Agent skill
PHP Security
PHP security standards for database access, password handling, and input validation.
Install this agent skill to your Project
npx add-skill https://github.com/majiayu000/claude-skill-registry/tree/main/skills/other/other/security-hoangnguyen0403-agent-skills-standar-2
Metadata
Additional technical details for this skill
- labels
-
php security pdo hashing
- triggers
-
{ "files": [ "**/*.php" ], "keywords": [ "pdo", "password_hash", "htmlentities", "filter_var" ] }
SKILL.md
PHP Security
Priority: P0 (CRITICAL)
Structure
src/
└── Security/
├── Validators/
└── Auth/
Implementation Guidelines
- Prepared Statements: Use PDO exclusively. Never concatenate SQL.
- Type Binding: Apply
bindParam()with PDO constants. - Password Hashing: Use
password_hash()withPASSWORD_ARGON2ID. - Verify Securely: Use
password_verify()for all authentication. - XSS Escaping: Apply
htmlentities($data, ENT_QUOTES, 'UTF-8')to all user output. - Input Filtering: Use
filter_var()for types (email, URL, int). - CSRF Protection: Require tokens for all state-changing requests.
Anti-Patterns
- Raw SQL: No Concat: Never build queries with string concatenation.
- Weak Hashing: No MD5/SHA1: Use modern algorithms only.
- Trusting $_GET: No Raw Input: Always validate external data.
- Error Exposure: No Production Errors: Log errors; don't display them.
References
- Secure Implementation Patterns
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
Didn't find tool you were looking for?