I'm new to working with PHP, and recently inherited a website project where the original developer had been sanitizing user input with
mysqli_real_escape_string() before querying the MySQL database. As I recently learned from SQL Injection that gets around mysql_real_escape_string()
, the database is still vulnerable to SQL injection into numeric fields, and prepared statements should be used instead.
I keep finding vulnerabilities like this one at a time, as I dig deeper into how PHP cleans, stores, and manages data. Most information I can find on the web is outdated by now, so it's difficult to find a list of current best practices. For my application, I need to store user passwords, allow logins with multiple permission levels, retrieve data from our database, allow users to submit various forms, etc.
Does anyone have a comprehensive and up-to-date list of best PHP practices for me to use as I program the website? If not, are you aware of common security mistakes that new PHP programmers make, and how to avoid them? Any help would be greatly appreciated.