Re: My very first website.... what you all think?

Originally Posted by
cristopher_caducoy96
This site is static, highly vulnerable for intrusion. I suggest, make it dynamic for more secure.
What on earth makes you think that a dynamic site is more secure than a static site? If I can get write access to the file system, I can just as easily change a PHP page as an HTML page. And changing things at the level of the file system is the only way to deface a static site. With a dynamic site, all I need to do to change content is to gain control over an author's account (and there is usually more than one), as often as not by sniffing usernames and passwords from HTTP packets. Or I can often count on SQL injection because the site's developer(s) disn't use parameterized statements. Or I can use cross-site scripting because you didn't properly sanitize user inputs. Or I can do cross-site request forgeries. The list goes on.
There is one "default secure" dynamic web environment out there that I'm aware of (IBM Lotus Domino), and even that is often insecure in practice because the developer/administrator is not aware of techniques to keep it secure. (It's often easier to "open a door" than it is to code things properly.) Dynamic doesn't mean safe; it means you've chosen to add attack vectors (that you are responsible for minimizing) in exchange for increased functionality or ease of maintenance.
“Beware of bugs in the above code; I have only proved it correct, not tried it.” --Donald Knuth
"It was as if its architects were given a perfectly good hammer and gleefully replied, 'neat! With this hammer, we can build a tool that can pound in nails.'" -- Alex Papadimoulis (on TheDailyWTF.com)