Posts: 2,187
Threads: 81
Joined: Aug 2011
Reputation:
0
What are the realistic measures you would take to secure your UCP? I know there exist many such topics on many forums, but I would like to ask it in the context of SA-MP. I mean I wouldn't buy a 300$ lockdown kit to protect my login and stuff. Besides, prepared statements which I assume take care of SQL injection, htmlspecialchars for XSS and whirlpooling passwords with long hashed session identifiers with regeneration for hijacking, what else? Please be productive in your replies.
Cheers
Posts: 400
Threads: 11
Joined: Jul 2011
Reputation:
0
As long as the public cannot see the MySQL connection details, and your password is secure you should be fine. You could use PDO instead of raw MySQL
Posts: 10,066
Threads: 38
Joined: Sep 2007
Reputation:
0
Limit the amount of subsequent login attempts within a given timeframe. Throw a 503 Service Unavailable if it gets excessive. Add a logbook entry when someone tries to get into an admin account. Lastly, make sure that you have a .htaccess in non-public folders to prevent directory listing.
Posts: 2,187
Threads: 81
Joined: Aug 2011
Reputation:
0
I am already using PDO. Thanks!
My core classes are already restricted, and I will look into the limited login attempts and logging. Thank you, anyone else?
Posts: 2,262
Threads: 260
Joined: Mar 2009
Reputation:
0
Securing forms from SQL Injections!
Oops never read OP!
