How to create cool web applications with data protection?

Question

PHP

In general, I asked myself a task when choosing a graduation thesis - to create a "Calendar-To-Doo List" web application with user data protection, but I came across a problem that I can't even draw up an approximate technical specification for myself. I know PHP at the level of "C + HTML = magic", JS at the level of jQuery, AJAX at the level of "heal the guys in the padik, like smart". I worked as a Bitrix progger, you understand ...
No, all this is of course an understatement, in general, I understand what and where to fasten in order to get a notable profit, but in many cases I don’t understand how to fasten it. Well, here's the question itself, or rather questions:

1. If anyone has come across information protection in web applications, share links - how data encryption-decryption is implemented on the server and client side, if the client uses a browser.

2. What database to use? The question is stupid, but I only worked with Bitrix infoblocks, and studied MySQL a little. Maybe it's time to learn something new?

3. Actually, the web application itself. How is it built, where to start, how to finish? Maybe someone had experience, maybe someone already shared it on Habré.

I know how to use Google, but I'm afraid that I will stumble upon low-quality, outdated or very sophisticated articles, and will only aggravate the situation. Thank you in advance.

Answer 1

1. Any libraries that implement already compiled encryption standards.
To the question "why not write your own algorithm?" I send court for an answer .
It is worth remembering that both the client and the server must know the key. In this regard, the courts should be followed .
2. If you decide to use PHP, then I confidently advise you to run the database as a server (even if it is local). For a small project, absolutely any database is suitable, even a NoSQL database.

Answer 2

1. If anyone has come across the protection of information in web applications, share links - how data encryption-decryption is implemented on the server and client side, if the client uses a browser.

Configuring https in nginx
MySQL Encryption
Koterov PHP5 In the podletnik
------
Judging by the wording of the question of knowledge, it’s not so hot at all, before creating a securitious application - try to create at least some one))

Answer 3

1. I'm looking for a solution myself.
2. I wrote my application in PHP and MySQL. It is possible in another way (JAVA, ASP, etc.). Read about json.
3. The essence is simple, point by point:
Server part. Write the application like a normal website. Interaction of the code with the database and display on the browser screen, Then you create the API. the same pages, only the output is no longer in the usual format, but in json format.
Customer. Written in JS (PHP is also possible) connects via AJAX to the server side, receives and processes json. After processing, it displays in a browser or application window.
I divided into 2 servers, but it is possible on one.

Answer 4

simple: HTTPS
correct: CRAM-MD5/HMAC ( wikipedia )
libraries for implementation in js - everything is in the public domain.

Answer 5

Before writing applications \ making a website, you first need to decide what kind of application it is and what kind of data needs to be protected in it, then, having already a semblance of context, you can think about the structure / architecture, select a database, etc. For an abstract horse in a vacuum, such questions do not make sense. Each task has its own tools, and if you use the wrong ones late in the project, you will realize that hammering the screws with a hammer is a bad idea and you will have to redo everything. So first decide what exactly you want to create.
And in essence, the lower the level of abstraction in development and the lower the level of the programmer, the more likely it is to make holes that can be used to the detriment of the site / application, so creating an application on html \ js \ php and the like without experience is tantamount to the fact that you just share your data in the public domain.