PHP Security Patterns

SQL injection prevention relies on prepared statements with parameterized queries, which separate SQL code from user input. This approach ensures malicious input cannot alter query structure, making it the standard defense for database interactions in PHP.

XSS protection combines input validation, output encoding for HTML context, and content security policies. HTML encoding converts user-supplied data into safe entities before rendering in web pages, preventing script execution.

CSRF tokens are unique, session-specific values embedded in forms and verified on submission. Generate tokens server-side, store them in the session, include them in form fields, and validate matches before processing state-changing requests.

Use strong, salted hashing algorithms like bcrypt or Argon2 via PHP's password_hash() function. These algorithms add computational cost, making brute-force attacks impractical while automatically managing salt generation and verification.

Secure file upload controls include validating file type and size, storing uploads outside the web root, renaming files to prevent predictable paths, and scanning for malware. Restrict executable file types and disable script execution in upload directories.

Sessions store user authentication state; insecure handling enables session hijacking and fixation attacks. Secure practices include using HTTPS-only cookies, regenerating IDs after login, setting short timeouts, and protecting against cross-site request forgery.