Small utilities and custom tools.
BEFORE INSTALLING ANYTHING
Where did it come from? Only install from the developer's own site or a reputable repository. When was it last updated? Abandoned scripts do not receive security fixes. Does it have a licence you can comply with? Does it need database access, file writing, or email sending?
THE PROCEDURE
- Upload and extract into its own directory, not into
public_htmlroot alongside everything else. - Create a database and user if it needs one.
- Set permissions: 755 directories, 644 files, 600 for configuration.
- Run the installer or edit the configuration file.
- Delete any install script afterwards.
SECURITY CHECKS
Does it validate input, or does it accept anything? Does it have an admin area, and is it protected? Does it write files, and where? Does it send email, and from what address?
WHAT TO AVOID
Scripts distributed on forums with no named author Anything encoded or obfuscated, which hides what it does Anything requiring 777 permissions
RECORD IT
Note what you installed and where. Forgotten scripts are a common route into accounts.
