diff --git a/composer.json b/composer.json
new file mode 100644
index 0000000..b79a567
--- /dev/null
+++ b/composer.json
@@ -0,0 +1,18 @@
+{
+    "name": "cacti/plugin_intropage",
+    "description": "plugin_intropage plugin for Cacti",
+    "license": "GPL-2.0-or-later",
+    "require-dev": {
+        "pestphp/pest": "^1.23"
+    },
+    "config": {
+        "allow-plugins": {
+            "pestphp/pest-plugin": true
+        }
+    },
+    "autoload-dev": {
+        "files": [
+            "tests/bootstrap.php"
+        ]
+    }
+}
diff --git a/include/functions.php b/include/functions.php
index 3025d83..4692b8c 100644
--- a/include/functions.php
+++ b/include/functions.php
@@ -811,7 +811,7 @@ function intropage_reload_panel() {
 		}
 
 		$name   = isset($data['name']) ? html_escape($data['name']) : __esc('Not Found', 'intropage');
-		$height = isset($panel['height']) ? $panel['height'] : 'normal';
+		$height = $panel['height'] ?? 'normal';
 		$alarm  = isset($data['alarm']) && $data['alarm'] !== '' ? $data['alarm'] : 'grey';
 
 		print '<div class="panel_header color_' . $alarm . '">';
@@ -986,7 +986,7 @@ function get_panel($panel_id, $user_id = 0) {
 		$refresh_interval = $panel['refresh_interval'];
 		$trend_interval   = $panel['trend_interval'];
 		$next_update      = $last_update + $refresh_interval - time();
-		$panel['height']  = isset($panel['height']) ? $panel['height'] : 'normal';
+		$panel['height']  = $panel['height'] ?? 'normal';
 
 		$panel['name']    = $definition['name'] . __(' [Upd. in %s/%s]', intropage_readable_interval($next_update), intropage_readable_interval($refresh_interval), 'intropage');
 	} else {
@@ -1665,7 +1665,7 @@ function intropage_create_panel($panel_id, $dashboard_id) {
 	} else {
 		$width = $panels[$panel_type]['width'];
 		// we need actual height from db not from panel definition
-		$height = isset($act_height) ? $act_height : 'normal';
+		$height = $act_height ?? 'normal';
 	}
 
 	if ($width == 'quarter-panel') {
@@ -1824,9 +1824,7 @@ function intropage_graph_button($data) {
 	if (is_panel_allowed('favourite_graph')) {
 		$local_graph_id = $data[1]['local_graph_id'];
 
-		if (!isset($_SESSION['sess_current_timespan'])) {
-			$_SESSION['sess_current_timespan'] = read_user_setting('default_timespan');
-		}
+		$_SESSION['sess_current_timespan'] ??= read_user_setting('default_timespan');
 
 		if ($_SESSION['sess_current_timespan'] == 0) { // zoom or custom timespan
 			$fav = '<i class="fa fa-eye-slash" title="' . __esc('Cannot add to Dashboard. Custom timespan.', 'intropage') . '"></i>';
diff --git a/include/intropage.js b/include/intropage.js
index 9881fba..921a36c 100644
--- a/include/intropage.js
+++ b/include/intropage.js
@@ -25,7 +25,7 @@
 $(function() {
 	$('.grid_item').css('background-color', $('body').css('background-color'));
 
-	$(window).resize(function() {
+	$(window).on('resize', function() {
 		resizeGraphsPanel();
 		resizeCharts();
 	});
@@ -202,15 +202,15 @@ function setPageRefresh() {
 }
 
 function initPage() {
-	$('#intropage_addpanel').unbind().change(function() {
+	$('#intropage_addpanel').off().on('change', function() {
 		addPanel();
 	});
 
-	$('#intropage_action').unbind().change(function() {
+	$('#intropage_action').off().on('change', function() {
 		actionPanel();
 	});
 
-	$('#intropage_action_timespan').unbind().change(function() {
+	$('#intropage_action_timespan').off().on('change', function() {
 		timeSpan();
 	});
 
@@ -303,7 +303,7 @@ function initPage() {
 		}
 	});
 
-	$('.droppanel').click(function(event) {
+	$('.droppanel').on('click', function(event) {
 		event.preventDefault();
 
 		var panel_div_id = $(this).attr('data-panel');
@@ -319,7 +319,7 @@ function initPage() {
 					checkForRedirects(data, url);
 
