This chapter introduces the common elements of a web application and how to configure them to your advantage.

Includes 2 lab exercises: Creating a Local Development Environment, and Practice Environment

This chapter introduces PHP7 and why you need to use it instead of PHP5.

Includes 8 lab exercises: Starting up a Virtual Machine, Installing Docker, Connecting to a VM with Visual Studio Code, Cloning the Example Project, Setting up phan and php7mar, Running Automated Tests, and Manual Checks

This chapter covers how to set up and secure a web server.

Includes 6 lab exercises: Starting up a Virtual Machine, Installing Docker, Connecting to a VM with Visual Studio Code, Setting up a docker-compose File, Finding Out Where PHP Loads Its Config Files From, and Configure PHP for Production

This chapter includes running PHP on modern serverless architectures.

Includes 9 lab exercises: Using VCS to Connect to the EC2 VM, Installing the AWS CLI, Creating an ECR repository and Building the Image to Push to ECR, Configuring the Service and Cluster, Viewing the Service, and Cleaning up

This chapter is about defining the security requirements of your system at the outset of the project.

Includes 6 lab exercises; Creating a Checklist, Advising the CTO on Your Level of Assurance, Performing Automated Scan, Updating Your Checklist, Creating a Tracking Document, Reflecting on the Experience

This chapter includes how to use existing security frameworks and libraries.

Includes 15 lab exercises: Connecting to VM, Setting up PHP Project, Adding the Dependency Container, Creating a Public Index File, Adding and Completing a Router Class, Adding the Dispatch Handler, Passing the Request to the Router, Stepping Through the Flow Process, Installing the OAuth2 Package, Setting up the Client Repository, and Adding the Scope Repository

This chapter covers securing access to a database.

Includes 5 lab exercises: Creating an RDS instance, Allowing Your EC2 Instance, Creating a MySQL User and a Laravel Project, and Connecting to MySQL Securely

This chapter introduces the principle of ‘filter input escape output.

Includes 9 lab exercises: Setting up a Project Dev Environment, Creating a Vulnerable HTML Page and a Script Vulnerable to SQL Injection, Adding a Log, Exploit Lack of HTML Escaping and SQL Escaping, and Attempt Log Poisoning

This chapter introduces the validation of input.

Includes 6 lab exercises: Setting up Dev Environment, Creating the Upload Form, Coding the Form Action Script, Validating the File, Scanning for Viruses, and Moving Uploaded File

This chapter covers authentication through implementing digital identity.

Includes 9 lab exercises: Preparing Dev Environment, Installing Google Authenticator, Setting up Laravel Installation and Enabling Authentication, Adding a Migration to Support 2FA, User Routes, and Controller Methods, Amending the Auth Controller, and Creating a Form Request

This chapter is about authorization through implementing access controls.

Includes 11 lab exercises: Creating a Dev Environment, Setting up PHP Project and Dependency Container, Staring the Main Index File and Route Handling Classes, Dispatching the Request in Main.php, Setting up Middleware, Adding and Configuring Authorization, and Using Roles

This chapter introduces the concept of protecting data everywhere.

Includes 6 lab exercises: Moving Control to Our Domain Nameserver to Cloudflare and Configuring It, Generating a Free HTTPS Certificate, Setting up a Private Webserver, Installing HAproxy and Setting up HTTPS Certificate, and Creating and Installing a Self-signed Certificate

This chapter introduces logging and monitoring security events.

Includes 6 lab exercises: Creating the Dev Environment, Setting up Docker Stack and Logstash, Setting up Laravel, Configuring Monolog, Adding Logging/ and Testing

This chapter covers error handling and exception management.

Includes 8 lab exercises: Preparing a Dev Environment, Creating an Example Application, Exposing Problems Using a Fuzzer, Configuring PHP to Log Errors and Creating a Central Error Handler, and Setting the Inputs to Some of the Problems.

This chapter introduces the OWASP top 10.

Includes 8 lab exercises: Setting up a Remote Dev Environment, Installing Java and OWASP ZAP, Restrict HTTP Access and Deploy DVWA to VM, Logging in to DVWA with ZAP, and Installing OWASP Juice Shop and Tools to VM