CHMOD 777 - Is This Hosting Setting Insecure?

Question

I am looking at using an off-the-shelf script.
The script requires CHMOD 777 settings
I read variously that such a setting is insecure.
Is this insecure
If so, could someone kindly explain how
If it is insecure, how would such scripts be made secure and still function?
W.

Answer 1

Could you give some concrete examples of what you mean when you say that the script may be badly written.
PHP security is a vast subject, but the most common error is the use of unfiltered user input. Take a look at the following article: http://www.sitepoint.com/article/php-security-blunders/. You'll also find a lot of information by doing a Google search for "PHP security".
The problem with identifying a badly written script is that it might do everything it's meant to, so you remain unaware of potential security loopholes. Unfortunately, security is a moving target. Many people, including myself, were caught out a few years ago by an exploit called "email header injection". It turns an online form into a spam relay by injecting spurious code into the email field of a form. Although I have warned users of this forum about it for several years, I still see people using scripts that are wide open to such exploits.