Skip to content
SudoSecurity

Sections

Course

PHP Backend Engineering

Modern PHP 8.x backend craft without the framework crutch: FPM, Composer discipline, PDO, sessions, uploads, object injection, and shipping hardened, fast PHP.

9 lessons

Course Q&A

The Runtime and the Toolbox

PHP 8.x, FPM, opcache, and Composer: the pieces every backend decision sits on.

  1. 01Running PHP 8.x in Production: FPM, Opcache, and the Request LifecycleHow PHP actually executes requests, how to tune FPM workers, and why opcache is non-negotiable.25mOpen
  2. 02Composer Without the Hangover: Versions, Lock Files, and AutoloadingVersion constraints that mean what you think, lock-file discipline, PSR-4, and auditing deps.20mOpen
  3. 03Framework-Free HTTP: Front Controllers, Routing, and MiddlewareBuild clean request handling in plain PHP — and learn where frameworks' magic ends and trust boundaries begin.30mMembers

Handling Requests and State Safely

Routing, PDO, sessions, and uploads: the four places PHP apps earn their CVEs.

  1. 01PDO Done Right: Prepared Statements, Transactions, and InjectionServer-side prepares, identifier whitelists, transactions, and the second-order bugs that still ship.30mMembers
  2. 02Sessions, Cookies, and Auth State That Doesn't LeakCookie flags, session fixation, password hashing, and token comparison without timing leaks.25mMembers
  3. 03File Uploads Without the ShellsMIME sniffing, random filenames, outside-the-docroot storage, and why SVG is scriptable.25mMembers

Breaking It and Speeding It Up

Object injection, profiling, and a hardened deployment path for real traffic.

  1. 01Object Injection: unserialize(), Phar Metadata, and Gadget ChainsHow unserialize turns one call into RCE, why phar:// reaches it, and the flags that shut it down.30mPremium
  2. 02Making PHP Fast: Opcache Tuning, Profiling, and Real BottlenecksMeasure before optimizing: opcache stats, realpath cache, profilers, k6, and the N+1 bug.30mPremium
  3. 03Shipping PHP Safely: php.ini Hardening, Secrets, and DeploysThe production checklist: display_errors, dotfile leaks, env secrets, atomic releases, opcache resets.25mPremium