Update: This wiki has been rewritten to be in line with Yii 1.1.14. Since many of the detailed complexities are now handled by Yii, the article focuses on how the crypt() built-in function works and why it's important to use it correctly.
Yii Framework Wiki
Wiki articles tagged with "security"
Showing 21-24 of 24 items.
Use crypt() for password storage
Checking for "expired" sessions/logins on the client side
Getting "Expired token" errors ? Here is a solution to avoid invalid CSRF on POST or ajax requests, or user identity changes.
Single PHP entry point with Nginx
In this article I will show you how to slightly increase application security, by exploiting the fact that Yii implements the Front Controller Pattern.
How to write secure Yii1 applications
- Validate the user input (see below for details).
- Protect (escape) your application output according to context (see below for a few output types, mostly HTML and SQL).
- Test your application in debug mode.
Set the constantYII_DEBUGto true (by default, it is defined inindex.php) and put alongsideerror_reporting(E_ALL);. Then errors and warnings will stop the execution an...