blocks|key|2235422|text|http://www.zend.com/services/certification/是一个很好的。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2235423|在你参加考试之前，你可能需要看一看：|2235424|httpOnly+Cookie|unordered-list-item|2235425|跨站点请求伪造|2235426|OWASP开发指南|2235427|SQL注入|2235428|信用卡处理规则|2235429|SSL/HTTPS|2235430|跨站点脚本(XSS)|2235431|2235432|谷歌浏览器安全手册|2235433|网络应用黑客手册|2235434|entityMap|0|LINK|mutability|MUTABLE|url|http://www.zend.com/services/certification/|1|http://www.codinghorror.com/blog/2008/08/protecting-your-cookies-httponly.html|2|http://www.codinghorror.com/blog/2008/09/cross-site-request-forgeries-and-you.html|3|http://www.owasp.org/index.php/Category%253aOWASP_Guide_Project|4|http://en.wikipedia.org/wiki/SQL_injection|5|https://www.pcisecuritystandards.org/|6|http://www.mozilla.org/projects/security/pki/nss/ssl/draft302.txt|7|http://en.wikipedia.org/wiki/Https|8|http://en.wikipedia.org/wiki/Cross-site_scripting|9|http://en.wikipedia.org/wiki/Cross-site_request_forgery|10|http://code.google.com/p/browsersec/wiki/Main|11|https://rads.stackoverflow.com/amzn/click/com/0470170778^0|0|17|0|0|0|0|F|1|0|0|7|2|0|0|9|3|0|0|5|4|0|0|7|5|0|0|3|6|4|5|7|0|0|A|8|0|0|7|9|0|0|9|A|0|0|8|B|0^^$0|@$1|2|3|4|5|6|7|1T|8|@]|9|@$A|1U|B|1V|1|1W]]|C|$]]|$1|D|3|E|5|6|7|1X|8|@]|9|@]|C|$]]|$1|F|3|G|5|H|7|1Y|8|@]|9|@$A|1Z|B|20|1|21]]|C|$]]|$1|I|3|J|5|H|7|22|8|@]|9|@$A|23|B|24|1|25]]|C|$]]|$1|K|3|L|5|H|7|26|8|@]|9|@$A|27|B|28|1|29]]|C|$]]|$1|M|3|N|5|H|7|2A|8|@]|9|@$A|2B|B|2C|1|2D]]|C|$]]|$1|O|3|P|5|H|7|2E|8|@]|9|@$A|2F|B|2G|1|2H]]|C|$]]|$1|Q|3|R|5|H|7|2I|8|@]|9|@$A|2J|B|2K|1|2L]|$A|2M|B|2N|1|2O]]|C|$]]|$1|S|3|T|5|H|7|2P|8|@]|9|@$A|2Q|B|2R|1|2S]]|C|$]]|$1|U|3|J|5|H|7|2T|8|@]|9|@$A|2U|B|2V|1|2W]]|C|$]]|$1|V|3|W|5|H|7|2X|8|@]|9|@$A|2Y|B|2Z|1|30]]|C|$]]|$1|X|3|Y|5|H|7|31|8|@]|9|@$A|32|B|33|1|34]]|C|$]]|$1|Z|3|-4|5|6|7|35|8|@]|9|@]|C|$]]]|10|$11|$5|12|13|14|C|$15|16]]|17|$5|12|13|14|C|$15|18]]|19|$5|12|13|14|C|$15|1A]]|1B|$5|12|13|14|C|$15|1C]]|1D|$5|12|13|14|C|$15|1E]]|1F|$5|12|13|14|C|$15|1G]]|1H|$5|12|13|14|C|$15|1I]]|1J|$5|12|13|14|C|$15|1K]]|1L|$5|12|13|14|C|$15|1M]]|1N|$5|12|13|14|C|$15|1O]]|1P|$5|12|13|14|C|$15|1Q]]|1R|$5|12|13|14|C|$15|1S]]]]

<a href="http://www.zend.com/services/certification/" rel="noreferrer">http://www.zend.com/services/certification/</a> is a good one.

Before you take that exam you might want to have a look at: 

<ul>
<li><a href="http://www.codinghorror.com/blog/2008/08/protecting-your-cookies-httponly.html" rel="noreferrer">httpOnly Cookies</a></li>
<li><a href="http://www.codinghorror.com/blog/2008/09/cross-site-request-forgeries-and-you.html" rel="noreferrer">cross-site request forgeries</a></li>
<li><a href="http://www.owasp.org/index.php/Category%3aOWASP_Guide_Project" rel="noreferrer">OWASP development guide</a></li>
<li><a href="http://en.wikipedia.org/wiki/SQL_injection" rel="noreferrer">SQL injection</a></li>
<li><a href="https://www.pcisecuritystandards.org/" rel="noreferrer">rules for processing credit cards</a></li>
<li><a href="http://www.mozilla.org/projects/security/pki/nss/ssl/draft302.txt" rel="noreferrer">SSL</a>/<a href="http://en.wikipedia.org/wiki/Https" rel="noreferrer">HTTPS</a></li>
<li><a href="http://en.wikipedia.org/wiki/Cross-site_scripting" rel="noreferrer">cross site scripting (XSS)</a></li>
<li><a href="http://en.wikipedia.org/wiki/Cross-site_request_forgery" rel="noreferrer">Cross-site request forgery</a></li>
<li><a href="http://code.google.com/p/browsersec/wiki/Main" rel="noreferrer">The Google Browser Security Handbook</a></li>
<li><a href="https://rads.stackoverflow.com/amzn/click/com/0470170778" rel="noreferrer" rel="nofollow noreferrer">The Web Application Hacker's Handbook</a></li>
</ul>

