如何建立PHP网站的安全检测机制？

$username = $_POST['username'];
$username = filter_var($username, FILTER_SANITIZE_STRING); // 过滤非法字符
if (!empty($username)) {
    // 处理已经过滤和验证过的用户名
} else {
    // 提示用户名不能为空
}

$username = $_POST['username'];
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");
$stmt->bindParam(':username', $username, PDO::PARAM_STR);
$stmt->execute();

$username = "John <script>alert('XSS');</script>";
echo htmlentities($username);
// 输出：John <script>alert(&#039;XSS&#039;);</script>

$allowedExtensions = ['jpg', 'jpeg', 'png', 'gif'];
$allowedSize = 2 * 1024 * 1024; // 2MB
$uploadDir = 'uploads/';

$fileName = $_FILES['file']['name'];
$fileExtension = strtolower(pathinfo($fileName, PATHINFO_EXTENSION));
$fileSize = $_FILES['file']['size'];
$fileTmpName = $_FILES['file']['tmp_name'];

if (in_array($fileExtension, $allowedExtensions) && $fileSize <= $allowedSize) {
    $newFileName = uniqid('', true) . '.' . $fileExtension;
    move_uploaded_file($fileTmpName, $uploadDir . $newFileName);
    echo '文件上传成功！';
} else {
    echo '文件格式不合法或文件过大！';
}

$password = 'password123';
$hashedPassword = password_hash($password, PASSWORD_DEFAULT);

$loginPassword = 'password123';
if (password_verify($loginPassword, $hashedPassword)) {
    echo '密码正确！';
} else {
    echo '密码错误！';
}