 					$('#intropage_addpanel').selectmenu('destroy').replaceWith(data);
-					$('#intropage_addpanel').selectmenu().unbind().change(function() {
+					$('#intropage_addpanel').selectmenu().off().on('change', function() {
 
 						addPanel();
 					});
@@ -376,7 +376,7 @@ function initPage() {
 				title: intropage_text_panel_details,
 			});
 
-			$('#block').click(function() {
+			$('#block').on('click', function() {
 				$('#overlay').dialog('close');
 			});
 		})
diff --git a/include/settings.php b/include/settings.php
index ec53f6e..ad39487 100644
--- a/include/settings.php
+++ b/include/settings.php
@@ -222,7 +222,7 @@ function intropage_user_admin_run_action($current_tab) {
 	draw_edit_form(
 		[
 			'config' => ['no_form_tag' => true],
-			'fields' => inject_form_variables($fields_intropage_user_edit, (isset($user) ? $user : []))
+			'fields' => inject_form_variables($fields_intropage_user_edit, ($user ?? []))
 		]
 	);
 
@@ -354,7 +354,7 @@ function intropage_user_group_admin_run_action($current_tab) {
 	draw_edit_form(
 		[
 			'config' => ['no_form_tag' => true],
-			'fields' => inject_form_variables($fields_intropage_group_edit, (isset($group) ? $group : []))
+			'fields' => inject_form_variables($fields_intropage_group_edit, ($group ?? []))
 		]
 	);
 
@@ -434,9 +434,9 @@ function intropage_user_admin_user_save($save) {
 
 					$save['last_update']      = '0000-00-00';
 					$save['data']             = '';
-					$save['priority']         = (isset($panel['priority']) ? $panel['priority'] : 99);
-					$save['alarm']            = (isset($panel['alarm']) ? $panel['alarm'] : 'green');
-					$save['refresh_interval'] = (isset($panel['refresh']) ? $panel['refresh'] : 300);
+					$save['priority']         = ($panel['priority'] ?? 99);
+					$save['alarm']            = ($panel['alarm'] ?? 'green');
+					$save['refresh_interval'] = ($panel['refresh'] ?? 300);
 
 					$id = sql_save($save, 'plugin_intropage_panel_data');
 				}
diff --git a/panellib/analyze.php b/panellib/analyze.php
index 7890867..3bb8862 100644
--- a/panellib/analyze.php
+++ b/panellib/analyze.php
@@ -1494,7 +1494,7 @@ function analyse_tree_host_graph_detail() {
 			foreach ($data as $row) {
 				$sql_hosts = db_fetch_assoc('SELECT id, description, hostname
 					FROM host
-					WHERE hostname = ' . db_qstr($row['hostname']) . ' AND snmp_port=' . $row['snmp_port']);
+					WHERE hostname = ' . db_qstr($row['hostname']) . ' AND snmp_port=' . (int) $row['snmp_port']);
 
 				if (cacti_sizeof($sql_hosts)) {
 					foreach ($sql_hosts as $row2) {
@@ -1805,7 +1805,7 @@ function analyse_tree_host_graph_detail() {
 						$tree   = $host['name'] . ' / ';
 
 						while ($parent != 0) {
-							$sql_parent = db_fetch_row('SELECT parent, title FROM graph_tree_items WHERE id = ' . $parent);
+							$sql_parent = db_fetch_row_prepared('SELECT parent, title FROM graph_tree_items WHERE id = ?', [(int) $parent]);
 							$parent     = $sql_parent['parent'];
 							$tree .= $sql_parent['title'] . ' / ';
 						}
diff --git a/panellib/busiest.php b/panellib/busiest.php
index a880c30..a26279b 100644
--- a/panellib/busiest.php
+++ b/panellib/busiest.php
@@ -218,9 +218,9 @@ function busiest_cpu($panel, $user_id) {
 			WHERE h.disabled != 'on'
 			$q_host_cond
 			AND dsh.average IS NOT NULL
-			AND dtd.data_template_id = " . $ds['id'] . '
+			AND dtd.data_template_id = " . (int) $ds['id'] . '
 			ORDER BY dsh.average DESC
-			LIMIT ' . $lines;
+			LIMIT ' . (int) $lines;
 
 		$avg    = db_fetch_cell('SELECT AVG(average)' . $query);
 		$result = db_fetch_assoc("SELECT $columns $query");
@@ -335,9 +335,9 @@ function busiest_load($panel, $user_id) {
 			WHERE h.disabled != 'on'
 			$q_host_cond
 			AND dsh.average IS NOT NULL
-			AND dtd.data_template_id = " . $ds['id'] . '
+			AND dtd.data_template_id = " . (int) $ds['id'] . '
 			ORDER BY dsh.average DESC
-			LIMIT ' . $lines;
+			LIMIT ' . (int) $lines;
 
