PHP Security

Core Principle

Never trust user input. Validate everything from $_GET, $_POST, $_COOKIE, $_FILES, $_SERVER, and $_REQUEST. Defense in depth — layer multiple protections.

SQL Injection Prevention

Use prepared statements with bound parameters for all queries. Never interpolate user input into SQL strings.

See resources/validation-patterns.md for prepared statement and dynamic column name code examples.

XSS Prevention

Escape all user data on output. Use htmlspecialchars($val, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') (or a short e() helper) for HTML contexts.

Set CSP headers: Content-Security-Policy: default-src 'self'; script-src 'self'

See resources/validation-patterns.md for output escaping and CSP code examples.

CSRF Protection

// Generate token
session_start();
if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}

// In form
<input type="hidden" name="csrf_token" value="<?= e($_SESSION['csrf_token']) ?>">

// Validate on submit
if (!hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'] ?? '')) {
    http_response_code(403);
    exit('Invalid CSRF token');
}

Password Security

// Hash with bcrypt (default, recommended)
$hash = password_hash($password, PASSWORD_DEFAULT);

// Verify
if (password_verify($inputPassword, $storedHash)) {
    // Authenticated
}

// Check if rehash needed (algorithm/cost changes)
if (password_needs_rehash($storedHash, PASSWORD_DEFAULT)) {
    $newHash = password_hash($inputPassword, PASSWORD_DEFAULT);
    // Update stored hash
}

Input Validation & Sanitization

Use filter_var() / filter_input() for type validation. Key filters: FILTER_VALIDATE_EMAIL, FILTER_VALIDATE_INT (with min_range/max_range), FILTER_VALIDATE_FLOAT, FILTER_VALIDATE_IP, FILTER_VALIDATE_URL, FILTER_VALIDATE_BOOL (with FILTER_NULL_ON_FAILURE), FILTER_VALIDATE_DOMAIN, FILTER_VALIDATE_REGEXP.

Sanitization Filters (FILTER_SANITIZE_*)

Output Escaping by Context

Key Rules

See resources/validation-patterns.md for filter_var code examples, serialization security, and process execution patterns.

File Upload Security

$file = $_FILES['upload'];

// Validate
if ($file['error'] !== UPLOAD_ERR_OK) {
    throw new UploadException('Upload failed');
}

// Check MIME type (don't trust $_FILES['type'] — user-controlled)
$finfo = new finfo(FILEINFO_MIME_TYPE);
$mime = $finfo->file($file['tmp_name']);
$allowed = ['image/jpeg', 'image/png', 'image/gif'];
if (!in_array($mime, $allowed, true)) {
    throw new ValidationException('Invalid file type');
}

// Check size
if ($file['size'] > 5 * 1024 * 1024) { // 5MB
    throw new ValidationException('File too large');
}

// Generate safe filename — never use original
$ext = match($mime) {
    'image/jpeg' => '.jpg',
    'image/png' => '.png',
    'image/gif' => '.gif',
};
$safeName = bin2hex(random_bytes(16)) . $ext;

// Move to non-web-accessible directory
move_uploaded_file($file['tmp_name'], '/var/uploads/' . $safeName);

Session Security

// Secure session configuration
ini_set('session.cookie_httponly', '1');     // No JavaScript access
ini_set('session.cookie_secure', '1');       // HTTPS only
ini_set('session.cookie_samesite', 'Lax');   // CSRF protection
ini_set('session.use_strict_mode', '1');     // Reject uninitialized IDs
ini_set('session.use_only_cookies', '1');    // No session ID in URL

session_start();

// Regenerate ID on privilege change (login)
session_regenerate_id(true);

// Destroy session properly
session_unset();
session_destroy();
setcookie(session_name(), '', time() - 3600, '/');

Filesystem Security

// BAD: Path traversal attack
$file = $_GET['file'];
include("/templates/$file");  // ../../etc/passwd

// GOOD: Validate and constrain
$allowed = ['header', 'footer', 'sidebar'];
$file = $_GET['file'];
if (!in_array($file, $allowed, true)) {
    throw new NotFoundException();
}
include("/templates/{$file}.php");

// GOOD: realpath validation
$basePath = realpath('/var/uploads');
$fullPath = realpath("/var/uploads/{$filename}");
if ($fullPath === false || !str_starts_with($fullPath, $basePath)) {
    throw new SecurityException('Path traversal detected');
}

Cryptography

// Random bytes for tokens, keys, nonces
$token = bin2hex(random_bytes(32));  // 64-char hex string
$apiKey = base64_encode(random_bytes(32));

// HMAC for data integrity
$signature = hash_hmac('sha256', $data, $secretKey);
if (!hash_equals($expected, $signature)) {
    throw new SecurityException('Invalid signature');
}

// Encryption with sodium (PHP 7.2+)
$key = sodium_crypto_secretbox_keygen();
$nonce = random_bytes(SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);
$encrypted = sodium_crypto_secretbox($plaintext, $nonce, $key);
$decrypted = sodium_crypto_secretbox_open($encrypted, $nonce, $key);

HTTP Security Headers

// Essential headers
header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
header("Content-Security-Policy: default-src 'self'");
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: DENY');
header('Referrer-Policy: strict-origin-when-cross-origin');
header('Permissions-Policy: camera=(), microphone=(), geolocation=()');

// Hide PHP version
ini_set('expose_php', '0');

php.ini Hardening (OWASP)

Error and Information Disclosure

Filesystem and Includes

Disable Unused Functions

Use disable_functions in php.ini to disable functions your application does not need. Audit which functions are actually used. Common candidates: phpinfo, show_source, pcntl_fork, pcntl_exec, and any shell-related functions not required by the app.

File Uploads (php.ini)

Session Hardening (php.ini)

Resource Limits

Error Exposure

Common Vulnerability Patterns

Automated Taint Analysis

Psalm can trace user input from source (e.g., $_GET) to dangerous sinks (e.g., SQL query, echo) and flag injection paths automatically:

vendor/bin/psalm --taint-analysis

Catches SQL injection, XSS, and other data-flow vulnerabilities that manual review misses. Use alongside manual code review, not as replacement.

Security Checklist

• declare(strict_types=1) in every file
• === for all comparisons (especially auth checks)
• Prepared statements for all database queries
• htmlspecialchars() for all HTML output
• CSRF tokens on all state-changing forms
• password_hash() / password_verify() for passwords
• random_bytes() for tokens and keys
• Session cookies: httponly, secure, samesite
• File uploads validated by content, not name/extension
• display_errors = Off in production
• CSP and security headers set
• expose_php = Off
• open_basedir restricts file access
• allow_url_include = Off and allow_url_fopen = Off
• disable_functions configured for unused dangerous functions
• session.sid_length >= 128, custom session.name
• No $_REQUEST usage — specify input source
• No unserialize() on user data — use JSON
• escapeshellarg() or array format for process execution
• Regex patterns tested for catastrophic backtracking (ReDoS)
• cURL: CURLOPT_SSL_VERIFYPEER enabled in production
• filter_var() / filter_input() for input validation
• Psalm taint analysis in CI (--taint-analysis)

Resources

• resources/validation-patterns.md — Detailed code examples for SQL injection prevention, XSS output escaping, input validation filters, serialization security, and process execution security