Hi, folks. I have been evaluating oscommerce, and before even getting to configuring my shop I had to give up because it is just too much of a mess. Before I go through the same process with ZC, perhaps someone could tell me if it has a better security model?

When I set up oscommerce, I was instructed to:
  • Turn on register globals
  • Make several folders world-writable
  • "Secure" the completely open admin directory with an apache realm (which still sends the password in the clear)

All of these seem like big security problems to me. I was able to locate and install a patch that took away the register globals need, but it promised to break any other module I would attempt to install.

Is ZenCart any better, or am I going to have the same issues?

Thanks.