Create a secure web application

As you know, everyone touch the web pages. Application are hard to secure.When it comes to security, remember that in addition to actual platform and operating system security issues, you need to ensure that you write your application to be secure. 


PHP programming mistakes that can result in security holes. By showing you what not to do, and how each particular flaw can be exploited, I hope that you’ll understand not just how to avoid these particular mistakes, but also why they result in security vulnerabilities. Understanding each possible flaw will help you avoid making the same mistakes in your PHP applications.

1. Validate Input
   We can not trust on user input so we need to validate input DATA( Client side as well server side) before saving the data in the database.
2. Register Global
   Register Global should be off in php_ini configuration file
3. Minimize hidden Input Fields
   Hidden fields in the form should be use as minimum as possible.
4. Database
   Your database related query should be protect mysql_injection.User password should be stored in md5 hash format.
5. Session Management
   After login the user session should be regenered to insure user is valid.
6. XSS Vulnerabilities
   To protect data against XSS attacks, filter your input through the htmlentities() function whenever the value of a variable is printed to the output. 
7. Valid Post
   To halt invalid post by the hacker, need to use one time form token. A form must have the token Id that is valid for only one time post data to the server.