News for hackers. Stuff that matters.

A comment on Ask HN: First steps to check the security of PHP web-application?. Parent comment

Re:Ask HN: First steps to check the security of PHP web-appl... by dlphii on Thursday November 24, 2016 @09:21AM (#13030421)
Thanks. And if you are given a big piece of source code. And no static/dynamic tools are allowed, only manual review. What should you look at first (PHP based site, authentication for users, online payment, very dynamic web-site).
[ Parent | on HN ]
Re:Ask HN: First steps to check the security of PHP web-appl... by paktek123 on Thursday November 24, 2016 @03:28PM (#13032566)
I'd start with the basics

- are any secrets/credentials visible in plain text?

- how is input handled (escaping HTML etc)

- how are headers and cookies being handled if any

[ Parent | on HN ]