But from Part 3 onwards things start to get a little more interesting. You cover Validating User Input first and then a whole host of what I consider the "regulars" such as Preventing Cross-Site Scripting, SQL Injections, Remote Execution and Session Hijacking.

Part 4 puts most of the previous theories into practise as you work through common security situations such as: "Allowing only human users", the verification of them, user roles and actions and user accountability. If you were to implement every recommendation from these chapters you could easily build up a formidable (and secure) php user management system. Considering this is the heart of nearly all web apps, this is no bad thing. The rest of the book is finished off with 4 chapters back in the more general land of security, covering "Preventing Data Loss", "Safely Executing System Commands", "Handling Remote Procedure Calls Safely" and finally "Taking Advantage of Peer Review".

If you tend to code and deploy into a secured environment, i.e. you already have a good system administrator or a managed hosting solution, then large chunks of this book won't be directly relevant to you. There is never any harm in understanding what precautions a sys admin has to go through, indeed I've heard it said that you cannot write a truly secure application unless you realise its implications across the entire server, irrespective of if you're responsible for the server or not.

The book is well presented, factual and the tone of writing is perfectly balanced and not too dry or ad-hoc. Given the rapidly increasing range of PHP related security books I'd have to say that if you want the bigger overall picture, it's worth looking at. Otherwise I'd probably direct you more towards Ilia's Guide to PHP Security.