# SCP - Writing Secure Code in PHP

![](/files/A1Tw4s7ZcTXv6OBNclL8)

PHP is one of the most famous languages in the world. Magento, WordPress, Drupal, and Joomla are written in PHP. Whether you are developing an extension for a blog or a complete e-commerce platform, knowing what vulnerable patterns look like is crucial for writing secure code. This course will guide you through different scenarios that will let you understand how attackers look at the code and applications.  We will look at vulnerabilities and remediations from a developer's point of view, equipping you with the right knowledge and tools to support you in each phase of the software development lifecycle. "SCP - Writing secure code in PHP" is a course for developers, security engineers, or professionals that want to improve their skills in PHP secure code reviews and vulnerability exploitation. The training is based on the OWASP standards such as the OWASP Top 10 2021 and the OWASP ASVS v4.

![IDOR vulnerability in PHP. Example from the course](/files/KAu5N4vO0JOhPFMHzHPA)

## Prerequisites

* Knowledge about PHP fundamentals
* Basic knowledge of Laravel
* Basic knowledge of SQL syntax 
* Interest in security 

## Target audience

* Security Engineers 
* Security Champions
* DevOps 
* Developers 

## Tools used 

* Any IDE
* Docker (docker-compose)
* Burp Suite Community edition
* Semgrep
* Coffee or Tea ☕️

## Syllabus

<table><thead><tr><th width="165.1926487040535">Module</th><th width="317.21642591684326">Topic</th><th>Details</th></tr></thead><tbody><tr><td><strong>The hacking mindset</strong></td><td></td><td></td></tr><tr><td></td><td>How attackers will look at your applications</td><td></td></tr><tr><td><strong>Secure coding introduction</strong></td><td></td><td></td></tr><tr><td></td><td>Secure coding principles</td><td></td></tr><tr><td></td><td>From SDLC to SSDLC</td><td></td></tr><tr><td></td><td>OWASP Top 10 2021</td><td></td></tr><tr><td></td><td>OWASP ASVS and security requirements</td><td></td></tr><tr><td></td><td>CVSS: how to rate vulnerabilities</td><td></td></tr><tr><td><strong>Exploiting the client side</strong> </td><td></td><td></td></tr><tr><td></td><td><strong>LAB:</strong> DOM Cross Site Scripting (XSS)</td><td></td></tr><tr><td></td><td><strong>LAB:</strong> Reflected Cross Site Scripting (XSS)</td><td></td></tr><tr><td></td><td><strong>LAB:</strong> Stored Cross Site Scripting (XSS)</td><td></td></tr><tr><td></td><td><strong>LAB:</strong> CORS misconfigurations</td><td></td></tr><tr><td></td><td><strong>LAB:</strong> Security Headers (Attacking CSP)</td><td></td></tr><tr><td></td><td><strong>LAB:</strong> Client side open redirect</td><td></td></tr><tr><td><strong>Authentication</strong> </td><td></td><td></td></tr><tr><td></td><td>Authentication Mechanisms in PHP and Laravel </td><td></td></tr><tr><td></td><td>Protecting routes</td><td></td></tr><tr><td><strong>Authorization and Access Control</strong></td><td></td><td></td></tr><tr><td></td><td><strong>LAB:</strong> Broken Access Control</td><td></td></tr><tr><td></td><td><strong>LAB:</strong> Type Juggling attacks on hashing functions</td><td></td></tr><tr><td></td><td><strong>LAB:</strong> Mass Assignment</td><td></td></tr><tr><td></td><td><strong>LAB:</strong> Insecure Direct Object Reference </td><td></td></tr><tr><td></td><td><strong>LAB:</strong> Path Traversal</td><td></td></tr><tr><td></td><td><strong>LAB</strong>: CSRF (Cross Site Request Forgery)</td><td></td></tr><tr><td><strong>Server Side Injections</strong></td><td></td><td></td></tr><tr><td></td><td><strong>LAB:</strong> SQL injections</td><td></td></tr><tr><td></td><td><strong>LAB:</strong> Command injection</td><td></td></tr><tr><td></td><td><strong>LAB:</strong> Code Injection</td><td></td></tr><tr><td></td><td><strong>LAB:</strong> XML External Entities</td><td></td></tr><tr><td></td><td><strong>LAB:</strong> Server-Side Request Forgery</td><td></td></tr><tr><td></td><td><strong>LAB:</strong> Server Side Template Injections in Twig</td><td></td></tr><tr><td><strong>Vulnerable and Outdated Components</strong></td><td></td><td></td></tr><tr><td></td><td>The importance of SCA (Static Component Analysis)</td><td></td></tr><tr><td></td><td><strong>LAB:</strong> Detecting known vulnerabilities using Snyk</td><td></td></tr><tr><td></td><td>Integrate SCA in the CI/CD pipeline</td><td></td></tr><tr><td></td><td>Detecting vulnerabilities in Laravel using SCA</td><td></td></tr><tr><td><strong>Scanning your code using Semgrep</strong></td><td></td><td></td></tr><tr><td></td><td>Semgrep basics</td><td></td></tr><tr><td></td><td><strong>LAB:</strong> Semgrep for PHP: How to write rules </td><td></td></tr><tr><td></td><td>Semgrep automation</td><td></td></tr></tbody></table>

## Why should you attend this course?&#x20;

This course will teach you the inside out of exploiting and securing PHP applications via real-life examples. If you are a PHP developer / DevOps this is the course for you.&#x20;

{% hint style="info" %}

### More info? Contact us at <trainings@dcodx.com>

{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://1337.dcodx.com/trainings/scp-writing-secure-code-in-php.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.