Secure Development & OWASP Top 10

Security should not be an afterthought, but integrated from the design phase (Security by Design). This guide covers secure coding practices based on the OWASP Top 10, the global standard for the most critical security risks in web applications.

A01: Broken Access Control

Occurs when users can access data or functions they shouldn't. The classic example is IDOR (Insecure Direct Object Reference).

// ❌ VULNERABLE: Blindly trusting user-supplied ID
$id = $_GET['id'];
$q = $pdo->query("SELECT * FROM invoices WHERE id = $id");

// ✅ SECURE: Validate ownership
$id = $_GET['id'];
$user_id = $_SESSION['user_id'];
$stmt = $pdo->prepare("SELECT * FROM invoices WHERE id = ? AND owner_id = ?");
$stmt->execute([$id, $user_id]);

A02: Cryptographic Failures

Insecure storage of sensitive data. Never use obsolete algorithms like MD5 or SHA1 for passwords.

// ❌ VULNERABLE: Fast hashing without Salt
$hash = md5($_POST['password']); 

// ✅ SECURE: Modern algorithms with automatic Salt (Bcrypt)
$hash = password_hash($_POST['password'], PASSWORD_DEFAULT);

A03: Injection

To prevent SQL Injection, the only 100% effective defense is Prepared Statements.

// ❌ VULNERABLE: Direct concatenation
$pdo->query("SELECT * FROM users WHERE email = '" . $_POST['email'] . "'");

// ✅ SECURE: Prepared statements
$stmt = $pdo->prepare("SELECT * FROM users WHERE email = :email");
$stmt->execute(['email' => $_POST['email']]);

A05: Security Misconfiguration

Default credentials, unnecessary services, or verbose error stack traces exposed in production.

# ❌ VULNERABLE (php.ini)
display_errors = On

# ✅ SECURE
display_errors = Off
log_errors = On

DevSecOps Integration (The Pipeline)

• Pre-Commit Hooks: Prevent secret leaks to Git (e.g., TruffleHog).
• SAST (Static Application Security Testing): Source code analysis (e.g., SonarQube, Semgrep).
• DAST (Dynamic Application Security Testing): Automated runtime attacks (e.g., OWASP ZAP).