Category:PHP

It is not easy to produce a PHP application without security vulnerabilities. Most application security vulnerabilities apply to PHP applications just like other environments.

The goals of this project are to provide information about building, configuring, deploying, operating, and maintaining secure PHP applications

PHP Security for Developers

* This section covers dangerous calls and common vulnerabilities associated with them, such as system() exec(), eval() and so on. This section will also cover standard security mechanisms available in the standard language, such as cryptography, logging, encryption, and error handling. Securing elements of an application, such as controllers, business logic, and persistence layers will be covered. We'll discuss handling request parameters, encoding, injection, and more.

* CONFIG

* CODEBASE

PHP Security for DevSecOps

* How to secure a PHP application when running on the major cloud providers. How to secure a PHP application if all you've got is an unmanaged Linux server. Harden web server, harden database, and various network defenses such as WAFs, GeoIP, and DNSBL.

* How to secure the development environment. Do you have control over the Source code repository? Are commits signed? How do you know which Docker Images to trust? Do you scan containers for vulnerabilities?

* INFRASTRUCTURE

* DEVELOPMENT

PHP Security for Software Architects

* Provides information about the design and architectural considerations for a PHP web application. Which frameworks to use, which frameworks are dead, and using the various FIGs.

* ARCHITECTURE

Resources

Awesome PHP Security

Awesome AppSec

Best 3rd Party PHP Security Guide

Secure php.ini Configuration

Libraries

Google PHP recaptcha

Paragonie Anti-CSRF Library

Enhanced BCrypt Encryption

PHP GnuPG Emailer

PHP CSP Builder

Documents

OWASP PHP Top 5

Legacy Pages

The pages below are from 2005-2014 when this project was maintained by a different team. These pages have been kept so that no links are broken, and because there might be certain situations, particularly with extremely legacy apps, where their use might be appropriate. THere is great advice below, but be careful, there is also outdated advice as well.

PHP Security for Architects

PHP Security for Developers

PHP Security for Deployers

PHP Configuration Cheat Sheet

PHP CSRF Guard

Log Injection

OWASP PHP Security Project

OWASP PHP Security Project Roadmap

OWASP RBAC Project

OWASP VaultDB Project

OWASP PHPRBAC Project

OWASP WebGoatPHP

PHP Projects Mailing Lists

https://lists.owasp.org/pipermail/owasp_php_security_project/

https://lists.owasp.org/pipermail/owasp_phprbac/

Related OWASP Resources

OWASP Project Repository

Languages Repository

.NET Project

Ruby Technology Knowledge Base

PHP Technology Knowledge Base

Perl Technology Knowledge Base

Python Technology Knowledge Base

JavaScript Technology Knowledge Base

C/C++ Technology Knowledge Base

SQL, PL/SQL and DB Scripting Technology Knowledge Base

The previous version of this PHP Project home page is archived here: OWASP_PHP_Project_Archive_(03.2015)