Security
Security is built into the code. This page lists what is protected for you and what you must do on your server.
Built in
| Protection | How it works |
|---|---|
| CSRF tokens | Every form of the website and of the admin carries a token; forms without a valid token are refused. |
| SQL injection | All queries use prepared statements with bound parameters. |
| Passwords | Stored with PHP password_hash(); never in plain text. |
| Login throttling | Admin logins are blocked after repeated failures; website logins, registrations, contact and AI requests are rate-limited per session and per IP address. |
| Uploads | Only real images are accepted, re-encoded as JPEG or PNG (this removes hidden code) and stored with generated names. .htaccess files forbid running scripts in the upload folders. |
| HTML from users | Descriptions are filtered to a short list of safe tags without attributes. Output is escaped everywhere else. |
| Payments | Amounts come from the database; Stripe and PayPal payments are verified with the provider; webhook signatures are checked. |
| Access control | Admin pages check the permissions of the group; users can edit only their own cars and bookings. |
| Spam | Hidden honeypot fields and rate limits on registration, contact and booking forms. |
Your checklist
- Delete the
installfolder and change the default administrator password. - Set
$DEBUG_MODE=falseinconfig.php. - Use HTTPS and keep PHP updated.
- Use a database user that has rights only on the script's database.
- Make sure
config.phpis not readable by other users of the server (permission 640 or 600 where possible). - Remove demo users and demo content before going live.
- Back up the database and the upload folders regularly (Backup and moving to another server).
Last updated