blocks|key|2235280|text|编写安全代码不仅仅是PHP:好的代码，正确的代码是语言不可知论的。虽然每一种语言都有细微差别，但无论你用什么文字，都有一套可以学习的基本原则。最好是学习这些核心价值观，然后学习语言的细节。有关密码学的基本知识、良好的数据库设计、适当的内存管理和操作系统原则将使您更深入地了解安全性，而不仅仅是通过PHP安全认证。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2235281|从根本上讲，编写安全代码应该是任何程序员技能集的一部分。|2235282|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

Writing secure code spans more than just PHP: good code, proper code is language agnostic. While there are nuances in each language, there are a base set of principals to learn that are transferable no matter what you write in. It's best to learn those core values and then learn about the specifics of the language. Basic knowledge of cryptography, good database design, proper memory management, and operating system principals will give you more insight to security than just being certified in PHP security.

When it comes right down to the point, writing secure code should be a part of any programmer's skill set.

blocks|key|2235241|text|http://www.zend.com/services/certification/|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2235242|entityMap|0|LINK|mutability|MUTABLE|url^0|0|17|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@$A|L|B|M|1|N]]|C|$]]|$1|D|3|-4|5|6|7|O|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|4]]]]

<a href="http://www.zend.com/services/certification/" rel="nofollow">http://www.zend.com/services/certification/</a>

blocks|key|1879196|text|我强烈推荐克里斯·希夫莱特的书。我认为应该对所有的web开发人员进行阅读，而不仅仅是PHP，因为所概述的原则、攻击和防御都适用于所有的web语言。这也是一个快速阅读，但会给你一个坚实的基础在网络应用安全IMHO，不需要一个课程。Zend认证工程师学习指南中关于安全性的章节也很好，但涵盖的基础与Shiflett的书相同。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1879197|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

I highly recommend Chris Shiflett's book. I think it should be required reading for all web developers, not just PHP dev's, as the principles, attacks and defenses outlined are applicable to all web languages. It's also a quick read but would give you a firm grounding in web app security IMHO, negating the need for a course. The chapter on security in the Zend Certified Engineer study guide is also good but covers the same ground as Shiflett's book.

blocks|key|1879234|text|有OWASP认证项目，但据我所知，它不再是活动的(虽然链接的一些内容看起来仍然是活动的)。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1879235|虽然PHP不是特定的，但也有GIAC认证。它的目标是一般安全，而不是特定于语言的技术(据我所能收集到的).|1879236|还有软件安全研究所..。我没有他们的背景，所以我不能真的担保，但它似乎有你正在看的东西。|1879237|编辑:反射后的：|style|BOLD|1879238|老实说，我看不出证书有什么意义。如果你想参加培训，那就太好了！但证书所做的就是证明你通过了一项考试。它没有提到你所知道的或你的能力.获得真实世界的体验，这比一周中任何一天的证书都更有价值。参与开源项目(特别是在安全方面，在我的经验中非常需要帮助)。参与OWASP。获得一些真实世界的经验，参加会议和用户组继续学习。价值是证书的10倍.|1879239|entityMap|0|LINK|mutability|MUTABLE|url|http://www.owasp.org/index.php/Category%253aOWASP_Certification_Project|1|http://www.giac.org/|2|http://www.sans-ssi.org/|3|http://www.owasp.org/index.php/Main_Page^0|1|9|0|0|E|6|1|0|2|7|2|0|0|7|0|3I|5|3|0^^$0|@$1|2|3|4|5|6|7|11|8|@]|9|@$A|12|B|13|1|14]]|C|$]]|$1|D|3|E|5|6|7|15|8|@]|9|@$A|16|B|17|1|18]]|C|$]]|$1|F|3|G|5|6|7|19|8|@]|9|@$A|1A|B|1B|1|1C]]|C|$]]|$1|H|3|I|5|6|7|1D|8|@$A|1E|B|1F|J|K]]|9|@]|C|$]]|$1|L|3|M|5|6|7|1G|8|@]|9|@$A|1H|B|1I|1|1J]]|C|$]]|$1|N|3|-4|5|6|7|1K|8|@]|9|@]|C|$]]]|O|$P|$5|Q|R|S|C|$T|U]]|V|$5|Q|R|S|C|$T|W]]|X|$5|Q|R|S|C|$T|Y]]|Z|$5|Q|R|S|C|$T|10]]]]

There was the <a href="http://www.owasp.org/index.php/Category%3aOWASP_Certification_Project" rel="nofollow">OWASP Certification Project</a>, but from what I can tell it's not active anymore (although some of the content linked still appears to be active).

