Advertisement
PHPImplement reCAPTCHA properly in PHP — server-side token verification, handling v3 scores, why the checkbox alone protects nothing, plus privacy-friendly alternatives like Cloudflare Turnstile and hCaptcha.
PHPImplement Login with Facebook the current way — the Authorization Code flow with a state parameter, server-side token exchange, storing users safely, and the account-linking rule that stops Facebook login becoming account takeover.
PHPSet, read, update and delete cookies in PHP using the modern array syntax — with SameSite, Secure and HttpOnly explained, the __Host- prefix, signing values against tampering, and where third-party cookie deprecation leaves you.
PHPHow PHP sessions really work — preventing session fixation and hijacking, the cookie settings that matter, why session_write_close() fixes slow concurrent requests, and the three-step logout most tutorials get wrong.
PHPImplement social login correctly using the Authorization Code flow with PKCE — the state parameter that prevents CSRF, why the implicit flow is deprecated, popup vs redirect handling, and the account-linking mistake that lets attackers take over accounts.
PHPIntegrate Stripe with PHP the way it works today — Checkout Sessions and Payment Intents, why raw card fields put you in PCI SAQ D scope, handling Strong Customer Authentication, and confirming payments with webhooks rather than the redirect.
PHPRaise PHP's upload limit properly — which method works for mod_php, PHP-FPM and CGI, the five directives that all have to agree, the nginx setting nobody mentions, and why ini_set() can never change upload_max_filesize.
PHPIPN is deprecated. Here is how to receive and verify PayPal payment notifications with Webhooks in PHP — signature verification, idempotency, sandbox testing, and why you must never trust the browser redirect to confirm a payment.
PHPBuild an RSS 2.0 feed in PHP that actually validates — correct XML escaping so one ampersand cannot break the whole document, stable GUIDs, the self-referencing Atom link validators require, and conditional GET support.
PHPIP geolocation in PHP done properly — why unserialize() on a remote response is a remote code execution risk, how to get the real client IP behind a proxy or CDN, plus caching, accuracy limits and GDPR.
PHPBuild a registration and login form using native HTML validation and the Constraint Validation API, with a PHP backend that hashes passwords correctly, prevents user enumeration, and defends against CSRF and session fixation.
Join 500+ engineering leaders who get our monthly insights on building great software.
