Skip to content
academia.sh
tr
Log in

Course Intermediate

PHP on the Web: State, Data and Security

Published Updated

By the end of this course

Start course

01

State and Sessions

Cookies, sessions, configuration and environment variables — the mechanisms that decide which part of the state carried between requests lives on the client, which on the server and which in the deployment environment.

  1. 01 Cookies How the cookie carries state on the client between requests, through the Set-Cookie header and its signed form; the four parties that classify who can change a result, and the ten-result measurement.
  2. 02 Sessions The session mechanism that keeps state on the server: the ID in the session cookie, $_SESSION, session_regenerate_id(true), and the limit set by the party that carries the ID.
  3. 03 Configuration and Environment Variables Separating deployment-dependent values such as the connection name and the key from the code and reading them from environment variables; the explicit error on a missing variable and the cost of a value fixed in code.

02

Data Access

The database access layer, transactions, migration management, the queries behind object–relational mapping, data formats and the HTTP client — at every point where the application reads and writes data, whether the result is decided by the code, the environment or an outside party.

  1. 01 The Database Access Layer Sets up a PDO connection, the error mode, prepared statements, named and positional placeholders and fetch modes; when a connection option comes from the environment, measures who can change the type of the returned value.
  2. 02 Transactions Runs a transfer between two accounts with and without a transaction; when the second write fails, measures who can change the balance total, and shows what a transaction without a rollback call does not protect.
  3. 03 Migration Management Builds migration files, a migration log table, ordered application and rollback in a small mechanism; measures that the database state decides how many migrations are applied in a run, while the code decides the schema version.
  4. 04 Queries Behind Object–Relational Mapping Counts the queries sent while a list is printed with a counter; measures that the query count grows with the rows in lazy loading, stays at two in eager loading, and that the query text can still change with the data sent.
  5. 05 Data Formats Parses JSON, XML and CSV text from a partner; measures who can change the result when the partner writes the same field differently, and shows whose choice the number notation in our own response is.
  6. 06 The HTTP Client Builds an HTTP client from request and response objects, a transport closure, a timeout exception, retry and a fallback value; measures how the price reported by the service and these defenses change who owns the result.

03

Security

Input validation and sanitization, SQL injection, cross-site scripting, request forgery, password storage and authentication flows — each as a defense that takes a result out of the hands of the client or a third party and moves it to the server.

  1. 01 Input Validation and Sanitization Narrowing a client input to the valid set with filter_var(), and measuring that validation and sanitization are separate steps and that validation does not take the power to change the value away from the client.
  2. 02 Preventing SQL Injection Measuring the parameterized query that separates the query text from the client's value: the same query changes with the value under concatenation, does not change with a prepared statement, and binding does not work everywhere.
  3. 03 Preventing Cross-Site Scripting Measuring how escaping narrows the result when text from a user is printed onto a page, escaping by context and double escaping; escaping does not change the owner.
  4. 04 Request Forgery Protection Telling apart whether a request was made by the user's own application or by another site with a request forgery token, the measured effect of the token, and the limit of the SameSite cookie attribute.
  5. 05 Password Storage Measuring that a password is stored as a hash, that a different salt gives a different hash for the same password, the cost parameter, and rehashing at login; the default cost is in the environment's hands.
  6. 06 Authentication Flows Measuring the identity of a request in the session-based and the bearer-token flow, seeing what a signature protects and what it does not, and gathering the fifteen lessons of the course into one table.

Final exam

PHP on the Web: State, Data and Security — Final Exam

In preparation

This course's question bank is not complete yet. The exam opens here automatically once enough questions are added.

Start typing to search.

↑↓ ↵ Esc navigate · open · close