in such a way. If
there's not a compelling reason to keep it as-is, you should probably
A by no means comprehensive list of resources to get your started:
Web Sites:
http://www.php.net/manual/en/security.php
http://phpsec.org/projects/guide/
Books:
http://phparch.com/pgps
http://phpsecurity.org/
http://apachesecurity.net/
### HOW CAN I CUSTOMIZE THE OUTPUT OF PHPSECINFO?
PHPSecInfo is intended to be used as a self-contained tool. However, you
can obtain the test results in an array and then present this data in your
preferred format.
Example:
require_once('PhpSecInfo/PhpSecInfo.php');
// instantiate the class
$psi = new PhpSecInfo();
// load and run all tests
$psi->loadAndRun();
// grab the results as a multidimensional array
$results = $psi->getResultsAsArray();
echo "
"; echo print_r($results, true); echo "
";
// grab the standard results output as a string
$html = $psi->getOutput();
// send it to the browser
echo $html;
### HOW CAN I OFFER FEEDBACK, REPORT BUGS, COMPLAIN, ETC.?
The best way is to subscribe to and post on the PHPSecInfo Mailing List:
http://lists.phpsec.org/mailman/listinfo/phpsecinfo