 		$avg    = db_fetch_cell('SELECT AVG(average)' . $query);
 		$result = db_fetch_assoc("SELECT $columns $query");
@@ -445,9 +445,9 @@ function busiest_hdd($panel, $user_id) {
 			WHERE h.disabled != 'on'
 			$q_host_cond
 			AND dsh.rrd_name = 'hdd_used'
-			AND dtd.data_template_id = " . $ds['id'] . '
+			AND dtd.data_template_id = " . (int) $ds['id'] . '
 			ORDER BY xvalue DESC
-			LIMIT ' . $lines;
+			LIMIT ' . (int) $lines;
 
 		$result = db_fetch_assoc("SELECT $columns $query");
 
@@ -461,7 +461,7 @@ function busiest_hdd($panel, $user_id) {
 			ON dl.id = dtd.local_data_id
 			WHERE dsh.rrd_name = 'hdd_used'
 			$q_host_cond
-			AND dtd.data_template_id = " . $ds['id'];
+			AND dtd.data_template_id = " . (int) $ds['id'];
 
 		$xavg = db_fetch_assoc('SELECT ' . $columns . ' ' . $query);
 		$avg  = 0;
@@ -561,7 +561,7 @@ function busiest_uptime($panel, $user_id) {
 			WHERE disabled != 'on'
 			$q_host_cond
 			ORDER BY snmp_sysUpTimeInstance DESC
-			LIMIT " . $lines;
+			LIMIT " . (int) $lines;
 
 		$avg    = db_fetch_cell('SELECT AVG(snmp_sysUpTimeInstance)' . $query);
 		$result = db_fetch_assoc("SELECT $columns $query");
@@ -656,10 +656,10 @@ function busiest_traffic($panel, $user_id) {
 			LEFT JOIN host as h on h.id = dl.host_id
 			WHERE h.disabled != 'on'
 			$q_host_cond
-			AND dtd.data_template_id = " . $ds['id'] . "
+			AND dtd.data_template_id = " . (int) $ds['id'] . "
 			AND rrd_name = 'traffic_out'
 			ORDER BY xvalue DESC
-			LIMIT " . $lines;
+			LIMIT " . (int) $lines;
 
 		$result = db_fetch_assoc("SELECT $columns $query");
 
@@ -668,7 +668,7 @@ function busiest_traffic($panel, $user_id) {
 			peak + (SELECT peak FROM data_source_stats_hourly WHERE local_data_id = ldid AND rrd_name='traffic_in') AS xpeak ";
 
 		$query = ' FROM data_template_data AS dtd LEFT JOIN data_source_stats_hourly AS dsh ON dtd.local_data_id = dsh.local_data_id
-			WHERE dtd.data_template_id = ' . $ds['id'] . '
+			WHERE dtd.data_template_id = ' . (int) $ds['id'] . '
 			AND rrd_name=\'traffic_out\' ';
 
 		$xavg = db_fetch_assoc('SELECT ' . $columns . ' ' . $query);
@@ -787,17 +787,17 @@ function busiest_interface_error($panel, $user_id) {
 			LEFT JOIN host as h on h.id = dl.host_id
 			WHERE h.disabled != 'on'
 			$q_host_cond
-			AND dtd.data_template_id = " . $ds['id'] . '
+			AND dtd.data_template_id = " . (int) $ds['id'] . '
 			AND dsh.average IS NOT NULL
 			ORDER BY dsh.average DESC
-			LIMIT ' . $lines;
+			LIMIT ' . (int) $lines;
 
 		$result = db_fetch_assoc("SELECT $columns $query");
 
 		$query = ' FROM data_template_data AS dtd
 			LEFT JOIN data_source_stats_hourly AS dsh
 			ON dtd.local_data_id = dsh.local_data_id
-			WHERE dtd.data_template_id = ' . $ds['id'] . '
+			WHERE dtd.data_template_id = ' . (int) $ds['id'] . '
 			AND dsh.average IS NOT NULL';
 
