How to securely write and format basic web scripts

Part 4 of 4 — completes the PHP module

Security is not a single plugin; it is a set of habits. The vulnerabilities below appear repeatedly in real applications. Understanding them helps you read tutorials critically and pass technical reviews for advertising programs that expect quality, safe content.

SQL injection — use prepared statements always

Never concatenate user input into SQL strings. Attackers can supply crafted input that alters query logic. PDO prepared statements separate SQL structure from data, which neutralizes classic injection in user-supplied values. 

// Unsafe — do not use
        $sql = "SELECT * FROM users WHERE email = '{$_GET['email']}'";

        // Safe pattern
        $stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email');
        $stmt->execute(['email' => $_GET['email']]);

Below is how the output typically looks in a browser, terminal, or API client:

Output (server response)
Request handled successfully.

Cross-site scripting (XSS) — escape on output

When you print user-controlled strings inside HTML, encode special characters so browsers treat them as text, not markup or script. PHP’s htmlspecialchars with ENT_QUOTES is the default tool for HTML body and attribute contexts. 

<p>Hello, <?= htmlspecialchars($name, ENT_QUOTES, 'UTF-8') ?></p>

Below is how the output typically looks in a browser, terminal, or API client:

Output preview (browser)

For JavaScript or URL contexts, different encoding rules apply—do not reuse HTML escaping everywhere blindly.

Cross-site request forgery (CSRF)

CSRF tricks a logged-in user’s browser into submitting a request they did not intend—for example changing an email address. Mitigate state-changing POST requests with a random token stored in the session and embedded as a hidden form field. Verify the token server-side before applying changes.

File uploads and includes

Validate MIME types and extensions for uploads, store files outside the web root when possible, and never pass raw user input to include or require. Path traversal attacks abuse poorly sanitized filenames.

Configuration hygiene

  • Turn off display_errors in production; log to files instead.
  • Keep PHP and extensions updated.
  • Use HTTPS everywhere cookies carry session identifiers.
  • Restrict database accounts to least privilege (no FILE privilege for app users).

You have now completed the PHP & MySQL module. Continue with the HTML track to pair secure backends with accessible interfaces.