Security Fundamentals

• SQL injection — always use PDO prepared statements (from Level 2), never string-concatenated queries.
• XSS (Cross-Site Scripting) — always htmlspecialchars() any user-supplied data before echoing it into HTML: echo htmlspecialchars($comment);
• CSRF (Cross-Site Request Forgery) — include a random, per-session token in every form and verify it on submit; frameworks like Laravel generate and check this automatically.
• Never trust $_POST/$_GET/$_COOKIE — validate and sanitize every value before using it, exactly as flagged back in Superglobals, Level 1.

Common mistakes

• Echoing user input directly into HTML without htmlspecialchars() — this is the single most common PHP XSS vulnerability, and one line fixes it in most cases.