 		$avg = db_fetch_cell('SELECT AVG(average)' . $query);
@@ -907,7 +907,7 @@ function busiest_interface_util($panel, $user_id) {
 			LEFT JOIN host as h on h.id = dl.host_id
 			WHERE h.disabled != 'on'
 			$q_host_cond
-			AND dtd.data_template_id = " . $ds['id'] . '
+			AND dtd.data_template_id = " . (int) $ds['id'] . '
 			AND value > 0
 			AND time > DATE_SUB(NOW(), INTERVAL 5 MINUTE)
 			ORDER BY value DESC');
@@ -1031,7 +1031,7 @@ function busiest_cpu_detail() {
 			WHERE h.disabled != 'on'
 			$q_host_cond
 			AND dsh.average IS NOT NULL
-			AND dtd.data_template_id = " . $ds['id'] . '
+			AND dtd.data_template_id = " . (int) $ds['id'] . '
 			ORDER BY dsh.average DESC
 			LIMIT 30';
 
@@ -1144,7 +1144,7 @@ function busiest_load_detail() {
 			WHERE h.disabled != 'on'
 			$q_host_cond
 			AND dsh.average IS NOT NULL
-			AND dtd.data_template_id = " . $ds['id'] . '
+			AND dtd.data_template_id = " . (int) $ds['id'] . '
 			ORDER BY dsh.average DESC
 			LIMIT 30';
 
@@ -1259,7 +1259,7 @@ function busiest_hdd_detail() {
 			WHERE h.disabled != 'on'
 			$q_host_cond
 			AND dsh.rrd_name = 'hdd_used'
-			AND dtd.data_template_id = " . $ds['id'] . '
+			AND dtd.data_template_id = " . (int) $ds['id'] . '
 			ORDER BY xvalue DESC
 			LIMIT 30';
 
@@ -1275,7 +1275,7 @@ function busiest_hdd_detail() {
 			ON dl.id=dtd.local_data_id
 			WHERE dsh.rrd_name = 'hdd_used'
 			$q_host_cond
-			AND dtd.data_template_id = " . $ds['id'];
+			AND dtd.data_template_id = " . (int) $ds['id'];
 
 		$xavg = db_fetch_assoc('SELECT ' . $columns . ' ' . $query);
 		$avg  = 0;
@@ -1469,7 +1469,7 @@ function busiest_traffic_detail() {
 			LEFT JOIN host as h on h.id = dl.host_id
 			WHERE h.disabled != 'on'
 			$q_host_cond
-			AND dtd.data_template_id = " . $ds['id'] . "
+			AND dtd.data_template_id = " . (int) $ds['id'] . "
 			AND rrd_name = 'traffic_out'
 			ORDER BY xvalue DESC
 			LIMIT 30";
@@ -1482,7 +1482,7 @@ function busiest_traffic_detail() {
 		$query = ' FROM data_template_data AS dtd
 			LEFT JOIN data_source_stats_hourly AS dsh
 			ON dtd.local_data_id = dsh.local_data_id
-			WHERE dtd.data_template_id = ' . $ds['id'] . '
+			WHERE dtd.data_template_id = ' . (int) $ds['id'] . '
 			AND rrd_name = \'traffic_out\' ';
 
 		$xavg = db_fetch_assoc('SELECT ' . $columns . ' ' . $query);
@@ -1604,7 +1604,7 @@ function busiest_interface_error_detail() {
 			LEFT JOIN host as h on h.id = dl.host_id
 			WHERE h.disabled != 'on'
 			$q_host_cond
-			AND dtd.data_template_id = " . $ds['id'] . '
+			AND dtd.data_template_id = " . (int) $ds['id'] . '
 			AND dsh.average IS NOT NULL
 			ORDER BY dsh.average DESC
 			LIMIT 30';
@@ -1614,7 +1614,7 @@ function busiest_interface_error_detail() {
 		$query = ' FROM data_template_data AS dtd
 			LEFT JOIN data_source_stats_hourly AS dsh
 			ON dtd.local_data_id = dsh.local_data_id
-			WHERE dtd.data_template_id = ' . $ds['id'] . '
+			WHERE dtd.data_template_id = ' . (int) $ds['id'] . '
 			AND dsh.average IS NOT NULL';
 
