What more can I do?
Current protection against hacks:
Database:
- My (access) database is outside the web directory (as recommended for this forum, for example);
Inputs:
- All inputs that should be numeric only are checked and sanitised using a function (that I was given via this forum, ta) to ensure they are only numeric;
- All alphabetic inputs are also checked (again, using a function I was given here!) to make sure they only contain valid characters (at the very most, a-z and underscore);
- Where possible, inputs which will be more constrained if valid (eg, will only be in the range 0-4) are checked for this;
If any of the above three return false, the user is response.redirect'ed to an error page which states why they're there, ie, invalid ID entered; The same applies if any other seemingly-legitimate input produces a EOF/BOF error.
Edit: Correction - most invalid inputs result in a bounce to error page; some result in a bounce to a default page (eg, if the choice is between classes 1-4 and the user ammends the URL to try to select class 5, it will bounce to class 1 instead).
So, back to the question: What more can I do to secure my site, before considering I might have done "enough" and have to leave the rest to the host (eg, in terms of securing the server itself)?
Edited by pedalcars
Topic Options
Post Options
Thanks(0)
