Cross Site Scripting on my website

There are a number of steps.

1. Edit PHP.INI and look for the "disable_functions" setting and set it like so

disable_functions = show_source, system, shell_exec, passthru, exec, popen, proc_open, proc_close, proc_terminate, proc_get_status, proc_nice, symlink, exec, proc_close, popen, dl, escapeshellarg, escapeshellcmd , php_uname, disk_free_space, disk_total_space

2. If you do not have open_basedir restrictions in effect, consider using them

3. Disallow "%" as a character in filenames - particularly uploads

4. Never trust data from the $_SERVER array. Use

    strip_tags( $_SERVER['PHP_SELF'])
   
    rather than $_SERVER['PHP_SELF']

5. Make sure all input from $_POST and $_GET is escaped by mysql_real_escape_string

6. In MySQL queries ALWAYS quote data - especially integer data like so

    mysql_query("select * from table where myInt='123' order by something");


If you do that little lot you will close down most avenues of attack.

I forgot the biggest security hazard of the lot - ensure that "register_globals" is OFF

2. If you do not have open_basedir restrictions in effect, consider using them --- How do I do this, what command do I put here?

This goes in the virtualhost for each website and restricts the PHP for that website to a set of folders. If you do this for every website you host then it can only infect its own code and this makes it easier to clean up. You simply give it a list of folders that are considered "safe" for that website. For example

php_admin_flag engine on
php_admin_value open_basedir "/www/htdocs/mysite.co.uk:/www/some/other/folder:"



3. Disallow "%" as a character in filenames - particularly uploads -- How is this enabled and done?

Anywhere in your code that you are processing a file upload - usually with a  <input type='file'..... /> tag, before moving the file up to the server, inspect the name. If it contains a % then reject it. If it contains "suspicious" characters like .js, .php or .exe in the filename then consider rejecting it. An old trick is to try a file named something like my_picture.php%00.jpg which is a PHP script rather than a JPG. To Apache the %00 looks like an  "end of string" character and so it executes my_picture.php


rather than $_SERVER['PHP_SELF'] ---- This is supposed to be in the PHP code for the site , not the php.ini file right?

Correct. Scan for $_SERVER in your code and look at each case.