Securing PHP Applications: Stopping SQL Injection with Prepared Statements
One line of careless PHP is all it takes. A login form that drops a username straight into a query string,
PHP security
How to Secure Your PHP Application by Using Prepared Statements
Here’s a bug that has burned more developers than almost any other: you drop a variable straight into a SQL string,
How to Prevent Session Hijacking: Secure PHP Session Management
A user logs in. Your app hands them a session ID. From that moment on, that little string is the only
The Dangers of Using PHP’s eval() Function: Risks and Secure Alternatives
Most PHP backdoors we clean off hacked WordPress sites share one line: eval(). It hands attackers a way to run whatever
Understanding PHP Deserialization Vulnerabilities and Preventing Remote Code Execution
A single line, unserialize($_GET[‘data’]), has handed attackers full control of more servers than most developers would like to admit. It looks
Modern PHP Session Management: Replacing session_register() and Securing Sessions
If you learned PHP a decade or more ago, you probably reached for session_register() without a second thought. Then one day
Upgrading PHP: Replacing Magic Quotes with Proper Input Sanitization
If you have ever inherited an old PHP codebase, you have probably met magic_quotes_gpc. It was PHP’s attempt to keep you
Migrating Legacy PHP Code to password_hash() for Secure Password Storage
If you’ve inherited an old PHP app, there’s a good chance its passwords are sitting in the database as md5() or
Transitioning from create_function() to Anonymous Functions in PHP
If you’re running PHP 8 and your old code calls create_function(), it doesn’t warn you anymore. It just dies. The function