Recently I’ve become more interested in something that, despite the wealth of resources out there, still seems to be lacking in a lot of web-based applications – good security. I’m not talking just about the “filter input, escape output” kinds of things. I’m digging a little deeper than that and looking and encryption, hashing, authentication methods and network/server configurations that could open your app wide open to malicious people.

So, in an effort to learn more about the security for PHP based applications, I’ve started up a new project that I hope can serve as a good tool (and maybe a guide) to those looking to create secure applications – the Shield microframework. It’s a small framework in the spirit of Slim framework that has a focus on security aspects and tries to help keep the user’s app a little safer by including things like:

• Output filtering on all values (preventing XSS)
• Logging on all actions
• Input filtering functionality for accessing all superglobal information
• Uses PHP’s own filtering for data sanitization
• Encrypted session handling (RIJNDAEL_256/MCRYPT_MODE_CBC, uses IV)
• Custom cookie handling (including httpOnly)
• Customized error handling to avoid exposing filesystem information
• Basic templating/view system
• IP-based access control

It’s an open source project and it’s already seen some great contributions from people all across the community. I wanted to provide a quick guide to getting started with this handy little framework so you could give it a shot in your own apps.

• 1. First off, you’ll need to download the framework from github: https://github.com/enygma/shieldframework
• 2. Once you’ve got it, check out the `app/index.php` file for an example of how to use it (pretty easy, right?)

At its most basic, all you need to do is make a route for the default page (this assumes you’re putting it in that same `app/` directory:

[php]
<?php
include_once ‘../Shield/Shield.php’;
$app = new Shield();

$app->get(‘/’,function() use ($app){
echo ‘It works!’;
});

$app->run();
?>
[/php]

That’s really all there is to it…this sets up a route for handling the main page of your app and echoes out the “It works!” message when you hit the page. You might see some other warnings and errors pop up about various settings and directories too. These are there to help you make things more secure, so be sure to make an effort to correct them.

There’s a lot more interesting things you can do with the frame work (it’s all in the README in the checkout) to work with filtering of user input, setting up custom filters, using the View object to add values to and display a rendered view and more.

I hope to make this project even better over time while trying to keep it small and flexible. I’m always looking for new ideas to help make it more secure and user friendly, so if you have any suggestions, please either leave them in the comments or email them over!.