The whole category in one page.
RUN A SUPPORTED PHP VERSION AND A SUPPORTED FRAMEWORK VERSION
Unsupported versions receive no security fixes, which is a standing vulnerability regardless of your code.
THE THREE RULES THAT PREVENT MOST VULNERABILITIES
Parameterise every query. Escape everything displayed. Never disable request protection to make something work.
And check the signed-in user is entitled to the record they named — that omission is the most common serious fault in custom applications.
IN PRODUCTION
Debug off, errors logged and never displayed, configuration outside the web root.
Debug mode left on exposes credentials in error pages.
ON CPANEL
Application outside the served directory, public contents in it, entry point paths adjusted.
Then try requesting your configuration file in a browser. It must not be served.
Database and user names carry your account prefix, and the terminal's PHP version may differ from the one serving your site.
THE MOST COMMON DEPLOYMENT REPORT
Changes not taking effect, because configuration and routes are cached.
THE MOST COMMON PERFORMANCE FAULT
Accessing a relationship inside a loop, issuing one query per record. It works with three records and collapses with three hundred.
ONLY STORAGE NEEDS TO BE WRITABLE
Never broaden permissions to clear an error.
