The summary.
RUN A SUPPORTED VERSION
Unsupported versions receive no security fixes, which is a standing vulnerability regardless of your code.
Check your application's requirements, test on a copy, and be ready to revert.
EACH REQUEST STARTS FRESH
Nothing persists unless you store it. That makes applications simple to reason about, and makes loading less and caching what is expensive matter considerably.
USE STRICT COMPARISON AND DECLARE STRICT TYPES
PHP converts between types willingly, which turns a class of bugs silent. Strict typing makes them visible.
USE THE MULTI-BYTE STRING FUNCTIONS FOR USER CONTENT
The basic ones mishandle accented and non-Latin characters.
NEVER BUILD MARKUP OR QUERIES BY JOINING STRINGS WITH USER INPUT
That single habit is the root of the two most common vulnerabilities in PHP applications.
IN PRODUCTION, DISPLAY NO ERRORS AND LOG EVERYTHING
Errors shown to visitors reveal paths, versions and sometimes credentials.
Never use the suppression operator — it hides the problem and prevents diagnosis.
COMMIT BOTH COMPOSER FILES, NOT THE DEPENDENCIES DIRECTORY
The lock file guarantees the same versions everywhere.
