The OWASP PHP Technology Knowledge Base is the clearing house for all information related to building secure web applications and services based on PHP technologies. The focus of the project is on guidance for developers and application architects on using PHP and PHP frameworks. Moreover, we aim to provide security related guidance for system administrators managing PHP based applications and tools.
Community content is key to security information. The project depends on content from developers throughout the PHP ecosystem.
OWASP PHP Technology Knowledge Base is free to use. It is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.
Lead: Dan Ehrlich
Please email [email protected] if you would like to help out.
Last Update: 12/2018
PHP Projects Mailing Lists
Related OWASP Resources
It is not easy to produce a PHP application without security vulnerabilities. Most application security vulnerabilities apply to PHP applications just like other environments.
The goals of this project are to provide information about building, configuring, deploying, operating, and maintaining secure PHP applications. We cover the following topics or pick a topic from the OWASP PHP Table of Contents
- PHP Security for Architects
- Provides information about the design and architectural considerations for a PHP web application. Common architectures such as MVC, Ajax, Web Services and PEAR / Zend Frameworks are discussed.
- PHP Security for Developers
- This section covers dangerous calls and common vulnerabilities associated with them, such as system() exec(), eval() and so on. This section will also cover standard security mechanisms available in the standard language, such as cryptography, logging, encryption, and error handling. Securing elements of an application, such as controllers, business logic, and persistence layers will be covered. We'll discuss handling request parameters, encoding, injection, and more.
- PHP Security for Deployers
- These articles cover topics specifically related to the PHP hosting environment. We discuss minimizing the attack surface, configuring error handlers, and performing hardening of PHP.
PHP Top 5 - OWASP PHP Top 5
Secure php.ini configuration
The previous version of this PHP Project home page is archived here: OWASP_PHP_Project_Archive_(03.2015)
Pages in category "PHP"
The following 10 pages are in this category, out of 10 total.