PHP Security, Redefined
summary
PHP claims actual security progress: over 80% of the web runs PHP and WordPress covers 58% of CMS sites, PHP 5.5+ adds native password_hash and password_verify, 5.6 adds hash_equals and stricter OpenSSL defaults, PHP 7 adds random_bytes/random_int, scalar type hints, return types and catchable engine errors. Composer plus the composer security checker, Respect\Validation, Twig and libsodium are demonstrated, dynamic scans (WhiteHat), static analysis, Burp and ZAP are used, and a templating/escaping library is rolling out to reduce real XSS risk.
AI-written summary · about
chapters (28)
- 0:00Introduction
- 0:22About me
- 1:01PHP History
- 4:28Support Schedule
- 5:09Anthony Ferrara
- 5:53Composer
- 8:32Frameworks
- 10:30Drupal
- 11:30WordPress
- 12:54Composer Libraries
- 15:00Password Hashing
- 16:29Password Rehash
- 17:10A Notice
- 17:30OpenSSL Updates
- 18:27Default Cipher Order
- 19:29OpenSSL Settings
- 19:59HashEquals
- 21:35Strict Sessions
- 22:33Scalar Type Hinting
- 24:30Return Types
- 25:12Random Library
- 26:12Uniform Variable Syntax
- 27:31Unicode
- 28:06Engine Exceptions
- 29:45Filter Done serialized
- 31:16Why is this important
- 33:59Educating the users
- 34:39Questions
related talks
02h 18mWeb application security (Part 2)
01h 00mIn Defence of PHP
10mIntroduction to web security
52mPractical Security in Web Applications
01h 01mSecurity: From basic principles to PHP specifics
29mSecuring PHP Applications with Zero Trust Principles
02h 14mWeb application security (Part 1)
01h 29mPHP Security Project