title: PHP and htaccess security
body: <p>I am working freelance on a website that website hacked 3 times before my working.</p>
  
  <p>I am working now and after some chnges I will upload I use these steps for security. some other help full tips will be appreciated. </p>
  
  <p>I thought there is a problem with server because some port was not secure. And I am not able to find and communicate that with server administrator.</p>
  
  <p>I want to make completely secure site from hack:</p>
  
  <p>I use these two functions for prevent with sql injections.</p>
  
  <pre><code>function escape($string) {
      if(get_magic_quotes_gpc()) $string = stripslashes($string);
      return mysql_real_escape_string($string);
  }
  </code></pre>
  
  <p>And some time use:  </p>
  
  <pre><code>function remove_spc_chr($str){
          $str=trim($str);
  
          $arr=array('%','$','/','\\','*','+','=','\'','"','#','@','(',')','^','~','`','&amp;',
                  ',',';','\'','?','&lt;','&gt;','!','{','}','[',']');
  
          $str=str_replace($arr,'',$str);
  
          $str=strip_tags($str);
  
          return $str;        
  }
  </code></pre>
  
  <p>And I use for htaccess security this code:</p>
  
  <pre><code>RewriteEngine on
  Options -Indexes
  
  Options +FollowSymlinks
  RewriteRule ^(.*)\.html$ $1.php [nc]
  
  
  Options +FollowSymlinks
  RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]
  RewriteCond %{QUERY_STRING} http:.*\/.*\/ [OR]
  RewriteCond %{QUERY_STRING} ..*\/ [OR]
  RewriteCond %{QUERY_STRING} (\&lt;|%3C).*script.*(\&gt;|%3E) [NC,OR]
  RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
  RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
  RewriteCond %{QUERY_STRING} [^a-z](declare|char|set|cast|convert|delete|drop|exec|insert|meta|script|select|truncate|update)[^a-z] [NC]
  RewriteRule (.*) - [F]
  
  
  &lt;IfModule mod_rewrite.c&gt;
  RewriteCond %{HTTP_USER_AGENT} (google|yahoo|aol|slurp|bing) [OR]
  RewriteCond %{HTTP_REFERER} (google|aol|yahoo|search|bing)
  RewriteCond %{REQUEST_URI} /$ [OR]
  RewriteCond %{REQUEST_FILENAME} (html|htm|php|phps|shtml|xml|xhtml|phtml)$ [NC]
  &lt;/IfModule&gt;
  
  
  
  
  #Block out any script trying to set a mosConfig value through the URL
  RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR]
  
  #Block out any script trying to base64_encode crap to send via URL
  RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]
  
  #Block out any script that includes a script tag in URL
  RewriteCond %{QUERY_STRING} (\&lt;|%3C).*script.*(\&gt;|%3E) [NC,OR]
  
  
  #Block out any script trying to set a PHP GLOBALS variable via URL
  RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
  
  #Block out any script trying to modify a _REQUEST variable via URL
  RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
  
  #Send all blocked request to homepage with 403 Forbidden error!
  #RewriteRule ^(.*)$ index.html [F,L]
  
  
  #DirectoryIndex index.html
  
  SetEnv TZ America/California
  AddDefaultCharset utf-8
  DefaultLanguage en-US
  LimitRequestBody 10240000
  
          &lt;FilesMatch "\.(htaccess|htpasswd|ini|phps|fla|psd|log|sh)$"&gt;
           Order Allow,Deny
           Deny from all
          &lt;/FilesMatch&gt;
  
          &lt;ifmodule mod_php4.c&gt;
           #php_value zlib.output_compression 16386
          &lt;/ifmodule&gt;
  
          AddType image/gif                       .gif .GIF
          AddType image/ief                       .ief
          AddType image/jpeg                      .jpeg .jpg .jpe .JPG
          AddType image/tiff                      .tiff .tifAuthName wapadik.net
          IndexIgnore .htaccess */.??* *~ *# */HEADER* */README* */_vti*
  
