Secure Coding in PHP: PDO Prepared Statements, Sessions & php.ini Hardening

PHP powers over 76% of all server-side web applications across the global internet (including WordPress, Laravel, and enterprise portals). Historically criticized for insecure default settings in PHP 4 and 5, modern PHP 8.1 - 8.4+ provides enterprise-grade cryptographic functions and robust type safety. Writing bulletproof PHP requires adhering to strict secure coding standards and hardening your runtime environment.

1. Input Validation vs. Output Sanitization

A fundamental security rule: Validate on Input, Encode on Output:

• Input Validation: Verifies that incoming data strictly adheres to expected types, lengths, and formats before processing. Reject invalid data immediately using filter_var() or regex allowlists.
• Output Encoding: Transforms special characters into safe entity representations right before rendering into HTML, JavaScript, or attributes to stop XSS.

// 1. Strict Input Validation
$email = filter_var($_POST['email'] ?? '', FILTER_VALIDATE_EMAIL);
if (!$email) {
    throw new InvalidArgumentException("Invalid email format provided.");
}

// 2. Context-Aware Output Encoding (Stops XSS)
echo htmlspecialchars($userBio, ENT_QUOTES | ENT_HTML5, 'UTF-8');

2. Production php.ini Hardening Checklist

Hardening the server's php.ini configuration file neutralizes entire categories of web vulnerabilities:

3. Hardened PHP Session Configuration

// Configure session parameters BEFORE session_start()
ini_set('session.cookie_httponly', 1); // Blocks JavaScript document.cookie access
ini_set('session.cookie_secure', 1);   // Forces HTTPS transmission only
ini_set('session.cookie_samesite', 'Strict'); // Halts cross-site CSRF requests
ini_set('session.use_strict_mode', 1); // Prevents Session Fixation
ini_set('session.use_only_cookies', 1);

session_start();