PHP Security Patterns
Language-level security patterns for PHP, applicable to any PHP project.
Input Validation
Type Validation
// Always validate and sanitize input
public function processUserId(mixed $input): int
{
if (!is_numeric($input)) {
throw new \InvalidArgumentException('User ID must be numeric');
}
$id = (int)$input;
if ($id <= 0) {
throw new \InvalidArgumentException('User ID must be positive');
}
return $id;
}Email Validation
public function validateEmail(string $email): bool
{
// Use built-in filter
$filtered = filter_var($email, FILTER_VALIDATE_EMAIL);
if ($filtered === false) {
throw new \InvalidArgumentException('Invalid email format');
}
return true;
}URL Validation
public function validateUrl(string $url): bool
{
$filtered = filter_var($url, FILTER_VALIDATE_URL);
if ($filtered === false) {
throw new \InvalidArgumentException('Invalid URL format');
}
// Additional checks
$parsed = parse_url($url);
// Only allow http/https
if (!in_array($parsed['scheme'] ?? '', ['http', 'https'])) {
throw new \InvalidArgumentException('URL must use http or https');
}
return true;
}SQL Injection Prevention
Use ORM Query Builder (Recommended)
// ✅ CORRECT: Use ORM (CakePHP example)
public function findUserByEmail(string $email): ?User
{
return $this->Users->find()
->where(['email' => $email]) // Automatically parameterized
->first();
}
// ✅ CORRECT: ORM with conditions array
public function findActiveUsers(int $companyId): array
{
return $this->Users->find()
->where([
'company_id' => $companyId,
'status' => 1,
'del_flg' => 0,
])
->toArray();
}
// ❌ WRONG: Raw SQL with string concatenation
public function findUserUnsafe(string $email): ?User
{
$query = "SELECT * FROM users WHERE email = '" . $email . "'"; // VULNERABLE!
return $this->getConnection()->query($query)->fetch();
}Use Query Expressions for Complex Conditions
// ✅ CORRECT: Use Query expressions for complex logic
public function findUsersWithComplexCondition(string $searchTerm): array
{
return $this->Users->find()
->where(function ($exp, $q) use ($searchTerm) {
return $exp->or([
'email LIKE' => '%' . $searchTerm . '%',
'name LIKE' => '%' . $searchTerm . '%',
]);
})
->toArray();
}Only Use Raw SQL When Absolutely Necessary
// If raw SQL is unavoidable, ALWAYS use parameter binding
public function executeRawQuery(int $userId): array
{
$conn = $this->getConnection();
// ✅ CORRECT: Named parameters
$stmt = $conn->execute(
'SELECT * FROM users WHERE id = :id',
['id' => $userId],
['id' => 'integer']
);
return $stmt->fetchAll();
}
// ❌ WRONG: Never concatenate user input
public function unsafeRawQuery(string $email): array
{
$sql = "SELECT * FROM users WHERE email = '$email'"; // VULNERABLE!
return $this->getConnection()->execute($sql)->fetchAll();
}XSS (Cross-Site Scripting) Prevention
Output Escaping
// ✅ CORRECT: Escape output
echo htmlspecialchars($userInput, ENT_QUOTES, 'UTF-8');
// For HTML attributes
echo '<input value="' . htmlspecialchars($value, ENT_QUOTES, 'UTF-8') . '">';
// For JavaScript
echo '<script>var name = "' . json_encode($name, JSON_HEX_TAG | JSON_HEX_AMP) . '";</script>';
// For URLs
echo '<a href="' . urlencode($url) . '">Link</a>';Content Security Policy
// Set CSP headers
header("Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'");CSRF (Cross-Site Request Forgery) Prevention
Token Generation
class CsrfToken
{
public static function generate(): string
{
if (session_status() === PHP_SESSION_NONE) {
session_start();
}
$token = bin2hex(random_bytes(32));
$_SESSION['csrf_token'] = $token;
return $token;
}
public static function validate(string $token): bool
{
if (session_status() === PHP_SESSION_NONE) {
session_start();
}
return isset($_SESSION['csrf_token']) && hash_equals($_SESSION['csrf_token'], $token);
}
}Form Implementation
// In form
<form method="POST">
<input type="hidden" name="csrf_token" value="<?= CsrfToken::generate() ?>">
<!-- Other fields -->
</form>
// In handler
if (!CsrfToken::validate($_POST['csrf_token'] ?? '')) {
throw new SecurityException('Invalid CSRF token');
}Password Security
Hashing
// ✅ CORRECT: Use password_hash()
public function hashPassword(string $password): string
{
return password_hash($password, PASSWORD_ARGON2ID, [
'memory_cost' => 65536,
'time_cost' => 4,
'threads' => 3,
]);
}
// ❌ WRONG: Never use md5, sha1, or plain text
public function insecureHash(string $password): string
{
return md5($password); // VULNERABLE!
