SecurityJan 2026 · 12 min read

10 PHP security mistakes we see in legacy codebases

SQL injection is obvious. But most of the bugs we fix are subtler — and more dangerous.

After auditing dozens of legacy PHP codebases, we keep seeing the same ten security mistakes. SQL injection via string concatenation. Direct $_GET use without filtering. CSRF tokens that aren't actually validated. Session fixation. File upload without MIME checking. Each one is fixable, but only if you know it's there. Here's how to find and fix them…

Need help with something like this?

We do this every week. Tell us about your project — reply within 24 hours.

Get a free quote
10 PHP security mistakes we see in legacy codebases — Kedaya Tech LLP — Kedaya Tech LLP