Suhosin

The security setting that Suhosin are definitely the right way to go, however as a developer it sometimes creates more work to build a custom app that will function correctly under the Suhosin rules.

For example if you are building a custom CMS you must limit the number of input variables in a post array, or Suhosin will silently remove elements from the array. As such your application can behave erratically. There doesn't seem to be any error output, your data is silently dropped. This makes it hard to figure out what the cause is.

This happens quite a bit with PHPMyAdmin which can become very buggy using Suhosin's default rules. On large tables with many fields PHPMyAdmin will throw errors when used in conjunction with Suhosin.

I have a feeling PHPMyAdmin is one of the main reasons why Suhosin has not been adopted offically. Because a default Suhosin install will break PHPMyAdmin.


Anyhow great Blog! Keep posting!

Right but Suhosin also allows you to configure the limit variables if necessary. The default is 200 which should be fine.

hardened-php.net/suhosin/configurat ...

I doubt that PHPMyAdmin uses more than 200 request variables. If they do, the application is badly designed.

Other than that Suhosin does not filter variables silently. You can send filtered actions to a log.

hardened-php.net/suhosin/configurat ...

All this is done finally since PHP 5.3.9, so if this is a problem with Suhosin, it is a problem with PHP too now.