PHP Security Testing

When to use

• The user wants to write tests that assert authentication and authorization — who can reach an endpoint and who gets 401 or 403.
• The user wants to test that the app resists injection and malicious input — SQL injection, XSS payloads, path traversal, and other untrusted-input attacks.
• The user wants to assert security response codes and behavior — 401 unauthenticated, 403 forbidden, 429 rate-limited, and CSRF-token rejection.

When NOT to use