Admu.
FR
Full-stack web2022

Wizanimes: a streaming platform, and its security review

My biggest high-school web project, reviewed with an attacker's eye: the attack surface of a real application, in miniature.

Period
Feb – May 2022
Stack
PHP · MySQL
Role
Solo, end to end
Angle
Security review

01The project

An anime streaming platform I built from scratch in PHP and MySQL in high school: sign-up and login, user profiles, and an admin panel to add series, artwork and video episodes.

Demo video

Project walkthrough (2022), the only full recording I still have
Admin panel menu
Admin panel
User management
User management
Artwork upload form
Artwork upload
Login page
Authentication

02Security review, four years later

This is the project that pushed me toward security: an app with accounts, sessions and file uploads is exactly the attack surface you meet in real audits. If I audited it today, here is my checklist:

  • SQL injection: do all queries go through prepared statements (PDO)?
  • File upload: type checked server-side (not just the extension), stored outside the web root, no way to execute a disguised .php.
  • Passwords: password_hash() / password_verify() instead of a fast hash.
  • Sessions: session_regenerate_id() after login, HttpOnly, Secure, SameSite cookies.
  • CSRF protection on admin actions, and server-side access control on every admin page.
  • XSS: systematic escaping (htmlspecialchars) of user-entered titles and descriptions.
This is not a completed audit: it's the checklist I would apply. Revisiting your own code with an attacker's eye is a great exercise.