Currently i've started building a blog which is also gonna be considered as a content management system for my site cause i'll be able to change everything from a simple control panel i build but my question is what is the most important security issues i should address when building such a site thank u in advance

TBH My first thought when I read this was - if you need to ask this question you shouldn't be building your own!

 

However, I do respect anyone who finds the time to even try to build their own CMS/Blog, so I figured I'd give you some pointers.

 

If you really want to use your own custom solution for your clients/own site then you will need to some serious reading up on security. It's a great exercise and can provide a cheap solution (once the initial cost of building the system is done) but you should always consider that existing solutions may suit yours and your clients needs.

 

So if you are building it for the sake of building it, great. But if you are building it because you haven't checked to make sure that there is not an existing solution that meets your needs - not so great! Even the UK government has now realised and started to advocate the use of Open Source projects as often being the best solution - the work is already done BUT you can change it however you want.

 

When it comes to security, holes are created where users can interact with your software in unsafe ways.

An example of this is SQL injection where a form element or just typing a dodgy URL allows the user to pass SQL to your website that is then executed. This means a user could add, change or even delete your data.

There are similar problems with passing raw PHP or other code in form elements & URLS that is executed, and in file uploads where dodgy files cause code to be executed.

 

Another example of common security holes are XSS or cross-site scripting vulnerabilities where users are able to inject their own scripts into the page.

 

Security holes are mostly similar in nature - they depend on the user being able to do something they shouldn't be able to and usually involve code of some sort being executed that shouldn't be.

 

http://en.wikipedia.org/wiki/SQL_injection

http://en.wikipedia.org/wiki/Cross-site_scripting

 

I really suggest you read up ALOT on how these things are caused and what the biggest problems are. Articles like this or this can be invaluable.

 

Of course all that is assuming that you are using the "most common" PHP + MySQL combination for development. If you are using ASP, Ruby, Python, Perl or anything else then you will need different articles but on the same problems - unvalidated, incorrectly processed user interactions.

Edited January 27, 201016 yr by ErisDS