Security

R

PHP Advanced

Rate Limiting Login Attempts Without Locking Anyone Out

Unlimited password guesses is a breach schedule; hard lockouts are a denial-of-service gift. The middle path: counting failures per account AND per IP, with exponential delays.

May 22, 2026 3 min 278 Read →

C

PHP Advanced

CSRF Protection from Scratch: What the Frameworks Are Doing for You

A hidden token, a session comparison, a header for AJAX - the whole defense is 30 lines of PHP and JS. Build it once by hand and framework CSRF errors stop being mysterious.

May 18, 2026 2 min 198 Read →

P

PHP Advanced

Protected Downloads That Don't Melt PHP: X-Sendfile and X-Accel-Redirect

Streaming big files through readfile ties up a PHP worker per download. The offload headers let PHP do the auth check, then hand the actual bytes back to the web server.

Apr 2, 2026 2 min 535 Read →

S

PHP Intermediate

SameSite, HttpOnly and the __Host- Prefix: Cookies Done Properly

The options-array setcookie signature made secure cookies writable in one call - and the __Host- name prefix gets the browser itself to enforce your security flags.

Mar 20, 2026 3 min 738 Read →

Y

PHP Intermediate

Your LIKE Search Has a Wildcard Injection Bug

Prepared statements stop SQL injection - but % and _ sail straight through into LIKE patterns, letting users dump whole tables or run pathological scans. The fix is three characters of escaping.

Mar 11, 2026 2 min 396 Read →

A

PHP Intermediate

array_intersect_key: The Input Whitelist Hiding in the Standard Library

Mass-assignment bugs happen when request data flows unfiltered into updates. Two array functions - intersect_key and diff_key - are the terse, auditable filter.

Feb 8, 2026 2 min 490 Read →

S

JavaScript Beginner

Stop Using Math.random() for IDs: crypto.randomUUID()

Math.random-based IDs collide more than you think and are predictable by design. The browser ships a real UUID generator and a cryptographic random source - both one-liners.

Feb 26, 2025 2 min 3,018 Read →

T

PHP Advanced

The Timing Attack Hiding in Your Token Comparison

Comparing secrets with === leaks how many leading characters matched, one microsecond at a time. hash_equals exists for exactly this, and knowing when to use it is the whole trick.

Oct 22, 2024 2 min 1,326 Read →

N

PHP Intermediate

Never Trust a File Extension: Real MIME Detection in PHP

A PHP script renamed to photo.jpg sails past extension checks. finfo reads the actual bytes. Here is the upload validation layer cake that actually holds.

Oct 16, 2024 2 min 1,913 Read →

T

JavaScript Advanced

Tagged Template Literals: The Feature Behind Every html`` You've Seen

That html`...` syntax in lit and friends is not magic - it is a plain JavaScript feature you can use to build an XSS-safe HTML helper in fifteen lines.

May 16, 2024 2 min 2,401 Read →