          RewriteCond %{REQUEST_METHOD} (GET) [NC]
          RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)https(%3A|:)(/|%2F){2}(.*)$ [NC,OR]
          RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)https%3a(%3A|:)(/|%2F){2}(.*)$ [NC,OR]
          RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)http(%3A|:)(/|%2F){2}(.*)$ [NC]
          RewriteRule (.*) /huwad/blocker/blocker1.php   [L]
  
          RewriteCond %{REQUEST_METHOD} (GET|POST) [NC]
          RewriteCond %{QUERY_STRING} ^(.*)(%20SELECT%20|%20INSERT%20|CHAR\(|%20UPDATE%20|%20REPLACE%20)(.*)$ [NC]
          RewriteRule (.*) /huwad/blocker/blocker1.php   [L]
  
          RewriteCond %{REQUEST_METHOD} (GET|POST) [NC]
          RewriteCond %{QUERY_STRING} ^(.*)(%3C|&lt;)/?script(.*)$ [NC,OR]
          RewriteCond %{QUERY_STRING} ^(.*)(%3D|=)?javascript(%3A|:)(.*)$ [NC,OR]
          RewriteCond %{QUERY_STRING} ^(.*)document\.location\.href(.*)$ [OR]
  
          RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)http%3a(%3A|:)(/|%2F){2}(.*)$ [NC,OR]
          RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)ftp(%3A|:)(/|%2F){2}(.*)$ [NC,OR]
          RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)ht%20tp(%3A|:)(/|%2F){2}(.*)$ [NC,OR]
          RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)htt%20p(%3A|:)(/|%2F){2}(.*)$ [NC,OR]
          RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)http%20(%3A|:)(/|%2F){2}(.*)$ [NC,OR]
          RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)h%20ttp(%3A|:)(/|%2F){2}(.*)$ [NC,OR]
  
          RewriteCond %{QUERY_STRING} ^(.*)base64_encode(.*)$ [OR]
          RewriteCond %{QUERY_STRING} ^(.*)GLOBALS(=|[|%[0-9A-Z]{0,2})(.*)$ [OR]
          RewriteCond %{QUERY_STRING} ^(.*)_REQUEST(=|[|%[0-9A-Z]{0,2})(.*)$ [OR]
          RewriteCond %{REQUEST_URI} ^(.*)_vti(.*)$ [OR]
          RewriteCond %{REQUEST_URI} ^(.*)MSOffice(.*)$ [OR]
          RewriteCond %{QUERY_STRING} ^(.*)/etc/passwd(.*)$ [OR]
          RewriteCond %{QUERY_STRING} ^(.*)//(.*)$ [OR]
          RewriteCond %{REQUEST_URI} ^(.*)ShellAdresi.TXT(.*)$ [OR]
          RewriteCond %{REQUEST_URI} ^(.*)\[evil_root\]?(.*)$ [OR]
          RewriteCond %{QUERY_STRING} ^(.*)\.\./\.\./\.\./(.*)$ [OR]
          RewriteCond %{QUERY_STRING} ^(.*)/proc/self/environ(.*)$
          RewriteRule (.*) /huwad/blocker/blocker1.php   [L]
  
