Some security knowledge about PHP

Never display or send a password in clear text.
This should be true even for the owner of the password.
If you need a "forgot password" function, you can randomly generate a new one-time (important) password, and then send the password to the user

You want to accept a numeric parameter, you can use the Is_numeric () or ctype_digit () function to check it. Always limit your data to the scope of your run.

Remember not only to validate the $_post and $_get variables,
And don't let go of cookies, user-agent, and all the other data that's not directly generated by your code.

Some security knowledge about PHP