I'm learning PHP and I'm working on a project , and i need to make it secure so
i use CSRF token
htmlspecialchar() for XSS
i do a time out
a make a functions against brute force attack
and i set some cockies

 0,
        'path' => '/',
        'secure' => true,
        'httponly' => false, //true for HTTPS!!!!!!!
        'samesite' => 'lax'
    ]);
?>

is there anything else should i add for security part