          RewriteCond %{HTTP_USER_AGENT} @nonymouse|ADSARobot|amzn_assoc|Anarchie|ASPSeek|Atomz|^[^?]*addresses\.com|Advanced\ Email\ Extractor|ah-ha|aktuelles|almaden|Art-Online|AspiWeb|ASSORT|ATHENS|attach|attache|autoemailspider|BackWeb|Bandit|BatchFTP|bdfetch|big.brother|BlackWidow|bmclient|Boston\ Project|Bot\ mailto:craftbot@yahoo.com|BravoBrian\ SpiderEngine\ MarcoPolo|Buddy|Bullseye|bumblebee|capture|CherryPicker|ChinaClaw|CICC|clipping|Crescent\ Internet\ ToolPack|cURL|Custo|cyberalert|Deweb|diagem|Digger|Digimarc|DIIbot|DirectUpdate|DISCo|Download\ Accelerator|Download\ Demon|Download\ Wonder|Downloader|Drip|DSurf15a|DTS.Agent|EasyDL|eCatch|echo\ extense|ecollector|efp@gmx\.net|EirGrabber|EmailCollector|Email\ Extractor|EmailSiphon|EmailWolf|Express\ WebPictures|ExtractorPro|EyeNetIE|fastlwspider|FavOrg|Favorites\ Sweeper|Fetch\ API\ Request|FEZhead|FileHound|FlashGet|FlickBot|fluffy|frontpage|GalaxyBot|Generic|Getleft|GetRight|GetSmart|GetWeb!|GetWebPage|gigabaz|Girafabot|Go!Zilla|Go-Ahead-Got-It|GornKer|Grabber|GrabNet|Grafula|Green\ Research|Harvest|hhjhj@yahoo|hloader|HMView|HomePageSearch|HTTP\ agent|HTTPConnect|httpdown|http\ generic|HTTrack|^[^?]*iaea\.org|IBM_Planetwide|^[^?]*\.ideography\.co\.uk|Image\ Stripper|Image\ Sucker|imagefetch|IncyWincy|Indy\ Library|informant|Ingelin|InterGET|Internet\ Ninja|InternetLinkAgent|InternetSeer\.com|Iria|Irvine|iOpus|IPiumBot\ laurion(dot)com|Jakarta|JBH*Agent|JetCar|JustView|Kapere|KWebGet|Lachesis|larbin|LeechFTP|LexiBot|lftp|libwww|likse|Link*Sleuth|LINKS\ ARoMATIZED|LinkWalker|LWP|lwp-trivial|Magnet|Mac\ Finder|Mag-Net|Mass\ Downloader|MemoWeb|MCspider|Microsoft\ URL\ Control|MIDown\ tool|minibot\(NaverRobot\)|Mirror|Missigua\ Locator|Mister\ PiX|MMMtoCrawl\/UrlDispatcherLLL|MSProxy|multithreaddb|nationaldirectory|Navroad|NearSite|NetAnts|NetCarta|netfactual|netcraft|NetMechanic|netprospector|NetResearchServer|NetSpider|Net\ Vampire|NetZIP|NEWT|nicerspro|NPBot|Octopus|Offline\ Explorer|Offline\ Navigator|OpaL|Openfind|OpenTextSiteCrawler|OutWit|PackRat|PageGrabber|Papa\ Foto|pavuk|pcBrowser|PersonaPilot|PingALink|Pockey|Program\ Shareware|psbot|PSurf|puf|Pump|PushSite|QRVA|QuepasaCreep|RealDownload|Reaper|Recorder|ReGet|replacer|RepoMonkey|Robozilla|Rover|RPT-HTTPClient|Rsync|SearchExpress|searchhippo|searchterms\.it|Second\ Street\ Research|Shai|sitecheck|SiteMapper|SiteSnagger|SlySearch|SmartDownload|snagger|SpaceBison|Spegla|SpiderBot|SqWorm|Star\ Downloader|Stripper|Sucker|SuperBot|SuperHTTP|Surfbot|SurfWalker|Szukacz|tAkeOut|tarspider|Teleport\ Pro|Telesoft|Templeton|traffixer|TrueRobot|TuringOS|TurnitinBot|TV33_Mercator|UIowaCrawler|URL_Spider_Pro|UtilMind|Vacuum|vagabondo|vayala|visibilitygap|vobsub|VoidEYE|vspider|w3mir|web\.by\.mail|Web\ Data\ Extractor|Web\ Downloader|Web\ Image\ Collector|Web\ Sucker|WebAuto|webbandit|Webclipping|webcollector|webcollage|WebCopier|webcraft@bea|WebDAV|webdevil|webdownloader|Webdup|WebEmailExtractor|WebFetch|WebGo\ IS|WebHook|Webinator|WebLeacher|WebMiner|WebMirror|webmole|WebReaper|WebSauger|WEBsaver|Website\ eXtractor|Website\ Quester|WebSnake|Webster|WebStripper|websucker|webvac|webwalk|webweasel|WebWhacker|WebZIP|Wget|whizbang|WhosTalking|Widow|WISEbot|WUMPUS|Wweb|WWWOFFLE|Wysigot|Xaldon\ WebSpider|XGET|x-Tractor|Zeus.* [OR]
  
