Dec. 13, 2022
Here is the article.
MySQL is an open-source database management system, commonly installed as part of the popular LAMP or LEMP stack. It implements the relational model and SQL to manage and query data. This tutorial explains how to install MySQL on your server. Choose your operating system below to get started.
Here is the article.
It’s recommended to launch a separate PHPStack application for the PHPMyAdmin installation on that server.
Following are the steps required to install PHPMyAdmin:
First, connect to your PHPStack application using SSH and navigate to the public_html folder with this command. Here folder name is the name of your PHPStack application.
cd applications/foldername/public_htmlNext, download the PHPMyAdmin using the following command.
Tip
Please be sure to check the PHPMyAdmin updated version name and modify the following command accordingly.
wget https://files.phpmyadmin.net/phpMyAdmin/5.2.0/phpMyAdmin-5.2.0-english.zipNext, unzip the folder using the following command.
unzip phpMyAdmin-5.2.0-english.zipNext, rename the PHPMyAdmin folder using the following command.
mv phpMyAdmin-5.2.0-english phpmyadminNow locate this folder from the browser to use PHPMyAdmin, for example, http://phpstack-123.cloudwaysapps.com/phpmyadmin.
If you need to access databases on a different server using PHPMyAdmin, you must also install PHPMyAdmin on that server.
Updated 3 weeks ago
FTX's new CEO John Ray is cleaning house at the top, per The Wall Street Journal. Ray, who previously oversaw Enron's bankruptcy proceedings, has fired former CEO Sam Bankman-Fried's top deputies: FTX co-founder and chief technology officer Gary Wang, engineering director Nishad Singh, and Caroline Ellison, CEO of trading arm Alameda Research. Ray criticized the "complete failure of corporate controls" at FTX and Alameda after both acknowledged that FTX lent billions of dollars in customer assets to Alameda to cover a funding hole, setting up the collapse of Sam Bankman-Fried's crypto empire.
Thanks for contacting Cloudways.
Here are the most important traits to look for in best WordPress hosting:
Here is the link.
Binance CEO Changpeng 'CZ' Zhao discusses the latest fallout from the FTX collapse and how that is expected to impact his company’s operation on ‘Varney & Co.’ #foxbusiness
华尔街最坚定的多头之一、摩根大通(134.21,2.05,1.55%)全球市场首席策略师科拉诺维奇（MarkoKolanovic）周一在给客户的一份报告中重申，他认为从现在到明年第一季度末，股市将面临下行风险，该行由于2023年经济前景疲软而减少了建议的股票配置。
美国人继续花钱，看似没有受通膨打击太重，但另一个世界正在兴起。去年美国店内窃盗问题严重，甚至数度演变成街头暴力，今年更猖獗，窃盗犯罪远高于历史，《华尔街日报》称“商店行窃已成为流行病”。大型零售商损失惨重，沃尔玛 (Walmart) 执行长警告，如果行窃问题再不解决，他们只好涨价，或可能看到商店关门。
Here is the article.
Investors may be on the doorstep of a deep pullback.
Morgan Stanley’s Mike Wilson, who has an S&P 500 year-end target of 3,900 for next year, warns corporate America is getting ready to unleash downward earnings revisions that will pummel stocks.
“It’s the path. I mean nobody cares about what’s going to happen in 12 months. They need to deal with the next three to six months,” he told CNBC’s “Fast Money” on Tuesday. “That’s where we actually think there’s significant downside. So, while 3,900 sounds like a really boring six months. No... it’s going to be a wild ride.”
Wilson, who serves as the firm’s chief U.S. equity strategist and chief investment officer, believes the S&P could drop as much as 24% from Tuesday’s close in early 2023.
“You should expect an S&P between 3,000 and 3,300 some time in probably the first four months of the year,” he said. “That’s when we think the deacceleration on the revisions on the earnings side will kind of reach its crescendo.”
On Tuesday, the S&P 500 closed at 3,957.63, a 17% decline so far this year. Wilson’s year-end price target was 3,900 for this year, too.
“The bear market is not over,” he added. “We’ve got significantly lower lows if our earnings forecast is correct.”
And he believes the pain will be widespread.
“Most of the damage will happen in these bigger companies — not just tech, by the way. It could be consumer. It could be industrial,” Wilson said. “When those stocks had a tough time in October, the money went into these other areas. So, part of that rally has been driven just be repositioning from the money moving.”
Wilson’s forecast comes on the heels of prior pullback warnings on “Fast Money.” In July, he warned the June low was probably not the final move downward. On Oct. 13, the S&P 500 reached its 52-week low of 3,491.58.
Yet Wilson does not consider himself a full-fledged bear.
“This is not a time to sell everything and run for the hills because that’s probably not until the earnings come down in January [and] February,” he said.
Wilson expects bullish tailwinds to push stocks higher over the next few weeks.
“It’s our job to call these tactical rallies. We’ve got this one right,” Wilson said. “I still think this tactical rally has legs into year end.”
WP Data Access is a powerful data administration, publication and development tool. An intuitive interface helps to create responsive tables and charts for back-end and front-end usage in just minutes. Highly customizable CRUD pages are generated on the fly. No programming skills required.
The plugin supports more complex features for advanced users, including remote database and file access, master-detail pages, lookups, inline editing, advanced search options, dynamic hyperlinks, WordPress media library integration, WordPress role management integration and many more. Programmers can also benefit from the WP Data Access API, which can be used to access remote databases and data files directly from their PHP code.
