PHP Security Patterns

This covers the essential security patterns you need for PHP applications: input validation, SQL injection prevention, XSS protection, CSRF defense, secure password handling, session security, and file upload protection. It's from thebushidocollective's han repository, which has 165 stars and passes all three security audits. Use this when you're building PHP apps that handle user data, authentication, or payments. The defensive approach is solid, focusing on multiple layers rather than single solutions. Good fit if you want Claude to follow established security practices instead of reinventing protection mechanisms or making assumptions about what's safe in a PHP context.

GitHub stars: 187
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add thebushidocollective/han --skill 'PHP Security Patterns' --agent claude-code

Installs into .claude/skills of the current project.

Files

PHP Security Patterns

Introduction

Security is paramount in PHP applications as they often handle sensitive user data, authentication, and financial transactions. PHP's flexibility and dynamic nature create opportunities for vulnerabilities if security best practices aren't followed.

Common PHP security vulnerabilities include SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), insecure password storage, session hijacking, and file inclusion attacks. Each can lead to data breaches, unauthorized access, or complete system compromise.

This skill covers input validation and sanitization, SQL injection prevention, XSS protection, CSRF defense, secure password handling, session security, file upload security, and defense-in-depth strategies.

Input Validation and Sanitization

Input validation ensures data meets expected formats before processing, while sanitization removes or encodes potentially dangerous content.

<?php
declare(strict_types=1);

// Email validation
function validateEmail(string $email): bool {
    return filter_var($email, FILTER_VALIDATE_EMAIL) !== false;
}

SKILL.md on GitHub