Archive for the ‘PHP’ Category

h1

Googles PHP performance tips – What about security?

June 25, 2009

Today Travis Biehn has posted a link to the Full Disclosure Mailinglist leading to Googles “PHP performance tips“.

Don’t copy variables for no reason.

Sometimes PHP novices attempt to make their code “cleaner” by copying predefined variables to variables with shorter names. What this actually results in is doubled memory consumption, and therefore, slow scripts. In the following example, imagine if a malicious user had inserted 512KB worth of characters into a textarea field. This would result in 1MB of memory being used!

BAD:
$description = $_POST[‘description’];
echo $description;

GOOD:
echo $_POST[‘description’];

Complement from me:

MUCH BETTER:
echo htmlspecialchars($_POST[‘description’], ENT_QUOTES);

😉

Advertisements