PHP Security Best Practices
Security is a critical aspect of web development. PHP applications are often targeted due to their popularity. Here are some best practices to secure your PHP code.
1. SQL Injection (SQLi)
SQL injection occurs when malicious SQL statements are inserted into entry fields for execution.
Prevention: Always use Prepared Statements (with PDO or MySQLi) instead of concatenating strings.
// BAD (Vulnerable)
$sql = "SELECT * FROM users WHERE email = '" . $_POST['email'] . "'";
// GOOD (Secure)
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email');
$stmt->execute(['email' => $_POST['email']]);
$user = $stmt->fetch();2. Cross-Site Scripting (XSS)
XSS attacks enable attackers to inject client-side scripts into web pages viewed by other users.
Prevention: Always sanitize output using htmlspecialchars() when displaying user-submitted data.
echo htmlspecialchars($user_input, ENT_QUOTES, 'UTF-8');3. Cross-Site Request Forgery (CSRF)
CSRF forces an end user to execute unwanted actions on a web application in which they're currently authenticated.
Prevention: Use anti-CSRF tokens in forms.
// Generate token
$_SESSION['token'] = bin2hex(random_bytes(32));
// In HTML form
<input type="hidden" name="token" value="<?php echo $_SESSION['token']; ?>">
// Verify on POST
if (!hash_equals($_SESSION['token'], $_POST['token'])) {
die("CSRF validation failed");
}4. Password Hashing
Never store passwords in plain text. Use PHP's built-in password hashing functions.
$hash = password_hash($password, PASSWORD_DEFAULT); // Create hash
if (password_verify($input_password, $hash)) { ... } // Verify