PHP applications have a reputation for higher than average security problems. What configuration techniques do you use for making sure the application is secure as possible?
I'm looking for ideas like:
- Using Hardened PHP/Suhosin
- Using mod_security
- Disabling register_globals and allow_url_fopen in php.ini
I normally use Linux, but feel free to suggest Windows solutions too.