Survive The Deep End: PHP Security. It's in draft.
https://github.com/padraic/phpsecurity.git
latest