Most security incidents on web applications don’t come from sophisticated attacks but from simple oversights. This checklist covers what to verify before every production release of a PHP application.
Key takeaways
- Prepared statements everywhere (PDO, mysqli or the ORM): no variable concatenated into SQL.
- Escape on output with
htmlspecialchars()or the template engine to block XSS. - CSRF tokens on every form that changes data.
- Hashed passwords with
password_hash(), never MD5 or SHA1.
Server configuration
display_errors = Offin production: errors go to a log, not to the screen.- HTTPS enforced, session cookies set to
Secure,HttpOnlyandSameSite. - Upload folders must never execute PHP.
- Sensitive files (
.env, SQL backups, archives) outside the web root.
Uploads, a sensitive spot
Don’t trust the extension sent by the browser: check the real file type, limit the size, rename the file server-side and store it outside executable folders.
Practical tip
Log sensitive actions (logins, permission changes, deletions) and set up automatic, tested backups. A backup you have never restored is only a hope.