While not PHP specific, there's also the <a href="http://www.giac.org/" rel="nofollow">GIAC Certification</a>. It's targeted towards general security as opposed to language specific techniques (from what I can gather anyway)...

There's also the <a href="http://www.sans-ssi.org/" rel="nofollow">Software Security Institute</a>... I have no background with them, so I can't really vouch, but it appears to have what you're looking at.

Edit: After some reflection:

Honestly, I don't see the point in certificates. If you want to attend training, great! But all that a certificate does is prove you were able to pass a test. It doesn't say anything about what you know or your capabilities... Get real world experience, that's worth more than any certificate any day of the week. Get involved with open source projects (especially from the security front, a lot need help there in my experience). Get involved with <a href="http://www.owasp.org/index.php/Main_Page" rel="nofollow">OWASP</a>. Gain some real world experience, attend conferences and user groups to continue learning. It'll be worth 10 times as much as the certificate...

blocks|key|2235485|text|获取PHP项目的CVE编号。如果在PHP代码中找不到漏洞才是最重要的，那么拥有证书并不意味着一件该死的事情。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2235486|为了理解代码如何是不安全的，我建议安装该死的脆弱的WebApp。您还应该查看现实世界中的漏洞，比如在白盒上发现的漏洞。PHP/MySQL项目的博客和商店，因为它们太不安全而被放弃了。这些挑战是在野外发现的困难的安全系统，但它们也非常不安全。对于一些令人讨厌的PHP安全性阅读，我建议使用“红”研究。|offset|length|2235487|entityMap|0|LINK|mutability|MUTABLE|url|http://www.dvwa.co.uk/|1|http://code.google.com/p/thewhitebox/|2|http://www.securereality.com.au/studyinscarlet.txt^0|0|J|C|0|1E|2|1|3Z|5|2|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|S|8|@]|9|@$D|T|E|U|1|V]|$D|W|E|X|1|Y]|$D|Z|E|10|1|11]]|A|$]]|$1|F|3|-4|5|6|7|12|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|M]]|N|$5|I|J|K|A|$L|O]]|P|$5|I|J|K|A|$L|Q]]]]

Get a CVE number for a PHP project. If you can't find vulnerabilities in PHP code is what matters, having a certification doesn't mean a damn thing.

In order to understand how code can be insecure I suggest Installing <a href="http://www.dvwa.co.uk/" rel="nofollow">Damn Vulnerable WebApp</a>. You should also look at real world vulnerabilities such as the ones found on <a href="http://code.google.com/p/thewhitebox/" rel="nofollow">The Whitebox</a>. The blog and shop where PHP/MySQL projects that where abandoned because they are so insecure. The challenges are difficult security systems found in the wild, however they too are very insecure. For some offensive PHP security reading I suggest <a href="http://www.securereality.com.au/studyinscarlet.txt" rel="nofollow">A Study In Scarlet</a>.

I've started reading a book on PHP security (but it's really all theoretical not so much practical) and have it in my plan to read Chris Shiflett's and Schenider's blogs, but does anyone know of a formal course that I can attend or even get a certificate that proves I know how to write secure PHP code?

<hr>

Edit: I got a lot of answers, some of which don't answer my question. So I'm quoting ircmaxell's comment because it really hits the point. 

<blockquote>
 While I agree with the cert not
 mattering (and that finding
 vulnerabilities is the best way to
 learn), I'm not sure that answers the
 question. How should one go from not
 knowing anything about security to the
 point where they can do audits to be
 able to find vulnerabilities
</blockquote>

What I want to add though is that while I agree that experience is more important that certification, certification is not unimportant. It's a quick proof that I know more than the high school hobbyist programmer from India who's charging $30 for a full project.

Training courses (or certification) for PHP security

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云AI代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

功能1上新10个字符

功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符。

功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符。

功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符

功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符

功能4上新

文章&问答评论现已支持表情

全新交互，全新视觉，新增快捷键、悬浮工具栏、高亮块等功能并同时优化现有功能，全面提升创作效率和体验

社区富文本编辑器全新改版！诚邀体验～ 

精选全网热门MCP server，让你的AI更好用 🚀

💥开发者 MCP广场重磅上线！

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

我已经开始读一本关于PHP安全性的书(但实际上理论上并不那么实用)，我计划阅读Chris和Schenider的博客，但有没有人知道我可以参加一门正式课程，甚至获得证明我知道如何编写安全PHP代码的证书？编辑：，我得到了很多答案，其中有些没有回答我的问题。因此，我引用ircmaxell的评论，因为它真的触及了重点。虽然我同意证书并不重要(发现漏洞是最好的学习方法)，但我不确定是否回答了这个问题。一个

问PHP安全培训课程(或认证)
EN

回答 6

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问PHP安全培训课程(或认证)EN

回答 6

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问PHP安全培训课程(或认证)
EN