          RewriteCond %{REQUEST_URI} .*((php|my)?shell|remview.*|phpremoteview.*|sshphp.*|pcom|nstview.*|c99|r57|webadmin.*|phpget.*|phpwriter.*|fileditor.*|locus7.*|storm7.*)\.(p?s?x?htm?l?|txt|aspx?|cfml?|cgi|pl|php[3-9]{0,1}|jsp?|sql|xml) [NC,OR]
          RewriteCond %{REQUEST_METHOD} (GET|POST) [NC]
          RewriteCond %{QUERY_STRING} ^(.*)=/home(.+)?/(.*)/(.*)$ [OR]
          RewriteCond %{QUERY_STRING} ^work_dir=.*$ [OR]
          RewriteCond %{QUERY_STRING} ^command=.*&amp;output.*$ [OR]
          RewriteCond %{QUERY_STRING} ^nts_[a-z0-9_]{0,10}=.*$ [OR]
          RewriteCond %{QUERY_STRING} ^c=(t|setup|codes)$ [OR]
          RewriteCond %{QUERY_STRING} ^act=((about|cmd|selfremove|chbd|trojan|backc|massbrowsersploit|exploits|grablogins|upload.*)|((chmod|f)&amp;f=.*))$ [OR]
          RewriteCond %{QUERY_STRING} ^act=(ls|search|fsbuff|encoder|tools|processes|ftpquickbrute|security|sql|eval|update|feedback|cmd|gofile|mkfile)&amp;d=.*$ [OR]
          RewriteCond %{QUERY_STRING} ^&amp;?c=(l?v?i?&amp;d=|v&amp;fnot=|setup&amp;ref=|l&amp;r=|d&amp;d=|tree&amp;d|t&amp;d=|e&amp;d=|i&amp;d=|codes|md5crack).*$ [OR]
          RewriteCond %{QUERY_STRING} ^(.*)([-_a-z]{1,15})=(ls|cd|cat|rm|mv|vim|chmod|chdir|mkdir|rmdir|pwd|clear|whoami|uname|tar|zip|unzip|tar|gzip|gunzip|grep|more|ln|umask|telnet|ssh|ftp|head|tail|which|mkmode|touch|logname|edit_file|search_text|find_text|php_eval|download_file|ftp_file_down|ftp_file_up|ftp_brute|mail_file|mysql|mysql_dump|db_query)([^a-zA-Z0-9].+)*$ [OR]
          RewriteCond %{QUERY_STRING} ^(.*)(wget|shell_exec|passthru|system|exec|popen|proc_open)(.*)$
          #RewriteRule  (.*)  /huwad/blocker/blocker3.php  [L]
  
  
  ErrorDocument 400 /index.html
  ErrorDocument 403 /index.html
  ErrorDocument 404 /index.html
  ErrorDocument 405 /index.html
  ErrorDocument 408 /index.html
  ErrorDocument 500 /index.html
  ErrorDocument 502 /index.html
  ErrorDocument 504 /index.html
  
          &lt;Files 403.shtml&gt;
          order allow,deny
          allow from all
          &lt;/Files&gt;
  </code></pre>
  
  <p><a href="http://coding-talk.com/f16/how-to-block-sql-injection-and-php-shell-uploaders-using-the-htaccess-file-7825/" rel="nofollow">Htaccess Reference</a></p>
  
  <p>I check variable proper before using in query.</p>
  
  <p>If there is and security step that will be help full for me?</p>
  
  <p>Kindly Answer security steps if there is a problem or any hole.</p>