Awesome PHP Security

Protect your application from known vulnerabilities in dependencies and the PHP ecosystem using these resources:

• security-checker: A PHP frontend for security.symfony.com. Can be run via Docker.
• Symfony Security Monitoring: Monitors PHP security vulnerabilities.
• roave/security-advisories: A Composer dependency that prevents the installation of known vulnerable packages during composer update.
• Security Advisories: A database of PHP security advisories (FriendsOfPHP).
• php-malware-detector: A tool to detect malware within PHP environments.
• Snyk Open Source: A package manager scanner for managing dependency security.

docker pull guardrails/security-checker

Use intentionally vulnerable applications to learn and test security concepts:

• DVWA (Damn Vulnerable Web Application): A PHP/MySQL web application designed to be vulnerable for practice.
• Insecure PHP Example: A Silex-based application providing examples of SQL Injection, plain text passwords, and XSS.

Use static analysis tools to find vulnerabilities and weaknesses in your PHP source code before deployment:

• Enlightn: Static and dynamic analysis specifically for Laravel applications.
• Exakat: PHP static code analysis with dedicated security rulesets.
• phpcs-security-audit: A set of PHP_CodeSniffer rules for finding security vulnerabilities. Can be run via Docker.
• progpilot: A static analyzer focused on security purposes.
• Parse: A static scanning tool to review code for potential security issues.
• SonarPHP: An extension for the SonarQube platform supporting up to PHP 8 with 200+ rules.
• Snyk Code: Provides PHP support (currently in beta).

docker pull guardrails/phpcs-security-audit

Access authoritative documentation and educational resources to build secure PHP software:

• Official PHP Security Manual: The primary source for PHP security documentation.
• Survive The Deep End: PHP Security: An educational resource for deep-diving into security.
• Security Tips for a PHP Application: Practical advice for application developers.
• The 2018 Guide to Building Secure PHP Software: A comprehensive guide by Paragon Initiative Enterprises.

To improve the security of your PHP web environment, consider using specialized hardening tools:

• Snuffleupagus: A security module for PHP 7/8, designed as the successor to Suhosin.
• Secure-Headers: A tool to add security-related headers to your HTTP responses.