php

Modern PHP

PHP earned its insecure reputation from a decade of mysql_query("...$_GET..."). Modern PHP (8.3+) is a typed, fast, well-tooled language — the craft is using its type system and PDO, and never trusting $_GET/$_POST/$_REQUEST near a query, a shell, or output.

Scan PHP for the classic dangerous patterns: python3 scripts/scan_php_smells.py src/**/*.php

Use the 8.x type system

// Wrong — untyped, mutable, verbose, no guarantees
class Money {
  public $amount;
  public $currency;
  function __construct($amount, $currency) { $this->amount = $amount; $this->currency = $currency; }
}

// Correct — typed, readonly, promoted constructor params, enum
enum Currency: string { case USD = 'USD'; case EUR = 'EUR'; }

final class Money {
  public function __construct(
    public readonly int $amount,            // promoted + readonly = immutable
    public readonly Currency $currency,
  ) {}
}

declare(strict_types=1); at the top of every file makes type declarations enforced, not coerced. Use readonly for value objects, enum for fixed sets, match (exhaustive, strict ===) over switch, and union/nullable types. Detail → references/modern-php.md.

Never build SQL from request data

// Wrong — SQL injection, the canonical PHP breach
$id = $_GET['id'];
$db->query("SELECT * FROM users WHERE id = $id");

// Correct — PDO prepared statement; the value never touches the SQL text
$stmt = $pdo->prepare('SELECT * FROM users WHERE id = ?');
$stmt->execute([$_GET['id']]);

Use PDO with prepared statements (or an ORM) for every query. The legacy mysql_* functions are removed; mysqli without bound params is the same hole. Query craft (parameterization, joins, plans) is owned by sql-authoring.

Escape on output, validate on input

// Wrong — reflected XSS
echo "<p>Hello {$_GET['name']}</p>";

// Correct — escape for the output context
echo '<p>Hello ' . htmlspecialchars($_GET['name'], ENT_QUOTES, 'UTF-8') . '</p>';