PHP Restaurant MarketplaceUser Manual
Visit PHP Restaurant Marketplace →
Reference

Security best practices

A marketplace handles customers' data and money, so security is part of the design.

Built into the script

  • Prepared statements for all database queries - protection against SQL injection.
  • Hashed passwords (password_hash) for administrators, owners and customers.
  • CSRF tokens on forms of the website and the owner panel, and secure session cookies (HttpOnly, SameSite).
  • Login throttling - repeated failed logins lock the session for 10 minutes.
  • Uploads are accepted only as images, resized and re-encoded with GD, and the upload folders do not execute scripts.
  • Sanitised HTML in descriptions and articles that restaurants write.
  • Verified payments - the script asks Stripe or PayPal whether a payment succeeded and never trusts the return address; Stripe webhooks are checked with the signing secret.
  • Private order links with a long secret token.
  • Permissions for administrators by group.
  • Card details are entered on the payment provider's pages and never reach your server.

Your checklist

  1. Use HTTPS on the whole site (free certificates are available from most hosts). Rename ADMIN/_.htaccess to force HTTPS in the admin panel.
  2. Delete install.php.
  3. Change the default administrator password and the demo logins.
  4. Remove the demo restaurants and demo users before going live.
  5. Set $DEBUG_MODE=false in config.php in production so errors are not shown to visitors.
  6. Keep PHP updated and back up the database regularly.
  7. Use the live Stripe and PayPal keys only on HTTPS and keep test and live keys apart.

Last updated