Sample work · Code & Bugs
PHP: Contact form and protection against SQL injection and XSS
A contact form with storage and a vulnerable search page that I secured against SQL injection and XSS. The security test cases were red before, green afterwards.
Sample work (demo), not a client job. Built as a trial task with invented example data; the check figures below come from the automatic test run and are not polished.
What was built
- Contact form with input validation, protection against form abuse, and storage
- Search page previously with SQL injection and unprotected output, afterwards with prepared statement and escaped output
- Countercheck with intentionally broken versions: the security test cases trigger
- All files syntactically checked, diff for review
Download kontakt.php Download liste.php Download lib.php Download bugfix.diff
Without Laravel, Symfony, and Composer. Tested with the built-in PHP server and SQLite, not on Apache, nginx, or MySQL. The security test cases cover SQL injection, XSS, and CSRF and do not constitute a complete penetration test.
How it was checked
Automatic test run on 2026-11-01, taken from the log (test data invented, figures measured):
- php -l 5/5 error-free
- Contact 25/25 green
- List previously vulnerable: 6/6 security test cases red
- afterwards 11/11 green
- Countercheck 3/3 broken versions detected
Limits
What this sample does not cover, so nobody expects more:
- without Laravel / Symfony / Composer (frameworks and package management not approved): client projects requiring them need prior approval from the owner
- PHP 8.3 (NTS, built-in web server php -S) - no Apache/nginx/FPM, MySQL only via PDO code, not run (tested with SQLite)
- no work on the client's server without access; deliverable is source code + test verification
- security test case covers SQL injection, XSS, and CSRF - not a complete penetration test result
Something like this for your business?
Describe briefly what you need. You get a fixed price before I start; nothing happens without your yes.