跳到正文
cccskills
免费在 GitHub 公开

php-security

PHP-only security standards for database access, password handling, and input validation. Use when securing PHP apps against SQL injection, XSS, or weak password storage; defer Laravel middleware and security questions in other languages.

中文简介正在准备中。当前显示原文说明。

实测评分 未实测

查看安装方法

包含的文件(3)

  • SKILL.md2.4 KB
  • evals/evals.json3.5 KB
  • references/implementation.md674 B

SKILL.md(原文)

安装前可以查看交给 AI 代理的指令内容。

PHP Security

Priority: P0 (CRITICAL)

Structure

src/
└── Security/
    ├── Validators/
    └── Auth/

Implementation Guidelines

  • Prepared Statements: Use PDO with Parameterized Queries: $stmt = $pdo->prepare('SELECT * FROM users WHERE id = :id'); $stmt->execute([':id' => $id]);. NEVER concatenate user input into SQL strings.
  • Password Hashing: ALWAYS use password_hash() with PASSWORD_ARGON2ID (PHP 7.4+) or PASSWORD_BCRYPT.
  • Auth Verification: Use password_verify(). Use password_needs_rehash() to upgrade legacy hashes. Implement Rate Limiting and MFA where appropriate.
  • XSS Escaping: Use htmlentities($userInput, ENT_QUOTES | ENT_HTML5, 'UTF-8') or htmlspecialchars() on all user output. Prefer Twig or Blade for auto-escaping.
  • CSRF Protection: Mandate CSRF tokens for all state-changing requests (POST, PUT, PATCH, DELETE).
  • Input Validation: Use filter_var($email, FILTER_VALIDATE_EMAIL) or filter_var($url, FILTER_VALIDATE_URL). Always Whitelist allowed values.
  • File Security: RESTRICT file uploads by MIME type and extension. Store uploads outside public root.
  • Session Safety: Configure session.cookie_httponly = 1, session.cookie_secure = 1, and session.samesite = "Lax".
  • Header Security: Enforce Content-Security-Policy (CSP), X-Frame-Options: DENY, and X-Content-Type-Options: nosniff.

Anti-Patterns

  • No SQL string concatenation: Use PDO prepared statements only.
  • No MD5/SHA1 for passwords: Use password_hash($password, PASSWORD_ARGON2ID).
  • No raw $_GET/$_POST: Validate all input with filter_var() first.
  • No production error display: Log to file; never show to users.

References

评价

还没有评价。欢迎分享你的使用感受。

评论

无需登录即可发表。欢迎分享使用感受、提问,或说明在哪些环境下无法运行。

还没有评论。来写第一条吧。

提交后会立即公开。请勿填写邮箱、电话等个人信息。URL 最多 2 个。

0 / 1000 字

此表单受 reCAPTCHA 保护,适用 Google 的隐私权政策和服务条款。

同一仓库的技能

Upgrade an Android project to Android Gradle Plugin (AGP) 9. Use when migrating to AGP 9, updating Gradle build files, migrating to built-in Kotlin, or adopting the new AGP DSL.

中文简介正在准备中。当前显示原文说明。

HoangNguyen0403/agent-skills-standard5812026年10月22日 更新

Apply Clean Architecture layering, modularization, and Unidirectional Data Flow in Android projects. Use when setting up project structure, placing code in layers, configuring feature/core modules, or implementing UDF patterns; defer Compose state and ViewModel/StateFlow implementation to their specific skills.

中文简介正在准备中。当前显示原文说明。

HoangNguyen0403/agent-skills-standard5812026年10月22日 更新

Implement WorkManager and background processing correctly on Android. Use when creating Worker classes, scheduling tasks, choosing between WorkManager and Foreground Services, or setting up Hilt in workers; defer FCM and notification delivery to android-notifications.

中文简介正在准备中。当前显示原文说明。

HoangNguyen0403/agent-skills-standard5812026年10月22日 更新

Build high-performance declarative UI with Jetpack Compose. Use when writing Composable functions, optimizing recomposition, hoisting state, or working with LazyColumn and side effects; defer deep-link and navigation routing to android-navigation.

中文简介正在准备中。当前显示原文说明。

HoangNguyen0403/agent-skills-standard5812026年10月22日 更新

Migrate an Android XML View to Jetpack Compose following a structured 10-step workflow. Use when converting XML layouts to Compose, setting up Compose in an existing View-based project, or incrementally adopting Compose.

中文简介正在准备中。当前显示原文说明。

HoangNguyen0403/agent-skills-standard5812026年10月22日 更新

Write correct coroutine scopes, lifecycle collection, and dispatcher injection in Android production code. Use for suspend functions, coroutine scopes, and dispatcher mechanics; defer ViewModel StateFlow/LiveData architecture, Fragment lifecycle recipes, persistence/notifications, and unit-test recipes to their specific skills.

中文简介正在准备中。当前显示原文说明。

HoangNguyen0403/agent-skills-standard5812026年10月22日 更新

查看 HoangNguyen0403 的全部技能

报告此技能的问题