Comprehensive Guide to Securing Web Applications: Best Practices Across All Stacks

<?php
// Vulnerable: $name comes from the request
$name = $_GET['name'] ?? '<img src=x onerror=alert(document.cookie)>';
// echo "<p>Hello $name</p>";                      // runs the attacker's script

// Fixed: escape for the HTML context, always with the charset and quote flags
function e(string $s): string { return htmlspecialchars($s, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8'); }
echo '<p>Hello ', e($name), "</p>\n";              // renders the tag as text
echo '<a href="/profile?u=', rawurlencode($name), '">link</a>', "\n";   // URL context: different encoder

// Node/Express equivalent — same rule, one escaper per context
const escapeHtml = (s) => String(s).replace(/[&<>"']/g, (c) =>
  ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));

const name = '<img src=x onerror=alert(1)>';
console.log(`<p>Hello ${escapeHtml(name)}</p>`);
console.log(`<a href="/profile?u=${encodeURIComponent(name)}">link</a>`);

<?php
declare(strict_types=1);
$pdo = new PDO('sqlite::memory:', options: [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC]);
$pdo->exec("CREATE TABLE invoices (id INTEGER PRIMARY KEY, user_id INTEGER, total INTEGER)");
$pdo->exec("INSERT INTO invoices VALUES (1001, 7, 57500), (1002, 8, 115000)");

$currentUserId = 7;
$requestedId   = "1002 OR 1=1";                        // attacker edits the URL

// Vulnerable: "SELECT * FROM invoices WHERE id = $requestedId" returns everything

// Fixed: bound parameter AND ownership in the same query
$stmt = $pdo->prepare('SELECT id, total FROM invoices WHERE id = :id AND user_id = :uid');
$stmt->execute(['id' => $requestedId, 'uid' => $currentUserId]);
var_dump($stmt->fetch());                              // false: not a number, not theirs

$stmt->execute(['id' => 1001, 'uid' => $currentUserId]);
print_r($stmt->fetch());                               // their own invoice only

// Node: the same two rules with the mysql2 driver (placeholders + ownership).
// Shown for shape; requires the mysql2 package.
async function getInvoice(db, invoiceId, currentUserId) {
  const [rows] = await db.execute(
    'SELECT id, total FROM invoices WHERE id = ? AND user_id = ?',
    [invoiceId, currentUserId],
  );
  return rows[0] ?? null;          // null, not someone else's row
}
module.exports = { getInvoice };

<?php
declare(strict_types=1);
session_start();

function csrfToken(): string {
    return $_SESSION['csrf'] ??= bin2hex(random_bytes(32));
}
function csrfCheck(?string $submitted): void {
    if ($submitted === null || !hash_equals($_SESSION['csrf'] ?? '', $submitted)) {
        http_response_code(403);
        throw new RuntimeException('Invalid CSRF token');
    }
}

// In the form, print it escaped:  <input type="hidden" name="_token" value="…csrfToken()…">
$token = csrfToken();
csrfCheck($token);                   // passes
try { csrfCheck('forged'); } catch (RuntimeException $ex) { echo $ex->getMessage(), PHP_EOL; }

<?php
declare(strict_types=1);
// Vulnerable: if (md5($password) === $row['password_md5'])  — rainbow tables solve this in seconds

// Fixed
$stored = password_hash('S3cure-passphrase', PASSWORD_DEFAULT);          // bcrypt today
$ok     = password_verify('S3cure-passphrase', $stored);
$bad    = password_verify('s3cure-passphrase', $stored);
var_dump($ok, $bad);                                                     // true, false

// Rate limit: count failures per account for 15 minutes (any store works; a table, Redis, APCu)
$failures = ['[email protected]' => 5];
$limit = 5;
if (($failures['[email protected]'] ?? 0) >= $limit) {
    echo "Too many attempts, try again in 15 minutes\n";
}

