Member Avatar for trektrak

Hello guys,

I've been playing around with php / sql programming like 6 months now. I would love to know what is the most basic security that I need to apply for php programming ... well at least the basic..

Well if you can list down .. and some snippets example..

  • 3 Contributors
  • 2 Replies
  • 183 Views
  • 8 Minutes Discussion Span
  • Latest Post Latest Post by dany12

Dani AI

Generated

Good instincts from the replies — and a sensible place to start, . Use the least number of strong defenses that actually stop attacks: stop SQL injection, store passwords correctly, escape output, protect sessions, and never trust serialized input. Some advice in earlier posts (for example using MD5 or relying on strip_tags) needs updating or clarification. is right that passwords need salts and frameworks help, but follow modern APIs rather than DIY crypto.

Always use parameterized queries (PDO or mysqli prepared statements) instead of string concatenation, and use PHP’s password APIs for authentication. Example patterns:

// PDO prepared statement
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email');
$stmt->execute(['email' => $email]);
$user = $stmt->fetch();
// password storage
$hash = password_hash($password, PASSWORD_DEFAULT);
if (password_verify($password, $hash)) { /* authenticated */ }

These avoid SQL injection and replace unsafe MD5/salted-MD5 schemes. (php.net)

Stop trying to fix XSS by stripping tags. Validate inputs but encode output for the context (HTML, JS, URL, CSS). For HTML use htmlspecialchars($val, ENT_QUOTES|ENT_SUBSTITUTE, 'UTF-8'). Protect state changes with CSRF tokens, serve everything over HTTPS, and set cookie attributes (Secure, HttpOnly, SameSite) and HSTS. These controls greatly reduce XSS/CSRF/session theft impact. (cheatsheetseries.owasp.org)

Avoid unserialize() on any untrusted data — it can instantiate objects and lead to code execution; prefer json_encode/json_decode or rigorously whitelist allowed classes if you must deserialize. Also use least-privilege DB accounts, disable detailed error output in production, keep PHP and libraries updated, and add logging and rate-limiting. For a beginner, using a modern framework with built-in escaping and auth makes these defaults much easier to get right. (php.net)

Recommended Answers

All 2 Replies

Member Avatar for pritaeas

Here's a nice introduction.

Member Avatar for dany12

Security points:

serialize data

strip tags

salt your passwords

use md5 encryption with salt

learn php oop and mvc pattern

work with a framework like zend codeigniter cakephp symfony smarty a lot more

look at the xss atack tehnic

look at ddos tehnic this tehnics will show you how a hacker thinks and prepare you for your security implementations

commented: very interesting +2
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.