What are key security best practices in PHP?

Question

Accepted Answer

PHP security means defending against the common web vulnerabilities (OWASP Top 10) at every layer — input handling, database access, output, authentication, and configuration. Since PHP powers so much of the web, these practices are critical.

## 1. Prevent SQL injection — prepared statements

```php
// ❌ NEVER concatenate user input into SQL
$pdo->query("SELECT * FROM users WHERE id = " . $_GET['id']);   // INJECTION
// ✅ ALWAYS use prepared statements (input treated as data, not SQL)
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
$stmt->execute([$_GET['id']]);
```

## 2. Prevent XSS — escape all output

```php
// ❌ echoing raw user input → XSS (injected scripts run in the browser)
echo $_GET['name'];
// ✅ escape output for HTML context
echo htmlspecialchars($_GET['name'], ENT_QUOTES, 'UTF-8');
```

Escape user-controlled data on output (`htmlspecialchars`) so injected HTML/JS can't execute. (Templating engines like Twig/Blade auto-escape.)

## 3. Hash passwords properly

```php
// ✅ use password_hash (bcrypt/argon2) — never plaintext, never MD5/SHA
$hash = password_hash($password, PASSWORD_DEFAULT);
// verify:
if (password_verify($input, $hash)) { /* correct password */ }
```

PHP's built-in `password_hash`/`password_verify` use strong, salted, slow algorithms — the correct way to store passwords.

## 4. Prevent CSRF — tokens

```php
// generate a token, store in the session, include in forms, verify on submit
$_SESSION['csrf'] = bin2hex(random_bytes(32));
// verify on POST: hash_equals($_SESSION['csrf'], $_POST['csrf'])
```

## 5. Validate and sanitize all input

```php
$email = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);   // validate
$id = (int) $_GET['id'];                                        // cast/whitelist
// never trust $_GET/$_POST/$_COOKIE — validate everything
```

## 6. Secure configuration and other practices

```text
✓ display_errors=Off in production (don't leak stack traces/internals to users — log instead)
✓ Keep secrets in env vars / config outside the web root, NOT in code/git
✓ Use HTTPS; set secure/httponly/samesite cookie flags
✓ Keep PHP and dependencies UPDATED (composer audit for vulnerable packages)
✓ Validate file uploads (type, size); store outside the web root
✓ Use a maintained framework (Laravel/Symfony) — they handle many protections by default
```

## Why it matters

Security is critical for PHP applications, and understanding these practices is essential — because PHP powers a huge portion of the web, PHP apps are constant attack targets, and security failures can be catastrophic (data breaches, account compromise, defacement).

PHP addresses the most common and dangerous web vulnerabilities, but unlike some frameworks, much depends on the developer following correct practices.

The non-negotiable essentials: **prepared statements** prevent SQL injection (one of the most common and devastating attacks), **output escaping** (`htmlspecialchars`) prevents XSS, **`password_hash`/`password_verify`** ensure secure password storage (never plaintext/weak hashes), **CSRF tokens** protect state-changing requests, and **rigorous input validation** (never trusting `$_GET`/`$_POST`/`$_COOKIE`) is the foundation.

Equally important is **secure configuration**: turning off error display in production (errors leak sensitive info to attackers), keeping secrets out of code, using HTTPS and secure cookie flags, validating uploads, and keeping PHP and dependencies updated (since vulnerable packages are a major attack vector).

Understanding this layered, defense-in-depth approach — and that a single overlooked layer (an injection, a leaked secret, an unescaped output, an unpatched dependency) can compromise the whole system — is important, high-stakes knowledge for any PHP developer.

While modern frameworks (Laravel, Symfony) provide many protections by default, understanding the underlying threats and practices is essential responsibility for building secure applications, making this a critical, frequently-relevant topic for production PHP.