Executive Summary: Essential security patterns: PDO parameterized queries, HTML entity escaping, Content Security Policies (CSP), and SameSite cookie policies.
Application security must be designed into every line of code rather than patched after a security breach.
### 1. SQL Injection Prevention
Never concatenate user input directly into SQL strings. Always use PDO prepared statements with bound parameters:
```php
// WRONG (Vulnerable to SQLi):
DB::select("SELECT * FROM users WHERE email = '" . $input . "'");
// RIGHT (Safe Parameterized Query):
DB::select("SELECT * FROM users WHERE email = ?", [$input]);
```
### 2. Cross-Site Scripting (XSS) Prevention
Always escape HTML output when rendering user-submitted text (e() or {{ }} in Blade). Implement strict Content Security Policy (CSP) headers to block unauthorized script execution.
### 3. CSRF Protection
Enforce anti-CSRF token verification (@csrf) on all state-changing HTTP POST, PUT, and DELETE requests.