// Node without extra packages: scrypt from the standard library
const { scryptSync, randomBytes, timingSafeEqual } = require('node:crypto');

function hashPassword(pw) {
  const salt = randomBytes(16);
  return salt.toString('hex') + ':' + scryptSync(pw, salt, 64).toString('hex');
}
function verifyPassword(pw, stored) {
  const [saltHex, hashHex] = stored.split(':');
  const candidate = scryptSync(pw, Buffer.from(saltHex, 'hex'), 64);
  return timingSafeEqual(candidate, Buffer.from(hashHex, 'hex'));   // constant time
}
const h = hashPassword('S3cure-passphrase');
console.log(verifyPassword('S3cure-passphrase', h), verifyPassword('wrong', h));   // true false

-- Vulnerable: GRANT ALL PRIVILEGES ON *.* TO 'app'@'%'

-- Fixed: least privilege, local only
CREATE USER 'cpaneluser_app'@'localhost' IDENTIFIED BY 'a-long-random-password';
GRANT SELECT, INSERT, UPDATE, DELETE ON cpaneluser_shop.* TO 'cpaneluser_app'@'localhost';
FLUSH PRIVILEGES;

<FilesMatch "(^\.|\.(env|bak|sql|old|orig|swp)$|~$)">
    Require all denied
</FilesMatch>
Options -Indexes

<?php
declare(strict_types=1);
// Send once, early, from a bootstrap file every page includes
function securityHeaders(): void {
    header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
    header('X-Content-Type-Options: nosniff');
    header('X-Frame-Options: DENY');
    header('Referrer-Policy: strict-origin-when-cross-origin');
    header("Content-Security-Policy: default-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'");
    header('Permissions-Policy: camera=(), microphone=(), geolocation=()');
}
securityHeaders();
echo PHP_SAPI === 'cli' ? "headers queued (CLI cannot send them)\n" : '';

// Node: same headers from a tiny middleware, no packages needed
const http = require('node:http');
const HEADERS = {
  'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
  'X-Content-Type-Options': 'nosniff',
  'X-Frame-Options': 'DENY',
  'Referrer-Policy': 'strict-origin-when-cross-origin',
  'Content-Security-Policy': "default-src 'self'; object-src 'none'; frame-ancestors 'none'",
};
const server = http.createServer((req, res) => {
  for (const [k, v] of Object.entries(HEADERS)) res.setHeader(k, v);
  res.end('ok');
});
server.listen(0, () => {
  http.get({ port: server.address().port }, (res) => {
    console.log(res.headers['content-security-policy']);
    server.close();
  });
});

<?php
declare(strict_types=1);
// Vulnerable: move_uploaded_file($_FILES['f']['tmp_name'], 'uploads/' . $_FILES['f']['name']);

// Fixed: sniff bytes, allow-list, random name, outside the web root
function acceptImage(string $tmpPath, string $privateDir): string {
    $mime = (new finfo(FILEINFO_MIME_TYPE))->file($tmpPath);
    $ext  = ['image/jpeg' => 'jpg', 'image/png' => 'png', 'image/webp' => 'webp'][$mime] ?? null;
    if ($ext === null) throw new RuntimeException("Rejected type $mime");
    $name = bin2hex(random_bytes(16)) . ".$ext";
    if (!rename($tmpPath, "$privateDir/$name")) throw new RuntimeException('Store failed');
    return $name;
}

$fake = tempnam(sys_get_temp_dir(), 'x'); file_put_contents($fake, '<?php echo 1;');
try { acceptImage($fake, sys_get_temp_dir()); } catch (RuntimeException $e) { echo $e->getMessage(), PHP_EOL; }

<FilesMatch "\.(php|phtml|phar)$">
    Require all denied
</FilesMatch>

<?php
declare(strict_types=1);
function securityLog(string $event, array $ctx = []): void {
    $line = json_encode([
        'ts'    => (new DateTimeImmutable('now', new DateTimeZone('UTC')))->format(DATE_ATOM),
        'event' => $event,
        'ip'    => $_SERVER['REMOTE_ADDR'] ?? 'cli',
        'ua'    => substr($_SERVER['HTTP_USER_AGENT'] ?? '', 0, 120),
    ] + $ctx, JSON_UNESCAPED_SLASHES);
    error_log($line);                                  // lands in the account's PHP error log
}
securityLog('login.failed', ['email' => '[email protected]', 'reason' => 'bad_password']);
securityLog('password.changed', ['user_id' => 42]);
echo "two events logged\n";