Practical Security in Web Applications
summary
Covers concrete steps: use prepared statements (PDO) to eliminate SQL injection, scan source with SonarQube/ProgPilot/PHP-CS-security and Composer checks (Roave, FriendsOfPHP) for vulnerable dependencies, run automated pentests with OWASP ZAP or Metasploit, and consider ModSecurity as a WAF while tuning for false positives. Recommends bcrypt → Argon2 for password hashing, avoid public DB IPs, enforce least-privilege DB users, log events to a separate store, and prefer well-tested OIDC libraries over rolling custom auth.
AI-written summary · about
chapters (22)
- 0:00Start
- 3:11Security Breaches
- 3:43Web Applications
- 4:33Strategies
- 6:52Open Web Application Security Project
- 8:19Code Scanning: PHP
- 11:33Penetration Testing
- 14:52Low-Level Vulnerabilities
- 22:16XSS: Cross-Site Scripting
- 23:36Application Vulnerabilities
- 23:47User Authentication
- 25:17User Auth: Failure Handling
- 26:22User Auth: Multi-Factor
- 27:31User Auth: Account Recovery
- 29:17User Auth: Password Policies
- 31:05User Auth: Password Hashing
- 33:30User Auth: Password Transport
- 35:24User Auth: Session Length & Re-Auth
- 43:27Resource Access & Multi-Tenancy
- 44:17Securing Data Stores
- 48:06Network & System Design
- 51:12InfoSec Mindset
related talks
59mPractical Security for Web Applications
02h 14mWeb application security (Part 1)
02h 18mWeb application security (Part 2)
30mWeb Security Engineering - Protect all layers of your project
55mDip Your Toes in the Sea of Security
01h 01mSecurity: From basic principles to PHP specifics
01h 04mWeb Security And You
10mIntroduction to web security