Chris Shiflet

Published 29 October 04 by Justin French

I’ve known of Chris for a long time via the php-general mailing list, and have always respected his intelligent answers and in-depth knowledge of PHP and security, but I never knew he had a website dedicated to such things, and a book on the way.

Here’s some of the goodies I’ve been reading in the last 24 hours, whilst slowly working my way through his archives:

• The Truth About Sessions
• Foiling Cross Site Attacks
• Shared Hosting
• PHP Security (PDF)

Sure, I had already learned, devised or discovered most of this stuff a long time ago, but it’s nice to have it all clearly documented in one place so that I know I’m on the right track, and can check my knowledge against that of a renowned PHP Security expert.

I also found a wealth of quality links scattered amongst his articles and presentation slides, including:

• WACT PHP Security Wiki
• PHP and the OWASP Top Ten Security Vulnerabilities
• NYPHP PHundamentals

All this really highlights the difference between PHP moonlighters and those who live and breath this stuff for a living, and insist on providing quality web applications.

Of course, trying to educate my clients that they need all this stuff, and why my quote is maybe double that of some hack competitor is a different story all together.

I can’t wait for Chris’ book PHP Security to be released through O’Reilly.