Modern PHP Session Management: Replacing session_register() and Securing Sessions
If you learned PHP a decade or more ago, you probably reached for session_register() without a second thought. Then one day
Snippets
A collection of web development tutorials and code snippets for WordPress, PHP, JavaScript, CSS and many more.
Managing PHP Deprecation Notices: Strategies for Refactoring Legacy Code
You upgrade PHP on a Friday, and by Monday your error log is full of “Deprecated:” lines you have never seen
HTML5 Web Storage Security Risks: Safeguarding localStorage and sessionStorage
You ship a login flow, stash the session token in localStorage because it survives refreshes, and move on. It works. Then
Preventing JavaScript Clickjacking: Essential Security Techniques
A user lands on your page, sees a friendly button, and clicks it. Nothing looks wrong. But the click never went
Understanding CSS Side-Channel Attacks: Mechanisms, Risks, and Prevention
You escaped every bit of user input in your HTML. You locked down your script sources. Then someone pastes a few
WP Engine vs WordPress.org: The Legal Battle Over Core Features and Hosting Control
In September 2024, a single conference talk pulled the WordPress world into a fight it still hasn’t finished. Matt Mullenweg, co-founder
Understanding and Preventing PHP File Inclusion Vulnerabilities: A Guide to RFI and LFI Attacks
One line of PHP is all it takes. A developer wires a page loader off a URL parameter, ships it, and
Securing Meta Tags: Preventing Clickjacking, XSS, and Other Vulnerabilities
You drop a meta tag into your <head>, and something in your brain relaxes. Security handled. Move on. That feeling is
PHP Deprecation Warnings Explained: Update Your Code and Handle Deprecated Functions Efficiently
You upgrade PHP, reload the site, and there it is in the logs: Deprecated: …. Nothing broke. The page still works.
Managing JavaScript Libraries: Best Practices for Reducing Security Risks
You add one small library to save an afternoon. It pulls in twelve more you never read. Six months later a
Protect Your WordPress Site: Understanding Plugin Vulnerabilities and How to Fix Them
WordPress runs north of 40% of the web, and most of that power comes from plugins. That’s the trade. Plugins hand
Defending Against Content Security Policy (CSP) Bypass: Best Practices for JavaScript Applications
You ship a Content Security Policy, see the header show up in DevTools, and feel safe. That feeling is the trap.
Upgrading PHP: Replacing Magic Quotes with Proper Input Sanitization
If you have ever inherited an old PHP codebase, you have probably met magic_quotes_gpc. It was PHP’s attempt to keep you
Understanding JavaScript Prototype Pollution and How to Prevent It
You merge a chunk of user-supplied JSON into a plain object. Looks harmless. A moment later every object in your app
Defending WordPress Security Against Cross-Site Scripting (XSS) Attacks
Someone leaves a comment on your site. It looks ordinary. But tucked inside the text is a <script> tag, and the
Safeguarding WordPress: How to Prevent XML-RPC Brute Force and DDoS Attacks
Open the access log on almost any WordPress site and you’ll find them: a slow, patient drip of POST requests to
Clickjacking Explained: How to Protect Your Website from Hidden HTML Frames
You click a button that says “Play.” Nothing seems to happen. But the click didn’t land on the button you saw.
CSS Injection Attacks: How to Prevent Malicious CSS from Harvesting Sensitive Data
A stylesheet feels harmless. It picks fonts, sets colors, nudges spacing. Nobody audits CSS the way they audit a login form,
Migrating Legacy PHP Code to password_hash() for Secure Password Storage
If you’ve inherited an old PHP app, there’s a good chance its passwords are sitting in the database as md5() or
Refactoring PHP Projects: Implementing Namespaces for Better Code Organization
You inherit a PHP project, open two files, and find two classes both called User. One is yours. One came from