PHP Security

Learn how to protect PHP applications from bad people by understanding common hacking risks, seeing examples to avoid vulnerabilities, and securing your projects; set goals and stay positive.

Discover the PHP development tools and editors used in this course, from a development package and Apache to flexible editors like PhpStorm, Sublime, and TextWrangler, plus frameworks such as Slim.

Download the zip folder of the course files to reference the exercises, or follow it from scratch to understand how everything works in PHP security.

Create a PHP security lab by setting up a database and a users table with an auto-increment id, email, and name to practice SQL injection techniques.

Demonstrate how an attacker can input data into a PHP form to manipulate the database via SQL injection, then show a fix using a PDO MySQL connection and post requests.

Explore SQL injection risks by simulating an attacker submitting an email to query a users table, reveal how vulnerable queries work, and preview preventing such attacks in the next lecture.

Learn how sql injection can drop tables and compromise data in a real-world app. Use prepared statements with placeholders to safely execute queries and protect your database from hackers.

Hackers can glean sensitive information from error messages, so disable error display in production by configuring php.ini or server settings, then restart the server and manage error reporting.

Learn about cross site scripting (xss) and how malicious javascript injection can compromise web apps, then see how to set up safe markup and prepared statements to prevent it.

show cross-site scripting by injecting javascript into a database, insert a comment, and display those comments in a list using a for-each loop.

Query and display all comments from the database in a table, showing each name and body, and highlight a javascript injection risk to be addressed in the next video.

Learn how to prevent cross-site scripting in PHP by escaping special characters and converting them to HTML entities, safeguarding database-stored comments and user input.

Shows how malicious javascript redirects users and exfiltrates cookies, illustrating cross-site cookie stealing risks and attacker techniques involving redirects and document.cookie.

Explore how missing cookies and unsafe data handling enable cookie theft and session hijacking in PHP. Learn to set, escape, and protect cookies to prevent such attacks.

In this PHP Security lecture, learn the right way to hash passwords versus flawed methods, and convert the login form to bootstrap using form-group, form-control, and a primary button.

Compare insecure MD5 password hashing with a secure password_hash approach, demonstrate hashing and verifying passwords, and preview best practices like salting, trimming input, and safe verification.

Learn to securely hash passwords with PHP using password_hash, configure the algorithm and cost, and insert the hashed password into a users table via prepared statements.

Learn how to verify a hashed password by retrieving a user from the database with a prepared query, using a password verify function, and securely displaying results.

Hide directory listings on your Apache server by creating an .htaccess file with an options directive to block access, preventing visitors from seeing folders and files.

Secure php cookies by restricting access to http only, preventing javascript access, and using attributes like expiration, domain, path, and secure flag.

Demonstrate cross-site request forgery (csrf) by simulating an attack in a php app, showing session cookies, a hacker page, and a delete action, then test a simple post-based protection.

Learn to prevent cross-site request forgery in PHP by validating post requests, using a session-based token created for each form, and rejecting invalid tokens.

Learn to prevent cross-site request forgery in PHP by building a form with a delete action that validates post requests, tokens, and session data.

Wrap up the PHP security course by thanking students, inviting five-star reviews, and guiding them to explore more courses and contact the instructor for help.