Use the Data Publisher to create professional data tables for back-end and front-end usage.
Use Data Projects to create data driven WordPress apps that can be executed on the back-end and front-end. Projects are highly customizable using templates.
Here is the pdf file link.
Damn, but security is hard.
It’s not always obvious what needs doing, and the payofs of good security are at best obscure. Who is surprised when it falls of our priority lists?
We’d like to ofer a little help if you don’t mind. And by « help » we don’t mean « pitch you our product »—we genuinely mean it.
Sqreen’s mission is to empower engineers to build secure web applications. We’ve put our security knowledge to work in compiling an actionable list of best practices to help you get a grip on your DevSecOps priorities. It’s all on the following pages.
We hope your find if useful. If you do, share it with your network. And if you don’t, please take to Twitter to complain loudly—it’s the best way to get our attention.
Use Parameterized Queries To avoid SQL injection attacks, never concatenate or interpolate SQL strings with external data. Use parameterized queries instead and prepared statements. These can be used with vendor-specific libraries or by using PDO.
Read more:
• Prepared statements and stored procedures in PDO
• Mysqli Prepared Statements
• The PostgreSQL pg_query_params function
Use an ORM
Take parameterized queries and prepared statements one step further, and avoid, if at all possible, writing SQL queries yourself, by using an ORM; one scrutinized and tested by many security-conscious developers.
Read more:
• Doctrine ORM
• Propel
• redbeanphp
Here is the article.
20 Comments / Information Security, PHP Tips & Tutorials / By / March 9, 2010
It’s not easy to become a great PHP developer which may very well take years of training and practice, but this doesn’t mean you shouldn’t do your best to not be a bad one that undermines every project he’s involved in. Based on the project experiences of my team and some recent researches done on PHP security issues, I have come up with a list of things you should know and do in your PHP code to achieve this goal. A few of them may be subjective and opinionated but most of them are actually security bottom lines that every self-deemed good PHP developer must definitely adhere to.
There are a lot more to consider other than PHP to secure your application. This is just a starting point if you are not also a system administrator who is equally responsible in maintaining a secure server (OS, web server, etc.). Oh and there’s browser security (such as phishing) that you essentially have no control over. So we will just stick to PHP here.
Some of the default settings in php.ini in earlier PHP versions are pretty dangerous. Modify the original php.ini if you are a server administrator or create custom php.ini in the webroot (directory of the web documents, accessible to the public via web server) to override the unsafe settings or use in-code functions such as ini_set():
In most cases, you don’t have to worry about more than just the error logging part because the most up-to-date version of PHP has been well optimized in security by default. For example, register_globals and magic_quotes_gpc are turned off as factory settings, and session data is automatically stored outside of webroot. Other than these, feel free to override things by the ini_set() function when you feel obligated to.
Note that magic_quotes_gpc cannot be set by ini_set() any more after PHP version 4.2.3, you have to do it in a local php.ini or .htaccess.
Disable directory listing site wide by adding this line to the .htaccess file (hidden) placed in the document root of your domain:
This includes member only materials, administrator stuff and site wide configuration files containing the vital data of your site, or whatever you feel uncomfortable exposed to the public. In fact, if you are having doubts whether some file is all right to be exposed, don’t expose it at all.
Compulsory security practices when handling uploaded files:
Cross Site Request Forgery (CSRF) Attacks: Just as the name suggests, the request is forged / fabricated from the authenticated user’s computer yet without his awareness and acknowledgement. For example, the malicious attacker creates a sneaky link (Clickjacking) or a form and manages to trick the legally logged user to use it to submit a hidden request to your application to perform something that he doesn’t authorize at all such as deletion. To prevent it:
Always filter or sanitize incoming data in $_GET, $_POST, $_COOKIE or $_REQUEST before using them in your code. Validate that a value is just what you expect and discard any characters suspicious / unneeded. Better yet, white list a few value prototypes by regular expressions and ignore anything that doesn’t match the criteria.
Path Traversal Attacks: By browsing through and trying different combinations of path input to your application, the cracker aims to access files and directories outside of the webroot, probably with a chain of ‘../’ in the path input. To prevent the attack:
SQL Injection Attacks: Exploits of secure vulnerabilities that occur in the database layer of an application wherein user input is not filtered for reserved characters that may cause the database to falsely interpret and execute the SQL query. To prevent this attack:
$mysqli -> real_escape_string($str)You can also use PDO to prepare the SQL queries, which will automatically sanitize any literal values by escaping it before using them in the query.
Cross-Site Scripting (XSS) Attacks: Or JavaScript injection, security vulnerabilities that allow malicious users to inject HTML code into your web pages that other users can view and execute. It can mess up the page, more fatally, it can load an arbitrary JavaScript script (hosted on another domain) in the user’s browser and steal their cookies thus identity. To prevent this attack:
htmlentities($str)session_regenerate_id();session_destroy();setcookie('SomeCookie', '', time() - 3600); // deletes it from client side
unset($_COOKIE['SomeCookie']); // deletes it from server side$str = 'Hi, I\'m on a web page.';
echo htmlentities($str);Please don’t hesitate to tip in by commenting below to make this security checklist as complete and useful as possible. To start a serious learning session of developing secure web applications, these books will provide a kickass ride for you.