PHP for Beginners: The Complete PHP Security Course 2026

Start the course right away if you already downloaded VS Code and exam, and skip the second two videos.

Install Xampp to run a local development server with Apache, MySQL, PHP, and phpMyAdmin, and verify by visiting localhost/index.php.

Install Visual Studio Code to begin coding; download for Windows, accept the agreement, install, and open the editor. Every text editor will do the trick.

Learn to secure PHP apps by validating and sanitizing all user input, enforcing HTTPS, keeping production errors generic, and using frameworks with regular updates and exploit monitoring.

Learn how cross-site scripting attacks inject JavaScript via form inputs and how encoding inputs with HTML special characters prevents execution, turning malicious input into harmless characters and preserving site security.

Explore remote file inclusion risks in PHP, where unvalidated user input can include and execute remote files, risking data theft and server compromise, and learn whitelist-based and php.ini mitigations.

Investigate remote file inclusion techniques and how disabling allow_url_fopen protects against full-link attacks, illustrated through a practical follow-up example.

Understand why plain text passwords are risky and how PHP's password_hash and password_verify securely hash and verify passwords, with salting and HTTPS.

Learn how to hide PHP error messages in production versus development, configure display_errors and display_startup_errors, and log errors to a file for secure debugging without exposing app details.

Learn to protect php files by disabling directory listings with htaccess. Use options - indexes and custom 403 messages to hide folders and safeguard uploads and configs.

Use the header function to redirect with a 302 response, then immediately call exit to stop post-redirect code and prevent data leaks and attacks via curl or Burp Suite.

Explain how https protects web apps by encrypting all browser-server data with ssl or tls certificates, preventing credential theft and session hijacking, and enforce secure cookies and sessions in production.

Protects sensitive folders such as config, vendor, and includes by applying a directory firewall in cPanel, preventing direct access by attackers.

Restrict access to directories with an htaccess file by allowing only specific IPs, denying others, and adding a first layer of defense for sensitive folders on Apache.

Learn to prevent server execution of specific file types using an htaccess block, protecting upload directories from PHP shells and ensuring only allowed file types are stored.

Secure file uploads in PHP by restricting extensions and validating mime types to prevent malicious files and denial of service. Create an upload script and form to enforce these checks.

The video covers enforcing a two megabyte limit on uploaded files and renaming uploads to a unique, time-based name to prevent overwriting and make files harder to guess.

Fix logged errors in your PHP application by keeping log files clean, preventing security vulnerabilities, reducing sensitive data exposure, and boosting performance, user experience, and stability as the app scales.

Learn why back end validation is essential for data integrity and security, going beyond front end checks to prevent SQL injection and XSS.

Regenerate the session ID on login to prevent session fixation and block attackers from reusing a known session. Enforce https to prevent session IDs from being sniffed over the network.

Learn how SQL injection threatens login forms and data integrity, and implement secure practices using prepared statements with bound parameters in PHP using PDO.

Explain cross-site request forgery and demonstrate how to prevent it by using a session-based CSRF token generated with random bytes and bin2hex, embedded in forms and validated on submission.