 		$avg = db_fetch_cell('SELECT AVG(average)' . $query);
@@ -1727,7 +1727,7 @@ function busiest_interface_util_detail() {
 			LEFT JOIN host as h on h.id = dl.host_id
 			WHERE h.disabled != 'on'
 			$q_host_cond
-			AND dtd.data_template_id = " . $ds['id'] . '
+			AND dtd.data_template_id = " . (int) $ds['id'] . '
 			AND value > 0
 			AND time > date_sub(now(), INTERVAL 5 MINUTE)
 			ORDER BY value DESC');
diff --git a/tests/Pest.php b/tests/Pest.php
new file mode 100644
index 0000000..e6bf268
--- /dev/null
+++ b/tests/Pest.php
@@ -0,0 +1,10 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+*/
+
+require_once __DIR__ . '/bootstrap.php';
diff --git a/tests/Security/AuthGuardTest.php b/tests/Security/AuthGuardTest.php
new file mode 100644
index 0000000..0092aab
--- /dev/null
+++ b/tests/Security/AuthGuardTest.php
@@ -0,0 +1,70 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+*/
+
+describe('auth guard presence in intropage', function () {
+	it('includes auth.php or global.php in all UI entry points', function () {
+		$uiFiles = array(
+		'include/functions.php',
+		'include/settings.php',
+		'panellib/analyze.php',
+		'panellib/busiest.php',
+		);
+
+		foreach ($uiFiles as $relativeFile) {
+			$path = realpath(__DIR__ . '/../../' . $relativeFile);
+			if ($path === false) continue;
+			$contents = file_get_contents($path);
+			if ($contents === false) continue;
+
+			// Files that include setup.php or are library files don't need direct auth
+			if (strpos($relativeFile, 'include/') === 0 || strpos($relativeFile, 'lib/') === 0) continue;
+			if (strpos($relativeFile, 'poller_') === 0) continue;
+
+			$hasAuth = (
+				strpos($contents, 'auth.php') !== false ||
+				strpos($contents, 'global.php') !== false ||
+				strpos($contents, 'global_arrays.php') !== false
+			);
+
+			expect($hasAuth)->toBeTrue(
+				"File {$relativeFile} does not include auth.php or global.php"
+			);
+		}
+	});
+
+	it('validates numeric IDs from request variables before DB queries', function () {
+		$uiFiles = array(
+		'include/functions.php',
+		'include/settings.php',
+		'panellib/analyze.php',
+		'panellib/busiest.php',
+		);
+
+		foreach ($uiFiles as $relativeFile) {
+			$path = realpath(__DIR__ . '/../../' . $relativeFile);
+			if ($path === false) continue;
+			$contents = file_get_contents($path);
+			if ($contents === false) continue;
+
+			// Check for get_filter_request_var usage for numeric IDs
+			if (preg_match('/get_request_var\s*\(\s*['"]id['"]/', $contents)) {
+				// Should use get_filter_request_var for 'id' params
+				$hasFilter = (
+					strpos($contents, 'get_filter_request_var') !== false ||
+					strpos($contents, 'input_validate_input_number') !== false ||
+					strpos($contents, 'form_input_validate') !== false
+				);
+
+				expect($hasFilter)->toBeTrue(
+					"File {$relativeFile} uses get_request_var for IDs without validation"
+				);
+			}
+		}
+	});
+});
diff --git a/tests/Security/OutputEscapingTest.php b/tests/Security/OutputEscapingTest.php
new file mode 100644
index 0000000..9778e44
--- /dev/null
+++ b/tests/Security/OutputEscapingTest.php
@@ -0,0 +1,74 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+*/
+
+describe('output escaping in intropage', function () {
+	it('does not interpolate raw variables into HTML attributes', function () {
+		$uiFiles = array(
+		'include/functions.php',
+		'include/settings.php',
+		'panellib/analyze.php',
+		'panellib/busiest.php',
+		);
+
+		foreach ($uiFiles as $relativeFile) {
+			$path = realpath(__DIR__ . '/../../' . $relativeFile);
+			if ($path === false) continue;
+			$contents = file_get_contents($path);
+			if ($contents === false) continue;
+
+			$lines = explode("\n", $contents);
+			$dangerous = 0;
+
+			foreach ($lines as $line) {
+				$trimmed = ltrim($line);
+				if (strpos($trimmed, '//') === 0 || strpos($trimmed, '*') === 0) continue;
+
+				// value="$row[...] without html_escape wrapping
+				if (preg_match('/value\s*=\s*["\'"]\s*<\?php\s+echo\s+\$/', $line)) {
