I'm new to working with PHP, and recently inherited a website project where the original developer had been sanitizing user input with mysqli_real_escape_string() before querying the MySQL database. As I recently learned from SQL Injection that gets around mysql_real_escape_string() , the database is still vulnerable to SQL injection into numeric fields, and prepared statements should be used instead.

I keep finding vulnerabilities like this one at a time, as I dig deeper into how PHP cleans, stores, and manages data. Most information I can find on the web is outdated by now, so it's difficult to find a list of current best practices. For my application, I need to store user passwords, allow logins with multiple permission levels, retrieve data from our database, allow users to submit various forms, etc.

Does anyone have a comprehensive and up-to-date list of best PHP practices for me to use as I program the website? If not, are you aware of common security mistakes that new PHP programmers make, and how to avoid them? Any help would be greatly appreciated.

closed as off-topic by Arminius, TheJulyPlot, Anders, Serge Ballesta, Xander Jul 6 '17 at 13:17

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    IMO this request is somewhat off-topic on SE because today's "current" list will be outdated in the near future, similar to product recommendations. – Arminius Jul 6 '17 at 6:44

I would start with OWASP's Developer Guide. Then just keep reading through other OWASP resources. Since you mentioned specifically PHP. Here is a PHP Security Cheat Sheet.

Another good read is SANS: "security checklist for web app design".

These should give you a good understand of building safe web sites/apps.

Not the answer you're looking for? Browse other questions tagged or ask your own question.