There's two words that are a sure way to send chills down a developer's spine: "legacy application". We've all dealt with legacy applications in one shape or form and some are even stuck with them as a full time job. While the code quality of legacy applications is always up for debate, the focus of this book is on taming the security in these apps.

Chances are that legacy PHP application you're working with wasn't written with security in mind. It might be a mish-mash of PHP files all included in a tangled web or it could be that it's just using an ancient version of a framework that hasn't seen an update in years. Regardless of the situation, I'll be guiding you through steps you can follow and topics to consider to help protect your application.

The book covers topics like:

• Determining risk
• Evaluating and updating access controls
• Effective input validation and output escaping
• Introducing new controls
• Templating for security
• Keeping security simple

While the illustrations will be predominantly in PHP, the theories behind each point will be shared first, making them applicable to any language. Securing legacy applications doesn't have to be as hard as you might think.