+					$dangerous++;
+				}
+				// title="<?php print $something without escaping
+				if (preg_match('/(?:title|alt|placeholder)\s*=.*print\s+\$(?!_|config)/', $line)) {
+					if (strpos($line, 'html_escape') === false && strpos($line, '__esc') === false && strpos($line, 'htmlspecialchars') === false) {
+						$dangerous++;
+					}
+				}
+			}
+
+			expect($dangerous)->toBe(0,
+				"File {$relativeFile} has unescaped variables in HTML attributes"
+			);
+		}
+	});
+
+	it('uses html_escape or __esc for user-controlled output', function () {
+		$uiFiles = array(
+		'include/functions.php',
+		'include/settings.php',
+		'panellib/analyze.php',
+		'panellib/busiest.php',
+		);
+
+		$totalEscapeCalls = 0;
+
+		foreach ($uiFiles as $relativeFile) {
+			$path = realpath(__DIR__ . '/../../' . $relativeFile);
+			if ($path === false) continue;
+			$contents = file_get_contents($path);
+			if ($contents === false) continue;
+
+			$totalEscapeCalls += preg_match_all('/html_escape|__esc\(|htmlspecialchars/', $contents);
+		}
+
+		// At least some escaping should be present in UI files
+		expect($totalEscapeCalls)->toBeGreaterThan(0,
+			'UI files should contain at least one html_escape/__esc call'
+		);
+	});
+});
diff --git a/tests/Security/Php74CompatibilityTest.php b/tests/Security/Php74CompatibilityTest.php
new file mode 100644
index 0000000..7c8f7e7
--- /dev/null
+++ b/tests/Security/Php74CompatibilityTest.php
@@ -0,0 +1,115 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+*/
+
+describe('PHP 7.4 compatibility in intropage', function () {
+	$files = array(
+		'include/functions.php',
+		'include/settings.php',
+		'panellib/analyze.php',
+		'panellib/busiest.php',
+	);
+
+	it('does not use str_contains (PHP 8.0)', function () use ($files) {
+		foreach ($files as $f) {
+			$p = realpath(__DIR__ . '/../../' . $f);
+			if ($p === false) continue;
+			$c = file_get_contents($p);
+			if ($c === false) continue;
+			expect(preg_match('/\bstr_contains\s*\(/', $c))->toBe(0, "{$f} uses str_contains");
+		}
+	});
+
+	it('does not use str_starts_with (PHP 8.0)', function () use ($files) {
+		foreach ($files as $f) {
+			$p = realpath(__DIR__ . '/../../' . $f);
+			if ($p === false) continue;
+			$c = file_get_contents($p);
+			if ($c === false) continue;
+			expect(preg_match('/\bstr_starts_with\s*\(/', $c))->toBe(0, "{$f} uses str_starts_with");
+		}
+	});
+
+	it('does not use str_ends_with (PHP 8.0)', function () use ($files) {
+		foreach ($files as $f) {
+			$p = realpath(__DIR__ . '/../../' . $f);
+			if ($p === false) continue;
+			$c = file_get_contents($p);
+			if ($c === false) continue;
+			expect(preg_match('/\bstr_ends_with\s*\(/', $c))->toBe(0, "{$f} uses str_ends_with");
+		}
+	});
+
+	it('does not use nullsafe operator (PHP 8.0)', function () use ($files) {
+		foreach ($files as $f) {
+			$p = realpath(__DIR__ . '/../../' . $f);
+			if ($p === false) continue;
+			$c = file_get_contents($p);
+			if ($c === false) continue;
+			expect(preg_match('/\?->/', $c))->toBe(0, "{$f} uses nullsafe operator");
+		}
+	});
+
+	it('does not use match expression (PHP 8.0)', function () use ($files) {
+		foreach ($files as $f) {
+			$p = realpath(__DIR__ . '/../../' . $f);
+			if ($p === false) continue;
+			$c = file_get_contents($p);
+			if ($c === false) continue;
+			// Avoid false positive on preg_match etc
+			$c2 = preg_replace('/preg_match|preg_match_all|fnmatch/', '', $c);
+			expect(preg_match('/\bmatch\s*\(/', $c2))->toBe(0, "{$f} uses match expression");
+		}
+	});
+
+	it('does not use union type declarations (PHP 8.0)', function () use ($files) {
+		foreach ($files as $f) {
+			$p = realpath(__DIR__ . '/../../' . $f);
+			if ($p === false) continue;
+			$c = file_get_contents($p);
+			if ($c === false) continue;
+			// Match function params/return with union types like string|false
+			$hits = preg_match_all('/function\s+\w+\s*\([^)]*\w+\s*\|\s*\w+/', $c);
+			expect($hits)->toBe(0, "{$f} uses union types in function signatures");
+		}
+	});
+
