Security: From basic principles to PHP specifics
summary
Code reviews repeatedly find the same concrete failures: missing output escaping, unsafe query composition, and permissive server configs. Recommendations include whitelisting inputs, using prepared statements (never string concatenation for values), validating uploads and mime types, regenerating session IDs with session_regenerate_id, using proven sanitizers like htmlpurifier, and slow password hashes such as Argon2 or bcrypt. Use cryptographically secure randomness via random_bytes, store secrets in Vault or CipherSweet blind indexes, set X-Frame-Options, run SAST in CI and keep the stack patched.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 2:18About me
- 3:40The basics
- 15:05SQL Injection
- 25:15Passwords
- 28:45Calculations
- 31:01Cracking passwords
- 33:15Sessions
- 35:20Check permissions
- 36:41Information leaks
- 37:19Password leaks
- 39:33Random numbers
- 40:48Libraries
- 42:33Admins support
- 45:23Security is a process
- 46:25Absolute security is not possible
- 47:40Stickers
- 49:25Never stop learning
- 50:11Make it expensive
- 50:36Reading list
- 51:37Questions
