FreeIntermediatePHP 8.0+v3.0

PHP Security Best Practices & Toolkit

A collection of security utility classes and configuration guides for hardening your PHP applications. Covers CSRF protection, XSS prevention, SQL injection defense, rate limiting, security headers, and input validation.

Overview

Web application security is not a feature you add at the end of a project. It must be built into every layer of your application from the start. This toolkit provides reusable PHP classes that implement the most critical security measures recommended by OWASP, along with configuration guides for your web server and PHP environment.

Each utility is designed to be dropped into any existing PHP project with minimal integration effort. The classes have no external dependencies and work with PHP 8.0 and above. Comprehensive inline documentation explains not just how to use each utility, but why each security measure matters and what attack it prevents.

What Is Included

CSRF token generator and validator
XSS output escaping helpers
Input sanitization and validation class
Rate limiter (IP and user-based)
Security headers middleware
Content Security Policy builder

Password strength validator
Secure session configuration helper
SQL injection prevention guide
File upload security checker
Encryption and hashing utilities
Security audit checklist

CSRF Protection

Cross-Site Request Forgery tricks authenticated users into submitting unwanted requests. The CSRF utility generates a unique token per session and embeds it in a hidden form field. When the form is submitted, the token is validated against the session value. Requests with missing or invalid tokens are rejected. The implementation uses random_bytes() for cryptographically secure token generation and supports both synchronizer token and double-submit cookie patterns.

// Generate a CSRF token for a form
$csrf = new CsrfProtection();
$token = $csrf->generateToken();

// In your HTML form:
// <input type="hidden" name="_token" value="<?= $token ?>">

// Validate on form submission
if (!$csrf->validateToken($_POST['_token'])) {
    http_response_code(403);
    die('Invalid CSRF token');
}

XSS Prevention

Cross-Site Scripting attacks inject malicious scripts through user-supplied data. The XSS utility provides context-aware escaping functions for HTML body content, HTML attributes, JavaScript strings, CSS values, and URLs. Using the correct escaping function for each output context is essential because each context has different dangerous characters. The toolkit also includes a Content Security Policy builder that generates CSP headers to restrict which scripts, styles, and resources the browser will load.

// Context-aware output escaping
$esc = new Escaper();

// In HTML body
echo $esc->html($userInput);

// In HTML attributes
echo '<div title="' . $esc->attr($title) . '">';

// In JavaScript context
echo 'var name = "' . $esc->js($name) . '";';

// In URL parameters
echo '<a href="/search?q=' . $esc->url($query) . '">';

SQL Injection Defense

SQL injection remains one of the most dangerous and common web vulnerabilities. The primary defense is always using PDO prepared statements with parameterized queries, which this toolkit reinforces with a lightweight query builder that makes it impossible to accidentally concatenate user input into SQL strings. The guide section explains why prepared statements work, how parameterized queries are processed by the database engine, and common mistakes that reintroduce SQL injection risk even when using PDO.

Rate Limiting

The rate limiter class restricts how many requests a client can make within a time window. It supports limiting by IP address, authenticated user ID, or API key. Storage backends include database and file-based options, with an optional Redis adapter for high-traffic applications. Configuration is per-endpoint, allowing stricter limits on sensitive routes like login and password reset while allowing higher throughput on read-only pages.

Security Headers

The security headers middleware sets recommended HTTP headers on every response. This includes Strict-Transport-Security for HTTPS enforcement, X-Content-Type-Options to prevent MIME sniffing, X-Frame-Options to block clickjacking, Referrer-Policy to control information leakage, and Permissions-Policy to restrict browser features. The Content Security Policy builder generates complex CSP headers from a readable configuration array, supporting nonces for inline scripts.

Security Audit Checklist

The toolkit includes a comprehensive security checklist covering all OWASP Top 10 categories applied specifically to PHP applications. Each item includes an explanation of the vulnerability, how to test for it, and the recommended remediation. Categories covered include injection flaws, broken authentication, sensitive data exposure, XML external entities, broken access control, security misconfiguration, cross-site scripting, insecure deserialization, using components with known vulnerabilities, and insufficient logging.

Installation Steps

Download and extract the toolkit files
Copy the security classes to your project's library directory
Include or autoload the classes in your application bootstrap
Apply the security headers middleware to your request pipeline
Add CSRF token generation and validation to your forms
Replace raw echo statements with context-aware escaping
Review the security checklist and address each item

Server Requirements

Requirement	Minimum	Recommended
PHP Version	8.0	8.2+
PHP Extensions	OpenSSL, mbstring	+ sodium, intl
Database	None (optional for rate limiter)	MySQL or Redis
HTTPS	Strongly recommended	Required