PHP is a very simple and easy-to-learn programming language – it provides anyone with minimal programming skills an easy way to get things done. For example, you can assign a value to a variable without even declaring that variable. It is those types of practices and often lack of knowledge of the weakness of PHP that makes web sites more prone to attacks. In our attempt to help you make your PHP site and web applications more secure, we’ve compiled a list of useful PHP security and auditing tools.
PhpSecInfo
There are various directives located in the PHP’s configuration file (php.ini) that can be tweaked to provide a more secure development environment. For example by turning off register_globals, you ensure that hackers cannot invoke your variable with fake data. The purpose of phpSecInfo is to provide an equivalent to phpinfo() function that reports security information about the PHP environment. It also offer suggestions for improvement for certain setting directives. Remember, phpSecInfo is just a reporting tool and it does not do any type of code or application auditing.
Cross-site scripting (XSS) and SQL injection (SQLI) vulnerabilities are present in many modern web applications. In the past, finding such vulnerabilities usually involved manual source code audits. Unfortunately, this manual vulnerability search is a very tiresome and error-prone task. Pixy is a Java program that performs automatic scans of PHP 4 source code, aimed at the detection of XSS and SQL injection vulnerabilities. Pixy takes a PHP program as input, and creates a report that lists possible vulnerable points in the program, together with additional information for understanding the vulnerability.
Spike is an open source PHP security audit tool that performs a static analysis of PHP code for common security exploits. After uploading and running the file, Spike will generate a source code analysis report in HTML about errors, warnings or possible security holes.
Suhosin is an advanced protection system for PHP installations. It was designed to protect servers and users from known and unknown flaws in PHP applications and the PHP core. Suhosin comes in two independent parts, that can be used separately or in combination. The first part is a small patch against the PHP core, that implements a few low-level protections against bufferoverflows or format string vulnerabilities and the second part is a powerful PHP extension that implements all the other protections.
HPIDS (PHP-Intrusion Detection System) is a simple to use, well structured, fast and state-of-the-art security layer for your PHP based web application. The IDS neither strips, sanitizes nor filters any malicious input, it simply recognizes when an attacker tries to break your site and reacts in exactly the way you want it to. Based on a set of approved and heavily tested filter rules any attack is given a numerical impact rating which makes it easy to decide what kind of action should follow the hacking attempt. This could range from simple logging to sending out an emergency mail to the development team, displaying a warning message for the attacker or even ending the user’s session.
ModSecurity is a web application firewall that can work either embedded or as a reverse proxy. It provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis. It is also an open source project that aims to make the web application firewall technology available to everyone
From: http://www.hotscripts.com/blog/6-free-php-security-auditing-tools/