The ultimate PHP security checklist
Tags: php, security, webdev
Published: 2018-08-23 11:25:04

---
title: The ultimate PHP security checklist
published: true
description: Learn how to improve the security of your PHP app
tags: php, security, webdev
canonical_url: https://www.sqreen.io/checklists/php-security-checklist
cover_image: https://thepracticaldev.s3.amazonaws.com/i/v4wm8enfkwhwg6c553tx.jpg
---

*Read the full checklist [here](https://www.sqreen.io/checklists/php-security-checklist)*

Damn, but security is hard. It’s not always obvious what needs doing, and the payoffs of good security are at best obscure. Who is surprised when it falls off our priority lists?

This security checklist aims to give developers a list of PHP security best practices they can follow to help improve the security of their code.

Here is a selection of some of the security checklist items:

## Filter and Validate All Data

Regardless of where the data comes from, whether that’s a configuration file, server environment, GET and POST, or anywhere else, do not trust it. Filter and validate it! Do this by using one of the available libraries, such as zend-inputfilter.

__Read more:__

- [Validation in Zend Framework](https://framework.zend.com/blog/2017-06-13-zend-validator.html)
- [Validation in Symfony](https://symfony.com/doc/current/validation.html)
- [Validation in Laravel](https://laravel.com/docs/5.6/validation)

## Use Parameterized Queries

To avoid SQL injection attacks, never concatenate or interpolate SQL strings with external data. Use parameterized queries instead and prepared statements. These can be used with vendor-specific libraries or by using PDO.

__Learn more:__

- [Prepared statements and stored procedures in PDO](https://secure.php.net/manual/en/pdo.prepared-statements.php)
- [Mysqli Prepared Statements](https://secure.php.net/manual/de/mysqli.quickstart.prepared-statements.php)
- [The PostgreSQL pg_query_params function](https://secure.php.net/manual/en/function.pg-query-params.php)


## Set open_basedir

The `open_basedir` directive limits the files that PHP can access to the filesystem from the `open_basedir` directory and downward. No files or directories outside of that directory can be accessed. That way, if malicious users attempt to access sensitive files, such as `/etc/passwd`, access will be denied.

__Read more:__

- [open_basedir configuration directive](https://secure.php.net/manual/en/ini.core.php#ini.open-basedir)
- [PHP Filesystem Security](https://secure.php.net/manual/en/security.filesystem.php)
- [Isolated Execution Environments by DigitalOcean](https://www.digitalocean.com/community/tutorials/7-security-measures-to-protect-your-servers#isolated-execution-environments)

## Check Your SSL / TLS Configurations

Ensure that your server’s SSL/TLS configuration is up to date and correctly configured, and isn’t using weak ciphers, outdated versions of TLS, valid security certificates without weak keys, etc, by scanning it regularly.

__Read more:__

- [SSL Labs](https://www.ssllabs.com/)
- [Observatory by Mozilla](https://observatory.mozilla.org/)


**Check out the full checklist [here](https://www.sqreen.io/checklists/php-security-checklist)**