}Verification
public function verifyPassword(string $password, string $hash): bool
{
return password_verify($password, $hash);
}
public function needsRehash(string $hash): bool
{
return password_needs_rehash($hash, PASSWORD_ARGON2ID, [
'memory_cost' => 65536,
'time_cost' => 4,
'threads' => 3,
]);
}Session Security
Secure Session Configuration
// Configure secure sessions
ini_set('session.cookie_httponly', '1');
ini_set('session.cookie_secure', '1'); // HTTPS only
ini_set('session.cookie_samesite', 'Strict');
ini_set('session.use_strict_mode', '1');
// Regenerate session ID on login
session_start();
if ($loginSuccessful) {
session_regenerate_id(true);
}Session Fixation Prevention
public function login(string $username, string $password): bool
{
if ($this->authenticate($username, $password)) {
// Regenerate session ID to prevent fixation
session_regenerate_id(true);
$_SESSION['user_id'] = $userId;
$_SESSION['last_activity'] = time();
return true;
}
return false;
}Session Timeout
public function checkSessionTimeout(): bool
{
$timeout = 1800; // 30 minutes
if (isset($_SESSION['last_activity'])) {
if (time() - $_SESSION['last_activity'] > $timeout) {
session_destroy();
return false;
}
}
$_SESSION['last_activity'] = time();
return true;
}File Upload Security
Validation
public function validateUpload(array $file): bool
{
// Check for upload errors
if ($file['error'] !== UPLOAD_ERR_OK) {
throw new \RuntimeException('Upload failed');
}
// Validate MIME type
$allowedTypes = ['image/jpeg', 'image/png', 'image/gif'];
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mimeType = finfo_file($finfo, $file['tmp_name']);
finfo_close($finfo);
if (!in_array($mimeType, $allowedTypes)) {
throw new \InvalidArgumentException('Invalid file type');
}
// Validate file size (max 5MB)
if ($file['size'] > 5 * 1024 * 1024) {
throw new \InvalidArgumentException('File too large');
}
return true;
}
public function saveUpload(array $file): string
{
$this->validateUpload($file);
// Generate safe filename
$extension = pathinfo($file['name'], PATHINFO_EXTENSION);
$filename = bin2hex(random_bytes(16)) . '.' . $extension;
// Save outside web root
$uploadDir = '/var/uploads/';
$destination = $uploadDir . $filename;
if (!move_uploaded_file($file['tmp_name'], $destination)) {
throw new \RuntimeException('Failed to save file');
}
return $filename;
}Directory Traversal Prevention
Path Sanitization
public function getSecurePath(string $userPath): string
{
// Define safe base directory
$baseDir = realpath('/var/www/uploads/');
// Resolve user path
$requestedPath = realpath($baseDir . '/' . $userPath);
// Ensure path is within base directory
if ($requestedPath === false || strpos($requestedPath, $baseDir) !== 0) {
throw new \InvalidArgumentException('Invalid path');
}
return $requestedPath;
}Command Injection Prevention
Avoid shell execution
// ✅ CORRECT: Use native PHP functions
$files = scandir($directory);
// ✅ CORRECT: If shell needed, use escapeshellarg()
$filename = escapeshellarg($userFilename);
exec("ls -la " . $filename, $output);
// ❌ WRONG: Direct shell execution with user input
exec("ls -la " . $userFilename); // VULNERABLE!XML External Entity (XXE) Prevention
Disable external entities
// ✅ CORRECT: Disable external entity loading
libxml_disable_entity_loader(true);
$dom = new DOMDocument();
$dom->loadXML($xmlString, LIBXML_NOENT | LIBXML_DTDLOAD);
// Or use SimpleXML
$xml = simplexml_load_string($xmlString, 'SimpleXMLElement', LIBXML_NOENT);Cryptographic Random Numbers
Use secure random
// ✅ CORRECT: Use random_bytes() or random_int()
$token = bin2hex(random_bytes(32));
$randomNumber = random_int(1, 100);
// ❌ WRONG: Never use rand() or mt_rand() for security
$insecureToken = mt_rand(); // VULNERABLE!HTTP Headers
Security Headers
// X-Frame-Options
header('X-Frame-Options: SAMEORIGIN');
// X-Content-Type-Options
header('X-Content-Type-Options: nosniff');
// X-XSS-Protection
header('X-XSS-Protection: 1; mode=block');
// Strict-Transport-Security (HTTPS only)
header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
// Referrer-Policy
header('Referrer-Policy: strict-origin-when-cross-origin');Error Handling
Don't expose sensitive information
// ✅ CORRECT: Log detailed errors, show generic message
try {
$this->processPayment($amount);
} catch (\Exception $e) {
// Log full error for debugging
error_log('Payment error: ' . $e->getMessage());
// Show generic message to user
throw new \RuntimeException('Payment processing failed');
}
// ❌ WRONG: Expose stack traces in production
ini_set('display_errors', '1'); // VULNERABLE in production!Framework-Agnostic
These security patterns apply to:
- CakePHP projects
- Laravel projects
- Symfony projects
- Any PHP application
Framework-specific security features (Authentication, Authorization, CSRF middleware, etc.) should be defined in framework-level skills (e.g., php-cakephp/security-patterns).