Current list of safe PHP Practices? [closed]

Question

I'm new to working with PHP, and recently inherited a website project where the original developer had been sanitizing user input with mysqli_real_escape_string() before querying the MySQL database. As I recently learned from SQL Injection that gets around mysql_real_escape_string() , the database is still vulnerable to SQL injection into numeric fields, and prepared statements should be used instead.

I keep finding vulnerabilities like this one at a time, as I dig deeper into how PHP cleans, stores, and manages data. Most information I can find on the web is outdated by now, so it's difficult to find a list of current best practices. For my application, I need to store user passwords, allow logins with multiple permission levels, retrieve data from our database, allow users to submit various forms, etc.

Does anyone have a comprehensive and up-to-date list of best PHP practices for me to use as I program the website? If not, are you aware of common security mistakes that new PHP programmers make, and how to avoid them? Any help would be greatly appreciated.

Answer 1

I would start with OWASP's Developer Guide. Then just keep reading through other OWASP resources. Since you mentioned specifically PHP. Here is a PHP Security Cheat Sheet.

Another good read is SANS: "security checklist for web app design".

These should give you a good understand of building safe web sites/apps.