PHP Security Checklist for Production Applications

Security is not a product you buy; it is a habit you practise. This checklist covers the controls that matter most for a PHP application.

Data access

• Use PDO prepared statements for every query. Never concatenate user input into SQL.
• Least-privilege database accounts: the web user needs SELECT, INSERT, UPDATE and DELETE — nothing more.

Output

• Escape every dynamic value with htmlspecialchars($value, ENT_QUOTES, 'UTF-8').
• Serve a Content-Security-Policy header and use nonces for inline data blocks.

Sessions and passwords

• Regenerate the session ID after login.
• Hash passwords with password_hash() (bcrypt) and verify with password_verify().
• Throttle failed logins per IP and per identity.

File uploads

• Verify the real MIME type with finfo, never the client-provided one.
• Store uploads outside the application code, with script execution disabled.
• Generate filenames server-side; never trust the original name.

Run through this list before every release, and most attacks against your application become significantly harder.