php - Best ways learn basic web security -

i'm 16 , lot of web design people. front end design apart occasional bit of php when handling forms. while know how manage basic sterilisation , validation, learn more intricate things user management , login systems. know way around js, mysql , php, etc... don't feel confident securing such systems. know there not 1 solve guide web security, wondering if knows helpful guides, resources, etc.... also, somewhere start.

what want learn about:

• setting , acquiring ssl certificates
• handling ssl certificates
• building secure login systems
• using cookies security purposes
• general php security
• sql security

my end goal able build sites users who's basic info can securely store (no payment details) in sql database. want able create user sign login , editing system. have created before not ssl. question how learn ssl?

could someone... - direct me guide. - direct me examples. - point me in right direction.

(examples big post) said quite broad question sorry (as hates people post questions this). open advice appreciated :)

edit: real question how learn how use ssl , set after i've bought certificate?

i'll add points know.

sql security - basic principle here, never trust user input, sanitize all. there numerous built-in functions so, example htmlentities , real escape string: mysqli, pdo, prepared statement.

using cookies security purposes - cookies point of failure, users can change cookies see fit. best way, use random string inside cookie identify user later on. example, generate 50 character random string, put cookie, make expire on time , store id sql, next time when user connects, can check have id inside sql , check user is. it's still unsafe, not unsafe leaving user_id's or worse, passwords inside cookies. using sessions safer, if need use cookies, that's way it.

building secure login systems - ssl 1 key here. password encryption. php, use password_hash hash password. best way keep passwords not being stolen / cracked, salt them. can, example, use aes encrypt password_hash random string key, know, can decrypt , verify passwords. also, 1 point here make sure, leave failed login counter on page, otherwise people might start flooding site many possible other passwords might work. enforce safe passwords not figured out (test123, password, pa55w0rd etc).

setting , acquiring ssl certificates - ssl certificate end user can accept without getting message ca not recognized, need buy ssl certificate, google one.