Secure Coding

Wrap every untrusted value in htmlspecialchars() at the moment it is echoed. Pass ENT_QUOTES | ENT_SUBSTITUTE and 'UTF-8', the PHP 8.1+ defaults, so both quote types are encoded and malformed UTF-8 cannot turn the output into an empty string.

Call filter_var($value, FILTER_VALIDATE_INT, ['options' => ['min_range' => 16, 'max_range' => 99]]). It returns an int on success and false on failure, so test with === false, because a valid 0 is falsy.

password_hash($plain, PASSWORD_DEFAULT) returns a self-describing string that embeds the algorithm, cost and a random salt; store that one string. password_verify($plain, $hash) rehashes the input the same way and returns a bool. Never generate the salt yourself or compare hashes manually.

eval() runs a string as PHP; include/require execute a file you supply; unserialize() rebuilds objects and calls their magic methods; extract() writes request keys into variables. Never feed request data to any of them.

=== returns as soon as it finds a differing byte, so its run time leaks how much of the secret matched — a timing side channel. hash_equals($known, $user) compares in constant time for equal-length strings. Pass the stored token first and the user-supplied value second.

Validate filters decide whether a value is acceptable and return it typed or signal failure; sanitize filters strip or encode characters and always return a string. Sanitizing cannot know the output context, so escaping still happens at use.

Use random_bytes($len) for a token (then bin2hex/base64 to make it printable) and random_int($min, $max) for a secure number; both draw from the OS CSPRNG and throw Random\RandomException on failure. rand() and mt_rand() are fast but predictable, so an attacker can reproduce their output.

unserialize() rebuilds whatever object graph the cookie bytes describe and calls magic methods like __wakeup and __destruct, so attacker-chosen objects run code (a gadget chain). allowed_classes narrows which classes are built but PHP still warns against untrusted input; replace the cookie with signed JSON.

htmlspecialchars() converts only &, <, >, and the quotes; htmlentities() also converts every character that has a named HTML entity, such as é into é. Both protect markup equally, so on a UTF-8 page htmlspecialchars() is the standard choice.

PHP exposes a request header as $SERVER['HTTP' + uppercased name with hyphens as underscores], so X-CSRF-Token becomes $_SERVER['HTTP_X_CSRF_TOKEN']. Read it, compare with hash_equals against the $_SESSION copy. A header suits fetch/JSON calls that carry no form field.

htmlspecialchars() encodes quotes and angle brackets but not spaces or equals signs, so an unquoted attribute value can still be split into new attributes. Always quote the value; and for event handlers, style or href, escaping alone is not enough.

Encode each value going into the URL, not the finished URL: rawurlencode() for path segments, http_build_query() or urlencode() for query parameters. Then pass the whole URL through htmlspecialchars() because it sits inside an href attribute.

strip_tags() removes things that look like tags but does not escape what remains, keeps every attribute on allowed tags, and can delete ordinary text after a stray <. The PHP manual says not to use it against XSS.

Use ctype_digit() for digit-only strings where leading zeros matter, such as postcodes, and an allow-list for fixed sets of values. ctype functions take strings: an int argument is deprecated and misread as a character code.

By default a failed filter returns false. FILTER_NULL_ON_FAILURE returns null instead, which matters when false is a valid result; PHP 8.5's FILTER_THROW_ON_FAILURE throws Filter\FilterFailedException. The two flags cannot be combined.

Both check syntax only. FILTER_VALIDATE_EMAIL confirms an address looks well-formed, not that it exists. FILTER_VALIDATE_URL requires a scheme but accepts any scheme, including file: and javascript: forms, so allow-list http and https yourself.

With PASSWORD_BCRYPT, password_hash() silently truncates the password to 72 bytes, so anything past byte 72 is ignored. Because it counts bytes, multibyte UTF-8 characters use several each. Two long passwords sharing a 72-byte prefix verify as equal. ARGON2ID has no such limit.

A single $_SESSION['csrf'] reused for the session is simplest and multi-tab friendly; per-form tokens are a $_SESSION map keyed by form and unset after use, but break the back button. Regenerate the token value at login, since one issued to a pre-auth session may be attacker-known.

Encode the data with json_encode() plus JSON_HEX_TAG, JSON_HEX_AMP, JSON_HEX_APOS and JSON_HEX_QUOT, and JSON_THROW_ON_ERROR. htmlspecialchars() is wrong inside a script, and a raw </script> in the data would end the block early.

The result holds only the defined keys: a typed value if valid, false if invalid, null if missing. Pitfalls: null-on-failure blurs invalid and missing, arrays fail scalar filters, and filter_input_array() reads the original request input, not $_POST.

You cannot batch-convert MD5 hashes because you lack the plaintext. Migrate on login: detect a legacy row, verify with the old scheme, then rehash the plaintext with password_hash and store it. Optionally wrap every existing MD5 in password_hash immediately so all rows get a slow layer at once.

You can only upgrade a hash when you hold the plaintext, which is at login. After a successful password_verify, call password_needs_rehash($hash, PASSWORD_DEFAULT); if it returns true, rehash the plaintext and store it. PHP 8.4 raised bcrypt's default cost from 10 to 12, so pre-8.4 hashes need a rehash.

include/require runs the file at the path you give, so request input selects the executed file: a planted local file runs as PHP, or a remote URL runs if allow_url_include is on. allow_url_include (default Off) blocks only the URL case. Use an allow-list, not basename().

Some md5/sha1 outputs are '0e' followed by digits; under == PHP treats two such hashes as the number 0, so different inputs compare equal — a 'magic hash' bypass PHP 8.0 did not change. Compare with hash_equals(), or === and in_array(..., true).

extract($_GET) creates a local variable for every request key, so a request can define or overwrite variables your logic trusts (like $isAdmin). The default EXTR_OVERWRITE clobbers existing ones; variable variables ($$key) share the flaw. Read expected keys by name instead.