Is XAMPP safe for use inside a firewall?

Question

This is partly related to this question.

I am deploying a PHP/MySQL application in my office, for my LAN. It will not be accessible to the outside world unless they can enter my wireless network (which is not broadcasting the SSID so only we know about it). This application will be hosting sensitive data that cannot be compromised. So my question is, is it safe to use an XAMPP installation with it being behind a firewall and an encrypted, invisible wifi connection, or should i take further precautions?

Answer 1

Not broadcasting the SSID is not really effective. However, if your Wifi network is WPA2 encrypted, then you should be relatively okay. You might want to use non standard ports for the XAMPP stuff and block them in your router's firewall.

Keep in mind that XAMPP isn't meant for production. Remember to make passwords for everything, as XAMPP comes with no passwords. For a really secure system, the best option is to install everything (Apache, PHP, MySQL, etc) manually and make sure they are properly secured.

Answer 2

Generally yes. Apache is the only service that will be exposed to the network and it was designed to survive the wild internets. It is very robust.

What may not be robust is the website you're serving. Be aware of SQL injection attacks and safe parsing/escaping of parameters in your web app. Basically be aware that users can access your web service by directly typing in the browser's URL bar and not just via forms and buttons in the web page.

But since this is the local environment if any problems crop up caused by users trying to hack the website you can always find out who did it from the server logs and slap them* ;-)

* note: just kidding, I'm not seriously advocating violence

Answer 3

Well, if its a windows box, apache mysql and php run on windows. If its a linux box.. there's no reason to use xampp. Xampp is generally meant for when you need a portable environment for testing, not really for 'production' use. In addition, setting up *amp yourself means, if anything goes bad, you know how to fix it.

In a safe environment, though, i suppose you can use xampp - just remember to update every so often, and turn off the FTP server if you don't use it