As an addendum, I'd add: "Learn about SQL injection." This is still the most common attack vector against a web application. Most modern frameworks will protect you from this, but you should absolutely know what it is, how it works, and how to avoid being open to it.
It's so sad that it still is. I mean it's a solved problem, just use prepared statements and you are save!
Yes, and you can't imagine how many website are vulnerable to this kind of attack and XSS and CSRF as well.
Even if they are well known and have great mitigation techniques.
Follow secure tips like the ones described here and the OWASP documents and you are good to go.
Yes ! I recommend this short but useful resource, also the same site have a good resource about PDO
And better read this: phpsecurity.readthedocs.io/en/latest/
PHP7 is probably the best web language in existence today.
In the world of Python and Ruby, building websites from the ground up is tiresome because neither Python nor Ruby was originally created to build websites. As a result general-purpose frameworks such as Django and Ruby on Rails quickly became popular for building websites in these languages.
PHP on the other hand was created in the beginning by Rasmus Lerdorf as a set of tools written in C that would enable you to easily and quickly develop dynamic HTML.
Another development secure tip is use env variables to config
Great post Andrew! I think these tips are great as a checklist of sorts to go through when developing/deploying a new PHP site such as turning off verbose errors etc. but I think it's just as (if not more) important that as developers we understand the ways in which our applications and websites could be attacked.
Using frameworks is a good way to protect against these sorts of exploits however it is much better if the dev understands the way in which the framework is protecting them as it is still rather easy for an uninformed dev to code around the protections most modern frameworks offer (raw DB queries etc.) without realising that they may be compromising the security of their application.
Check out this course: hacker101.com/ I completed it recently and it truly does open your eyes up to some of the super complex ways people are able to exploit websites.
I would add another one: Use a well-supported Web Framework
Phew, I had it all ;)
You should also use password_needs_rehash once you verified a password, this ensures that you keep the most up-to-date hashing algorithm.
I'd like to add one more, use security tokens. A security token makes sure the client did sent a certain request to your application. I'm maintaining the following open-source PHP package: CSRF Protection where you can use tokens and validate them without too much boilerplate code.
Great post Andrew!
Thanks for this guide
XSLT is the best template framework.
Hey, I've tried to cover few PHP security tips in detail here: cloudways.com/blog/php-security/
I hope you like it and feedbacks are welcome.
We're a place where coders share, stay up-to-date and grow their careers.
We strive for transparency and don't collect excess data.