"Static" PHP page security

I'm开发者_如何学运维 currently building a website, using PHP, and looking into securing the website fully. Currently, and in the future, I don't plan on using SQL, or even user-submitted input anywhere on the website - the PHP pages are basically simply in place for ease in piecing together several different HTML fragments to create a full page, using requires. What type of vulnerabilities, if any, should I be aware of to protect against?

---

There are no vulnerabilities in the situation you've outlined.

If you are using any query string variables to load pages, they may need to be secured. For example: article.php?page=php-page-security.

Otherwise just make sure that your server software is updated regularly to the latest versions, and access to the web server is properly secured. It sounds like your code is pretty basic and you aren't doing any processing in PHP, so you should be fine.

---

This is a huge topic that can't be answered in a single post. Some tips:

• Secure physical access to your web server (your hosting provider should handle this)
• Minimize remote access to the server. Setup a firewall, use proper passwords, regularly run updates
• Secure your code (PHP and javascript). Make sure to "clean" any qstrings you might process and never use eval. Consider using a framework to simplify this step.
• Keep server logs and review them regularly for mischief.

This is just a jumping point. A google search for "web application security" will turn up troves of information. Good luck!

---

Possible exploits are in the overall server security. As you use PHP in that simple manner, there's a risk that you do not know it well enough and might overlook some hole: like user input option, or file access rights which would allow a bad guy to upload his php to the server.

PHP offers too much for a simple task of including files. More capabilities == more risk.

I'd use server-side includes for the sake of assembling several files into one web page, and just disable php — faster, more secure.

---

You should be sure that your software (e.g. webserver, operating system, PHP) is up-to-date, with the latest security patches and updates. You can also hide PHP (read the official guide or [search Google])(http://www.google.com/search?q=hiding+php)

By combining all the advice you get from the answers here, your application will be something more that perfectly safe.

As @Toast said, you had better block incoming traffic and only allow port 80 by using a firewall (Netfilter/iptables on Linux), except if you want to enable additional services, such as FTP.

And in case you want the data travelling between the server and the client to be safe, then HTTPS is the best solution.

---

If you're not basing the "piecing together" on any kind of user-provided data, and not including any user-provided data into the page, then you're about as vulnerable as a plain static .html file.

That means you're not doing:

include($_GET['pageName']); // hello total server compromise

or

echo "Hello, ", $_GET['username']; // hello cross-site-scripting!

and the like.