armourinfosec/Secure-PHP-Development: an open-source tool on GitHub for self-hosters

A one-month, lab-driven course on writing secure PHP and reviewing it like an attacker — from language fundamentals and modern PHP 8.2/8.3, through OOP, databases, and REST APIs, to a full OWASP-mapped catalogue of PHP vulnerabilities with exploit-then-fix labs. Build it correctly, then learn exactly how it breaks.

Curriculum home: Armour Infosec Vault

Course Information

[!NOTE] What this course is A study-and-practice track built as an Obsidian knowledge base. Each module is a folder with its own Readme hub and a set of deep-dive notes containing tagged, copy-ready PHP, SQL, and shell snippets. It is designed to be read in order but is fully cross-linked for reference use.

[!WARNING] Educational use only Every vulnerable code sample is clearly labelled (// VULNERABLE) and paired with a secure counterpart, and every exploitation walkthrough is documented at a study / detection / remediation level for use only on applications and environments you own or are explicitly authorized to test (your own lab, a CTF, an authorized engagement). Run the labs in a disposable local environment (php -S or Docker), never against systems you do not control.

Course Description

Master secure PHP development end to end: the language and modern PHP 8.2/8.3, the web request layer (superglobals, forms, validation, headers, file handling), object-orientation and MySQL access through PDO, professional tooling (Composer, PSR standards, architecture, testing, static analysis), and a full application-security track covering the OWASP Top 10 and PHP-specific vulnerabilities — authentication, cryptography, and REST APIs included.

The program is delivered through extensive, reproducible hands-on labs written from a defensive and offensive perspective, so every vulnerability class is paired with a working exploit and the secure, idiomatic PHP that fixes it.

Overview

The Secure PHP Development program provides practical, job-ready skills across modern PHP, application architecture, database access, and web application security. It assumes only basic programming familiarity and progresses to exploiting and remediating real vulnerabilities.

By the end of the course, students will be able to:

• Write clean, modern PHP 8.2/8.3 with declare(strict_types=1) and PSR-12 style
• Handle web input safely — superglobals, forms, validation, and file uploads
• Model data and query MySQL exclusively through PDO prepared statements
• Structure applications with OOP, SOLID, and common design patterns
• Manage dependencies with Composer and enforce quality with tests and static analysis
• Identify and exploit the OWASP Top 10 and PHP-specific vulnerabilities in a lab
• Remediate each vulnerability class with a secure, idiomatic PHP fix
• Build secure authentication — password hashing, sessions, MFA, and RBAC
• Apply cryptography correctly with libsodium (hashing, encryption, key management)
• Design and secure REST APIs with JWT, versioning, and rate limiting
• Profile, tune, and deploy hardened PHP behind PHP-FPM and a reverse proxy
• Automate testing, security gates, and deployment with CI/CD

[!TIP] Build it correctly, then break it Security is taught alongside development, not bolted on at the end. Each vulnerability is presented as an exploit-then-fix pair — you learn exactly how it breaks and the secure version that prevents it.

Learning Path

The 31 modules are sequenced into eight progressive stages. Complete each stage before advancing; later security and operations modules assume the fundamentals from earlier stages.

Stage 1  Fundamentals ......... Introduction · Dev Environment · First Steps · Data Types
Stage 2  Logic & Functions .... Control Structures · Functions & Scope
Stage 3  The Web Layer ........ Superglobals · Forms & Validation · Regex · Dynamic Pages
                                Headers · Encode/Decode · File Handling · Debugging
Stage 4  OOP & Databases ...... OOP · MySQL · PHP + MySQL (PDO)
Stage 5  Secure Baseline ...... Secure PHP Development Practices
Stage 6  Professional PHP ..... Modern PHP · Composer · PSR · Architecture · Testing · Static Analysis
Stage 7  Application Security . Security (OWASP) · Authentication · Cryptography · REST APIs
Stage 8  Operations ........... Performance · Deployment · CI/CD

flowchart LR
    A[Fundamentals] --> B[Logic & Functions]
    B --> C[The Web Layer]
    C --> D[OOP & Databases]
    D --> E[Secure Baseline]
    E --> F[Professional PHP]
    F --> G[Application Security]
    G --> H[Performance · Deployment · CI/CD]

[!IMPORTANT] Prerequisite chaining The Application Security stage (Stage 7) depends on the Secure Baseline (Stage 5) and OOP & Databases (Stage 4). Attempting the SQL-injection, object-injection, or authentication labs without PDO, sessions, and OOP will leave gaps in both the exploit and the fix.

