security-review

name	security-review
description	PHP security review and vulnerability scanning guide. Use for code review, security audits, and fixing vulnerabilities in PHP applications.
allowed-tools	Read, Grep, Glob, Bash

PHP Security Review Skill

This skill guides security review and vulnerability scanning for PHP applications.

Quick Scanning

Composer Audit

composer audit                           # Check known vulnerabilities
composer audit --format=json             # JSON output

Static Analysis

./vendor/bin/phpstan analyse             # PHPStan (if configured)

Security Checklist

1. Input Validation

• All user input sanitized before use
• Database queries use prepared statements / parameterized queries
• No raw SQL string concatenation with user input
• File uploads validated (type, size, extension)

2. Output Encoding

• HTML escaped: htmlspecialchars($data, ENT_QUOTES, 'UTF-8')
• URL encoded when building URLs with user data
• JSON encoded with json_encode() for API responses
• No direct echo/print of user-controlled data

3. Access Control

• Authentication checks on protected endpoints
• Authorization verified for resource access
• Admin functions properly protected
• Role/permission checks where needed

4. Authentication & Sessions

• password_hash() / password_verify() for passwords
• Session management via framework (not custom)
• CSRF token protection on state-changing requests
• Login attempt rate limiting

5. Secrets Management

• No hardcoded credentials in source code
• API keys in environment variables or config files outside repo
• .env files not committed to version control
• Secrets directories in .gitignore

6. Dependencies

• composer audit clean
• No deprecated packages with known vulnerabilities
• Latest security patches applied

Dangerous Patterns

SQL Injection

// BAD - Direct concatenation
$query = "SELECT * FROM users WHERE name = '" . $name . "'";

// GOOD - PDO Prepared statements
$stmt = $pdo->prepare("SELECT * FROM users WHERE name = :name");
$stmt->execute(['name' => $name]);

XSS (Cross-Site Scripting)

// BAD - Unescaped output
echo $user_input;

// GOOD - Escaped
echo htmlspecialchars($user_input, ENT_QUOTES, 'UTF-8');

Command Injection

// BAD - Direct shell execution
exec("ls " . $user_input);

// GOOD - Escaped argument
exec("ls " . escapeshellarg($user_input));
// Better: Use PHP functions instead of shell commands

Path Traversal

// BAD - Direct path from user input
file_get_contents($user_path);

// GOOD - Validate path is within allowed directory
$real_path = realpath($user_path);
// PHP 8.0+: str_starts_with($real_path, $allowed_directory)
// PHP 7.x:  strpos($real_path, $allowed_directory) === 0
if ($real_path && str_starts_with($real_path, $allowed_directory)) {
    file_get_contents($real_path);
}

Insecure Deserialization

// BAD - Unserialize user data
$data = unserialize($user_input);

// GOOD - Use JSON instead
$data = json_decode($user_input, true);
// Or restrict allowed classes
$data = unserialize($input, ['allowed_classes' => [SafeClass::class]]);

Code Review Process

1. Identify entry points: Forms, APIs, URL parameters, file uploads
2. Trace data flow: Input -> Processing -> Output
3. Check sanitization: At both input and output points
4. Verify access control: Authentication and authorization
5. Review dependencies: Third-party code vulnerabilities
6. Test edge cases: Empty, null, special characters, boundary values

Reporting

When reporting issues, include:

• Severity: Critical/High/Medium/Low
• Location: File path and line number
• Description: What the vulnerability is
• Impact: What could happen if exploited
• Remediation: How to fix it

Resources

• OWASP Top 10: https://owasp.org/Top10/
• PHP Security: https://www.php.net/manual/en/security.php
• CWE/SANS Top 25: https://cwe.mitre.org/top25/