mirror of
https://github.com/affaan-m/everything-claude-code.git
synced 2026-03-31 06:03:29 +08:00
34 lines
1.3 KiB
Markdown
34 lines
1.3 KiB
Markdown
---
|
|
paths:
|
|
- "**/*.php"
|
|
- "**/composer.lock"
|
|
- "**/composer.json"
|
|
---
|
|
# PHP Security
|
|
|
|
> This file extends [common/security.md](../common/security.md) with PHP specific content.
|
|
|
|
## Input and Output
|
|
|
|
- Validate request input at the framework boundary (`FormRequest`, Symfony Validator, or explicit DTO validation).
|
|
- Escape output in templates by default; treat raw HTML rendering as an exception that must be justified.
|
|
- Never trust query params, cookies, headers, or uploaded file metadata without validation.
|
|
|
|
## Database Safety
|
|
|
|
- Use prepared statements (`PDO`, Doctrine, Eloquent query builder) for all dynamic queries.
|
|
- Avoid string-building SQL in controllers/views.
|
|
- Scope ORM mass-assignment carefully and whitelist writable fields.
|
|
|
|
## Secrets and Dependencies
|
|
|
|
- Load secrets from environment variables or a secret manager, never from committed config files.
|
|
- Run `composer audit` in CI and review new package maintainer trust before adding dependencies.
|
|
- Pin major versions deliberately and remove abandoned packages quickly.
|
|
|
|
## Auth and Session Safety
|
|
|
|
- Use `password_hash()` / `password_verify()` for password storage.
|
|
- Regenerate session identifiers after authentication and privilege changes.
|
|
- Enforce CSRF protection on state-changing web requests.
|