+	it('does not use constructor property promotion (PHP 8.0)', function () use ($files) {
+		foreach ($files as $f) {
+			$p = realpath(__DIR__ . '/../../' . $f);
+			if ($p === false) continue;
+			$c = file_get_contents($p);
+			if ($c === false) continue;
+			expect(preg_match('/function\s+__construct\s*\([^)]*\b(public|private|protected|readonly)\s/', $c))->toBe(0,
+				"{$f} uses constructor promotion"
+			);
+		}
+	});
+
+	it('uses array() not short syntax for new arrays', function () use ($files) {
+		// This is a style preference for 1.2.x consistency, not a hard requirement
+		// Just verify no mixed styles in the same file
+		foreach ($files as $f) {
+			$p = realpath(__DIR__ . '/../../' . $f);
+			if ($p === false) continue;
+			$c = file_get_contents($p);
+			if ($c === false) continue;
+
+			$hasArrayFunc = preg_match('/\barray\s*\(/', $c);
+			$hasShortArray = preg_match('/=\s*\[/', $c);
+
+			// Flag files that mix both styles
+			if ($hasArrayFunc && $hasShortArray) {
+				// Allow mixed if the file existed before our changes
+				// This is informational, not a hard fail
+			}
+		}
+
+		expect(true)->toBeTrue();
+	});
+});
diff --git a/tests/Security/PreparedStatementConsistencyTest.php b/tests/Security/PreparedStatementConsistencyTest.php
new file mode 100644
index 0000000..fbcba19
--- /dev/null
+++ b/tests/Security/PreparedStatementConsistencyTest.php
@@ -0,0 +1,79 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+*/
+
+describe('prepared statement consistency in intropage', function () {
+	it('uses prepared DB helpers in all plugin files', function () {
+		$targetFiles = array(
+		'include/functions.php',
+		'include/settings.php',
+		'panellib/analyze.php',
+		'panellib/busiest.php',
+		);
+
+		$rawPattern = '/\bdb_(?:execute|fetch_row|fetch_assoc|fetch_cell)\s*\(/';
+		$preparedPattern = '/\bdb_(?:execute|fetch_row|fetch_assoc|fetch_cell)_prepared\s*\(/';
+
+		foreach ($targetFiles as $relativeFile) {
+			$path = realpath(__DIR__ . '/../../' . $relativeFile);
+			if ($path === false) continue;
+			$contents = file_get_contents($path);
+			if ($contents === false) continue;
+
+			$lines = explode("\n", $contents);
+			$rawCalls = 0;
+
+			foreach ($lines as $line) {
+				$trimmed = ltrim($line);
+				if (strpos($trimmed, '//') === 0 || strpos($trimmed, '*') === 0 || strpos($trimmed, '#') === 0) continue;
+				if (preg_match($rawPattern, $line) && !preg_match($preparedPattern, $line)) {
+					$rawCalls++;
+				}
+			}
+
+			expect($rawCalls)->toBe(0, "File {$relativeFile} contains raw DB calls");
+		}
+	});
+
+	it('uses parameterized placeholders not string interpolation in SQL', function () {
+		$targetFiles = array(
+		'include/functions.php',
+		'include/settings.php',
+		'panellib/analyze.php',
+		'panellib/busiest.php',
+		);
+
+		foreach ($targetFiles as $relativeFile) {
+			$path = realpath(__DIR__ . '/../../' . $relativeFile);
+			if ($path === false) continue;
+			$contents = file_get_contents($path);
+			if ($contents === false) continue;
+
+			$lines = explode("\n", $contents);
+			$interpolatedSql = 0;
+
+			foreach ($lines as $num => $line) {
+				$trimmed = ltrim($line);
+				if (strpos($trimmed, '//') === 0 || strpos($trimmed, '*') === 0) continue;
+
+				// Detect _prepared calls with $ interpolation instead of ? placeholders
+				if (preg_match('/_prepared\s*\(/', $line) && preg_match('/\$[a-zA-Z_]/', $line)) {
+					// Allow array($var) param binding but flag "WHERE id = $var"
+					if (preg_match('/(?:SELECT|INSERT|UPDATE|DELETE|WHERE|SET|FROM|JOIN).*\$/', $line)) {
+						$interpolatedSql++;
+					}
+				}
+			}
+
+			// This is a heuristic; some false positives expected for complex queries
+			expect($interpolatedSql)->toBeLessThanOrEqual(2,
+				"File {$relativeFile} may have SQL interpolation in prepared calls"
+			);
+		}
+	});
+});
diff --git a/tests/Security/RedirectSafetyTest.php b/tests/Security/RedirectSafetyTest.php
new file mode 100644
index 0000000..f69ff3b
--- /dev/null
+++ b/tests/Security/RedirectSafetyTest.php
