Prepared statements, password hashing, CSRF, validation and structure: five lessons from comparing a plain PHP news portal with Laravel.