Breaking into most websites does not take extraordinary skill; an attacker only needs to find one of the mistakes known for years. The good news is that closing them is not hard if you build clear habits from the first line.

1. Prepared statements against SQL injection

Never concatenate user input into a query string. Use prepared statements:

$stmt = $db->prepare('SELECT id, name FROM users WHERE email = ?');
$stmt->bind_param('s', $email);
$stmt->execute();
$user = $stmt->get_result()->fetch_assoc();

2. Store passwords hashed, never as text

Use password_hash() when saving and password_verify() when signing in. Do not invent an algorithm, and do not use MD5 or SHA1 for passwords.

3. Escape everything you output (XSS)

Any text from a user or the database should pass through htmlspecialchars() before printing, otherwise an attacker may run a script in your visitors' browsers.

4. A CSRF token in every form

Any request that changes data (save, delete, pay) should carry a random session-bound token verified on the server, so a signed-in user cannot be tricked into an action they did not intend.

5. Handle file uploads carefully

Check the real file type, not only the extension, limit size, rename files to random names, and block PHP execution inside the upload folder. Private client files should be served through a script that checks permissions.

6. Secure sessions and HTTPS

Enable HttpOnly, Secure and SameSite on the session cookie, regenerate the session ID after sign-in, and serve the whole site over HTTPS.

7. Updates and production settings

  • Run a PHP version that still receives security updates.
  • Turn off error display for visitors (display_errors = Off) and log errors instead.
  • Remove installer and test files when done.
  • Take regular backups and actually test restoring them.
Security is a habit that starts with the first line, not a feature added a day before launch.

This list does not replace a full security review, but it closes the doors attackers knock on first. If you want your current site checked, get in touch.