After creating a simple login system and trying to protect it against things like SQL injection, Session Hijacking, XSS, etc, I've found that I really enjoy doing this type of thing. I'd like to pick up a book and dive into all the details regarding PHP / database security and intrusion prevention/detection tactics.
Basically, I'm wanting to learn properly from the get-go. I've found Essential PHP Security, but since it was published in 2005, I imagine they will use things like mysql_ (deprecated) and potential a non OOP structure. I've also been using this page for assistance along with the PHP documentation, but I was hoping to go more in-depth (particularly relating to security).
Can anyone suggest a book that is updated for use today (so...):
- Contains information about PDO Connections
- Uses prepared statements to escape variables
- Uses Object Oriented Approach for structure
- Involves HTML templates for separation of languages
- Preventing XSS, Session Hijacking, Null Byte intrusions, Cookie stealing, etc.
If there isn't a book that really addresses these things (yet), can the concepts from Essential PHP Security (or another recommended book) still be applied for most uses today?
Thanks for the input! I'm just trying to learn properly and avoid bad habits.
EDIT: I posted this elsewhere at first and a lot of the comments I received were along the lines of "I wouldn't use PHP" or "Use jQuery". Why is PHP security not a good area of focus?