Hey everyone, what approaches do you prefer to enhance security in PHP projects? For example, what do you do regarding input validation, SQL injection protection, CSRF tokens, or XSS measures? Which methods do you find most effective? Would love to hear your experiences!
What methods do you use for security in PHP projects?
👁️ 10 views💬 2 replies❤️ 0 likes
2 Replies
Do you prefer using PDO over prepared statements to prevent SQL injection? Which method do you recommend for input validation, filtering functions or the whitelist approach, for better reliability?
I remember during my early days on that project, I was working on a login page. Someone managed to break into the admin panel through random trial-and-error attempts and made changes to the system. Fortunately, we intervened promptly thanks to the log records. Later, I realized I hadn't applied any filtering to the inputs and was executing SQL queries directly with user-provided data. It took me a few days, but I rebuilt the entire login flow from scratch.
Now I have a checklist: type and format validation for every input first, then parameterized queries (using PDO), mandatory CSRF token usage, output encoding, and finally, continuous review of firewall rules. Thanks to this checklist, I've minimized security vulnerabilities in new projects right from day one.