On the surface it looks like both libraries are designed to preform the same functionality with similar "drop-in" capabilities. Are there differences that I need to take into account when making a decision about which to use? If so, what are they?

https://www.owasp.org/index.php/OWASP_PHP_Security_Project https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API


I would not use ESAPI-PHP. It's a port of the Java ESAPI framework, (which has had its own issues, but soldiers on, more or less, mostly less) but the PHP port has been dead for a considerable amount of time now. I wouldn't trust it as far as I could throw it.

I can't speak authoritatively to the PHP Security Project, but at a glance, the PHP Security Project may be in a similar state (their project page and site announces their upcoming participation in AppSecUSA 2013, which happened over a year ago) but at least it was a native PHP framework designed for PHP, so there may still be use to be had from it. It's potentially worth researching, at minimum.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.