Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Build a small data-driven web app in modern, typed PHP 8 (a guestbook, a task list, a simple blog). Use declare(strict_types=1) and typed functions; structure code with Composer + PSR-4 autoloading (not a pile of include statements). Persist data with PDO and PREPARED STATEMENTS (never concatenate user input into SQL). Apply the security basics: escape all output with htmlspecialchars() to prevent XSS, and if you have login, hash passwords with password_hash()/password_verify() (never md5). Keep display_errors off for the 'production' config.
PDO with prepared/bound statements throughout — no string-built SQL; correct CRUD.
Output escaped with htmlspecialchars (XSS); any passwords use password_hash/verify (not md5); errors not leaked.
strict_types + typed functions; Composer/PSR-4 autoloading; not legacy spaghetti.
Runs and does the CRUD correctly end-to-end.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# A secure CRUD app in modern PHP ## Goal Build a small data-driven web app in modern, typed PHP 8 (a guestbook, a task list, a simple blog). Use declare(strict_types=1) and typed functions; structure code with Composer + PSR-4 autoloading (not a pile of include statements). Persist data with PDO and PREPARED STATEMENTS (never concatenate user input into SQL). Apply the security basics: escape all output with htmlspecialchars() to prevent XSS, and if you have login, hash passwords with password_hash()/password_verify() (never md5). Keep display_errors off for the 'production' config. ## Acceptance criteria - [ ] Safe data access: PDO with prepared/bound statements throughout — no string-built SQL; correct CRUD. - [ ] Security basics: Output escaped with htmlspecialchars (XSS); any passwords use password_hash/verify (not md5); errors not leaked. - [ ] Modern PHP: strict_types + typed functions; Composer/PSR-4 autoloading; not legacy spaghetti. - [ ] Works: Runs and does the CRUD correctly end-to-end. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.