2

A couple weeks ago I decided to learn PHP and make a blog from scratch. Most of the features are completed so now I'm looking at security, specifically for the admin area. As it stands right now, in this admin area I will manage (database) content. I've been reading many articles regarding security, such as:

The definitive guide to form-based website authentication

http://www.wikihow.com/Create-a-Secure-Login-Script-in-PHP-and-MySQL

http://www.wikihow.com/Create-a-Secure-Session-Managment-System-in-PHP-and-MySQL

What are best practices for securing the admin section of a website?

Admin section for website - security?

securing my admin page that accesses several php files

and a bunch of Google articles regarding SSL

Basically, I'm just having trouble understanding exactly how much security I need with regards to the admin login page and the admin area. The consensus seems to be that I should use SSL, but that seems like overkill to me since this is a brand new website with initially 0 visitors.

In addition, I'm now starting to ask why I even need an admin area. If I'm the only person operating the blog, why couldn't I just manage the content from phpmyadmin? Without an admin area (and without requiring users to register to post comments) I shouldn't need SSL for anything. There wouldn't be any sharing of sensitive information. Wouldn't it make my life easier not to even have an admin section in this case?

So to clarify, I'm just trying to understand what the appropriate level of security protections would be for a brand new website with a single admin operating the website and if this website has an admin login page and an admin login area. Obviously I'll take measures to protect against SQL injections and brute force attacks, but what would be an appropriate measure to protect sensitive data such as an admin password? Thanks in advance for the help!

Community
  • 1
  • 1
Homer
  • 45
  • 1
  • 1
  • 3
  • The only thing I personally would add is a good hash method for your password. But that question seems too vague for SO, see the [faq](http://stackoverflow.com/faq#dontask) – kero Mar 27 '13 at 21:59
  • 3
    being lazy, if phpmyadmin works for you, just use that. –  Mar 27 '13 at 22:02
  • Yes, your life is obviously easier to not bother with an admin interface and instead simply make updates to any dynamic content by running sql statements directly in phpmyadmin. So, the first question you need to ask yourself is whether you want to continue doing that or if you are trying to learn how to go further. If you decide to go further, then either go to security.stackexchange.com to ask generic security questions or here to ask specific implementation ones. – NotMe Mar 27 '13 at 22:02

1 Answers1

0

Think of what kind of info you are going to protect with this security system. Next think of what you will lose if someone breaks through it. Put your time needed to write and implement really good security on the other hand. Ask yourself what is more important? That's all =)

Denis O.
  • 1,841
  • 19
  • 37