Security Best Practices

Introduction

A PHP application that works correctly is not the same as a PHP application that is safe to put on the internet. Because PHP so often handles logins, payments, and user-submitted content, security has to be a habit, not an afterthought bolted on at the end.

Several of these topics — prepared statements and password hashing in particular — were covered in earlier lessons when you built database and authentication features. This lesson pulls those ideas together with a few new ones, forming a single security checklist you can apply to every project you build.

Preventing SQL Injection

SQL injection happens when untrusted input is concatenated directly into a SQL query, letting an attacker change what the query actually does. You saw this danger back in the Prepared Statements lesson — the fix is to never build queries with string concatenation.

$id = $_GET['id'];
$result = $conn->query("SELECT * FROM users WHERE id = $id");
// An attacker could pass ?id=1 OR 1=1 and expose every row

$stmt = $conn->prepare("SELECT * FROM users WHERE id = ?");
$stmt->bind_param("i", $_GET['id']);
$stmt->execute();
$result = $stmt->get_result();

Preventing XSS

Cross-Site Scripting (XSS) happens when untrusted input is output into HTML without escaping, allowing an attacker to inject a <script> tag or other markup that runs in another user's browser. The fix is simple and consistent: always escape output with htmlspecialchars().

$comment = $_POST['comment'];
echo "<p>$comment</p>";
// An attacker could submit <script>stealCookies()</script>

$comment = $_POST['comment'];
echo "<p>" . htmlspecialchars($comment, ENT_QUOTES, 'UTF-8') . "</p>";

Password Hashing Recap

As covered in the Password Hashing lesson, passwords must never be stored as plain text or with a fast, general-purpose hash like md5() or sha1(). PHP's built-in password functions handle this correctly and safely by default.

// When a user registers:
$hash = password_hash($plainTextPassword, PASSWORD_DEFAULT);
// Store $hash in the database, never the original password

// When a user logs in:
if (password_verify($enteredPassword, $hash)) {
    echo "Login successful.";
} else {
    echo "Invalid credentials.";
}

Login successful.

CSRF Protection Basics

Cross-Site Request Forgery (CSRF) tricks a logged-in user's browser into submitting a request they never intended — for example, a malicious site silently submitting a form that transfers money on a banking site where the user is already logged in. The standard defense is a CSRF token: a random, secret value embedded in every form and verified on submission.

<?php
session_start();
if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
?>
<form method="POST" action="process.php">
    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
    <input type="text" name="message">
    <button type="submit">Submit</button>
</form>

<?php
session_start();

$submittedToken = $_POST['csrf_token'] ?? '';

if (!hash_equals($_SESSION['csrf_token'] ?? '', $submittedToken)) {
    http_response_code(403);
    die("Invalid CSRF token.");
}

echo "Form processed safely.";

Form processed safely.

Because the token is stored in the user's session and only known to the legitimate form, a request forged from another site cannot supply a matching token.

Validating and Sanitizing Input

SQL injection, XSS, and CSRF are all specific consequences of a more general rule: never trust data that comes from the user. Every piece of incoming data — form fields, query strings, uploaded files, even cookies — should be validated against what you expect before it is used.

$email = trim($_POST['email'] ?? '');

if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    die("Please provide a valid email address.");
}

$age = filter_var($_POST['age'] ?? '', FILTER_VALIDATE_INT, [
    'options' => ['min_range' => 0, 'max_range' => 120],
]);

if ($age === false) {
    die("Please provide a valid age.");
}

echo "Input validated successfully.";

Input validated successfully.

Keeping PHP and Dependencies Updated

Security is not only about the code you write — the PHP version and Composer packages you depend on matter too. Older PHP versions and outdated libraries can carry known, publicly documented vulnerabilities that attackers actively scan for.

Security Checklist

Common Mistakes

Best Practices

Frequently Asked Questions

Key Takeaways

Summary

Security in PHP is less about any single clever trick and more about consistently applying a small set of well-known practices: prepared statements, output escaping, proper password hashing, CSRF tokens, input validation, and staying up to date. Together, these form a solid baseline for any real-world application.

In this lesson, you reviewed and consolidated the core PHP security practices covered throughout the course. Next, you will look at performance optimization techniques to keep your applications fast as they grow.