This question is a big one... Let’s start from the following aspects:
Database permissions: Don’t always use root to connect to the database. Open a separate account for the web application and minimize permissions
Database password: Don’t use a weak password, try to have a randomly generated password of more than 16 characters
Web server: Same as the database, make the password as complicated as possible. Try not to use the root account directly. Open a separate account. Use root only when necessary
web application:
Try to choose a better DB library or ORM library and use parameterized SQL queries. Do not put parameters directly in SQL to prevent SQL injection
The password information of users (including backend management users) should not be stored directly. It should be hashed with salt before storage
If possible, try to use HTTPS
When rendering HTML, try to use encoding before outputting to prevent XSS
When you have to output a piece of user-controlled rich text HTML, use a filter like htmlpurifier to prevent XSS
Follow HTTP verb semantics, use POST/DELETE/PUT for addition, deletion and modification operations, and add csrf_token to prevent CSRF attacks
Thinking of this for the time being, there are still many points to pay attention to in web security. I suggest LZ hire a security consultant directly.
First of all, your front-end and back-end codes must ensure their security and avoid attack vulnerabilities such as XXS or SQL injection. Secondly, the database server and the web server must be separated, which can improve part of the security performance and improve the website. efficiency. In addition, it is best for all passwords in user information to be encrypted using a specific encryption method before being stored in the database. This ensures that even if it is stolen, it will be difficult for the thief to know the real password. We hope you will adopt it!
![[Web front-end] Node.js quick start](https://img.php.cn/upload/course/000/000/067/662b5d34ba7c0227.png)
This question is a big one... Let’s start from the following aspects:
Database permissions: Don’t always use root to connect to the database. Open a separate account for the web application and minimize permissions
Database password: Don’t use a weak password, try to have a randomly generated password of more than 16 characters
Web server: Same as the database, make the password as complicated as possible. Try not to use the root account directly. Open a separate account. Use root only when necessary
web application:
Try to choose a better DB library or ORM library and use parameterized SQL queries. Do not put parameters directly in SQL to prevent SQL injection
The password information of users (including backend management users) should not be stored directly. It should be hashed with salt before storage
If possible, try to use HTTPS
When rendering HTML, try to use encoding before outputting to prevent XSS
When you have to output a piece of user-controlled rich text HTML, use a filter like htmlpurifier to prevent XSS
Follow HTTP verb semantics, use POST/DELETE/PUT for addition, deletion and modification operations, and add csrf_token to prevent CSRF attacks
Thinking of this for the time being, there are still many points to pay attention to in web security. I suggest LZ hire a security consultant directly.
First of all, your front-end and back-end codes must ensure their security and avoid attack vulnerabilities such as XXS or SQL injection. Secondly, the database server and the web server must be separated, which can improve part of the security performance and improve the website. efficiency. In addition, it is best for all passwords in user information to be encrypted using a specific encryption method before being stored in the database. This ensures that even if it is stolen, it will be difficult for the thief to know the real password. We hope you will adopt it!