Prerequisites

[!TIP] No PHP background needed The first two stages assume zero prior PHP. If you already write PHP, you can skim Stages 1–2 and start at The Web Layer or the Secure Baseline.

Software Requirements

[!WARNING] Run the vulnerability labs in isolation Every // VULNERABLE snippet is intentionally exploitable. Keep the labs on a disposable local environment — never expose them on a shared network or copy the vulnerable half into a real application.

Development Environment

The "lab" for this course is a local PHP + MySQL install (or a container). Later modules add a reverse proxy, PHP-FPM, and CI tooling.

# Check for an existing PHP install
php -v

# Debian / Ubuntu / Kali — PHP 8.3 + MySQL client + common extensions
sudo apt update
sudo apt install -y php php-cli php-mysql php-mbstring php-xml php-curl mariadb-server

# Composer (dependency manager)
php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
sudo php composer-setup.php --install-dir=/usr/local/bin --filename=composer

# Serve a project with PHP's built-in development server
php -S localhost:8000 -t public/

# Or run everything in disposable containers
docker compose up -d

[!TIP] Keep it disposable Use a throwaway local environment (the built-in server or a container) for the labs. Reset it freely — nothing here should touch a machine or database you rely on.

Course Modules

31 teaching modules grouped into eight progressive stages, each linking to the module's own Readme hub — plus the Labs, Mini-Projects, and Flashcards collections (below) for 34 folders total.

Stage 1 · Fundamentals

Stage 2 · Logic & Functions

Stage 3 · The Web Layer

Stage 4 · OOP & Databases

Stage 5 · Secure Baseline

Stage 6 · Professional PHP

Stage 7 · Application Security

Stage 8 · Operations

[!WARNING] Vulnerable code is always labelled In the security modules and labs, every intentionally insecure snippet is marked // VULNERABLE and immediately followed by its secure replacement. Study the pair — never ship the first half.

Hands-On Labs

20 exploit-then-fix labs — each self-contained (objective → prerequisites → walkthrough → exercises → challenge → solution → security discussion). Start at the Labs index.

Mini Projects

16 secure mini-projects & capstones — each a self-contained build that combines several modules into a working, hardened application. Start at the Mini-Projects index.

Flashcards

5 spaced-repetition decks of Q::A cards for exam-style revision across the course's core domains. Start at the Flashcards index.

Learning Outcomes

On completion, a student can:

Certification & Skills Alignment

This course's content is exam-relevant preparation and role-focused skill building — not a guarantee of passing any exam.

[!TIP] Best-fit target The security depth here maps most directly to secure-coding / AppSec developer competency and the OWASP Top 10; the language and OOP breadth additionally supports the ZCPE.

References

• The PHP Manual — https://www.php.net/manual/
• PHP: The Right Way — https://phptherightway.com/
• PHP-FIG (PSR Standards) — https://www.php-fig.org/psr/
• Composer Documentation — https://getcomposer.org/doc/
• OWASP Top 10 — https://owasp.org/www-project-top-ten/
• OWASP Cheat Sheet Series — https://cheatsheetseries.owasp.org/
• Paragon Initiative (PHP security) — https://paragonie.com/blog
• libsodium Documentation — https://doc.libsodium.org/
• PHPUnit Documentation — https://docs.phpunit.de/
• PHPStan Documentation — https://phpstan.org/user-guide/getting-started

Related Courses

Sibling courses in this vault that pair well with Secure PHP Development:

• Linux Administration & Server Hardening — administer and harden the Linux / Nginx / PHP-FPM stack these apps run on.
• Secure WordPress Administration — apply secure PHP practices to the world's most-attacked PHP CMS.
• Python for Security Professionals — scripting and automation beyond PHP.

See also the course hub Secure PHP Development.

Contribution

Contributions that improve accuracy, add labs, or deepen module notes are welcome.