Stop Making These PHP REST API Mistakes
Key Takeaways
- ✓Always use prepared statements — SQL injection remains the top PHP vulnerability
- ✓Use === instead of == to avoid PHP's counterintuitive type juggling behavior
- ✓Hash passwords with password_hash(PASSWORD_ARGON2ID), never MD5 or SHA1
- ✓Keep controllers thin and move business logic into dedicated service classes
Not Using Prepared Statements
<?php
// DANGEROUS: SQL injection vulnerability
$sql = "SELECT * FROM users WHERE email = '$email'";
$result = $pdo->query($sql);
// SAFE: Prepared statement with parameter binding
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email');
$stmt->execute(['email' => $email]);
$result = $stmt->fetch();Using == Instead of ===
Ignoring PHP Error Levels
Think Your Code Is Clean? Let NexusBro QA It in 20 Seconds.
Paste your code. Click QA. Get an instant expert-level audit with fixes.
QA My Code FreeNot Hashing Passwords Properly
<?php
// WRONG: Never use these for passwords
$hash = md5($password);
$hash = sha256($password);
$hash = hash('sha256', $password . $salt);
// CORRECT: Use password_hash
$hash = password_hash($password, PASSWORD_ARGON2ID);
// Verify on login
if (password_verify($inputPassword, $storedHash)) {
// Check if rehash needed
if (password_needs_rehash($storedHash, PASSWORD_ARGON2ID)) {
$newHash = password_hash($inputPassword, PASSWORD_ARGON2ID);
updateUserHash($userId, $newHash);
}
}Fat Controllers, Thin Models
Ignoring Composer Autoloading
Unlock Unlimited QA Audits for $15.99/mo
Free: 5 audits/day. Pro $15.99/mo: 50/day + 250 pages. Pro Max $99/mo: unlimited audits, 10K pages, API access.
See PlansFrequently Asked Questions
What is the most dangerous PHP REST API mistake?
SQL injection from concatenating user input into queries. Despite decades of awareness, it remains the most exploited vulnerability in PHP applications. Always use prepared statements with parameter binding. No exceptions, no shortcuts.
How can I catch PHP REST API mistakes before production?
Use a layered defense: strict_types catches type errors, PHPStan catches logic errors through static analysis, PHPUnit catches behavioral bugs through testing, and code review catches design issues. Each layer catches different types of mistakes. CI should run all of these on every pull request.
Are PHP REST API mistakes more common than in other languages?
PHP's permissive defaults (loose comparison, implicit type coercion, suppressed errors) create more opportunities for subtle mistakes. However, modern PHP with strict_types, type declarations, and static analysis is comparable to other languages in safety. The key is opting into strict mode consistently.
How do I fix PHP REST API mistakes in legacy code?
Prioritize security fixes first (SQL injection, XSS, password hashing). Then add strict_types to files you modify. Introduce PHPStan at baseline level and fix new violations. Add tests before refactoring to ensure behavior is preserved. Use rector for automated modernization. Fix incrementally, not all at once.
How do I prevent my team from making PHP REST API mistakes?
Automate detection: CI checks for common vulnerabilities, PHPStan for type errors, and PHP-CS-Fixer for style. Create project templates with secure defaults. Conduct security-focused code reviews. Share this common mistakes guide during onboarding. Make the right way the easy way.
Related Articles
Unlock Unlimited QA Audits for $15.99/mo
Free: 5 audits/day. Pro $15.99/mo: 50/day + 250 pages. Pro Max $99/mo: unlimited audits, 10K pages, API access.
See PlansNoizz helps you discover and compare the best new products and tools. Try it free →
Is your site built to last?
Run a free QA audit and get your Site Health Score in seconds.
Check Your Site FreeNo signup required