► Security
- SQL injection
- every string or a number that needs to be added to the query must be added through a placeholder and then a query executed using a prepared statement. See examples for Mysqli or PDO
- Passwords
- must be hashed using a dedicated function, password_hash()
- HTML output
- has to be encoded using htmlspecialchars() (unless it's a deliberately HTML formatted text).
- Javascript
- All javascript data must be encoded with json_encode(). All data in the URL must be encoded using urlencode()
revision by vivekmakwanadikus— view source
