PHP Security Best Practices Checklist

1. Input Validation and Sanitization

• Validate and sanitize all user inputs
  • Use filter_var() and filter_input() functions
  • Implement proper data validation for each input type (e.g., email, integers, strings)
• Use prepared statements or parameterized queries for database operations
  • Utilize PDO or MySQLi with prepared statements
• Implement proper escaping for different contexts (HTML, JavaScript, SQL, etc.)

2. Authentication and Session Management

• Use secure password hashing (e.g., password_hash() with bcrypt)
• Implement proper session management
  • Use session_start() at the beginning of each script
  • Set secure session cookies (HTTPOnly, Secure flags)
  • Regenerate session ID after login: session_regenerate_id(true)
• Implement proper logout functionality (destroy session and clear cookies)
• Use HTTPS for all authenticated pages

3. Cross-Site Scripting (XSS) Prevention

• Escape all output to prevent XSS
  • Use htmlspecialchars() for HTML contexts
  • Use appropriate encoding for JavaScript contexts
• Implement Content Security Policy (CSP) headers
• Use HTTPOnly flag for cookies to prevent JavaScript access

4. Cross-Site Request Forgery (CSRF) Protection

• Implement CSRF tokens for all state-changing operations
• Validate the CSRF token on the server-side for each request
• Use the SameSite cookie attribute to limit CSRF risks

5. File Upload Security

• Validate file types, sizes, and content
• Store uploaded files outside of the web root
• Use randomly generated filenames to prevent overwriting
• Set proper permissions on the upload directory

6. Error Handling and Information Disclosure

• Disable display_errors in production environments
• Implement custom error handlers to avoid information disclosure
• Log errors securely without exposing sensitive information

7. Database Security

• Use principle of least privilege for database connections
• Encrypt sensitive data before storing in the database
• Use database connection pooling for better security and performance

8. Configuration and Server Setup

• Keep PHP and all dependencies up to date
• Disable unnecessary PHP modules and functions
• Set secure PHP configuration options in php.ini
  • expose_php = Off
  • allow_url_fopen = Off (if not needed)
  • allow_url_include = Off
• Implement proper file and directory permissions

9. SSL/TLS Implementation

• Use HTTPS for the entire application
• Implement HSTS (HTTP Strict Transport Security)
• Keep SSL/TLS certificates up to date

10. Third-Party Components and Dependencies

• Regularly update all third-party libraries and frameworks
• Verify the integrity of downloaded packages
• Use a dependency checker to identify known vulnerabilities

Related Checklists

• LAMP Stack Setup Checklist
• Web Application Security Checklist
• MySQL Security Hardening Checklist