@@ -0,0 +1,52 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+*/
+
+describe('redirect safety in intropage', function () {
+	it('calls exit or die after header Location redirects', function () {
+		$files = array(
+		'include/functions.php',
+		'include/settings.php',
+		'panellib/analyze.php',
+		'panellib/busiest.php',
+		);
+
+		foreach ($files as $relativeFile) {
+			$path = realpath(__DIR__ . '/../../' . $relativeFile);
+			if ($path === false) continue;
+			$contents = file_get_contents($path);
+			if ($contents === false) continue;
+
+			$lines = explode("\n", $contents);
+			$missingExit = 0;
+
+			for ($i = 0; $i < count($lines); $i++) {
+				if (preg_match('/header\s*\(\s*['"]Location/', $lines[$i])) {
+					// Next non-empty line should contain exit, die, or return
+					$foundExit = false;
+					for ($j = $i + 1; $j < min($i + 4, count($lines)); $j++) {
+						$next = trim($lines[$j]);
+						if ($next === '') continue;
+						if (preg_match('/\b(exit|die|return)\b/', $next)) {
+							$foundExit = true;
+						}
+						break;
+					}
+
+					if (!$foundExit) {
+						$missingExit++;
+					}
+				}
+			}
+
+			expect($missingExit)->toBe(0,
+				"File {$relativeFile} has header(Location) without exit/die"
+			);
+		}
+	});
+});
diff --git a/tests/Security/SetupStructureTest.php b/tests/Security/SetupStructureTest.php
new file mode 100644
index 0000000..2f1daf1
--- /dev/null
+++ b/tests/Security/SetupStructureTest.php
@@ -0,0 +1,36 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+*/
+
+describe('intropage setup.php structure', function () {
+	$source = file_get_contents(realpath(__DIR__ . '/../../setup.php'));
+
+	it('defines plugin_intropage_install function', function () use ($source) {
+		expect($source)->toContain('function plugin_intropage_install');
+	});
+
+	it('defines plugin_intropage_version function', function () use ($source) {
+		expect($source)->toContain('function plugin_intropage_version');
+	});
+
+	it('defines plugin_intropage_uninstall function', function () use ($source) {
+		expect($source)->toContain('function plugin_intropage_uninstall');
+	});
+
+	it('returns version array with name key', function () use ($source) {
+		expect($source)->toMatch('/[\'\""]name[\'\""]\s*=>/');
+	});
+
+	it('returns version array with version key', function () use ($source) {
+		expect($source)->toMatch('/[\'\""]version[\'\""]\s*=>/');
+	});
+
+	it('registers hooks in install function', function () use ($source) {
+		expect($source)->toContain('api_plugin_register_hook');
+	});
+});
diff --git a/tests/bootstrap.php b/tests/bootstrap.php
new file mode 100644
index 0000000..3cc3724
--- /dev/null
+++ b/tests/bootstrap.php
@@ -0,0 +1,54 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+*/
+
+$GLOBALS['__test_db_calls'] = array();
+
+if (!function_exists('db_execute')) {
+	function db_execute($sql) {
+		$GLOBALS['__test_db_calls'][] = array('fn' => 'db_execute', 'sql' => $sql, 'params' => array());
+		return true;
+	}
+}
+if (!function_exists('db_execute_prepared')) {
+	function db_execute_prepared($sql, $params = array()) {
+		$GLOBALS['__test_db_calls'][] = array('fn' => 'db_execute_prepared', 'sql' => $sql, 'params' => $params);
+		return true;
+	}
+}
+if (!function_exists('db_fetch_assoc')) { function db_fetch_assoc($sql) { return array(); } }
+if (!function_exists('db_fetch_assoc_prepared')) { function db_fetch_assoc_prepared($sql, $p = array()) { return array(); } }
+if (!function_exists('db_fetch_row')) { function db_fetch_row($sql) { return array(); } }
+if (!function_exists('db_fetch_row_prepared')) { function db_fetch_row_prepared($sql, $p = array()) { return array(); } }
+if (!function_exists('db_fetch_cell')) { function db_fetch_cell($sql) { return ''; } }
+if (!function_exists('db_fetch_cell_prepared')) { function db_fetch_cell_prepared($sql, $p = array()) { return ''; } }
+if (!function_exists('db_index_exists')) { function db_index_exists($t, $i) { return false; } }
+if (!function_exists('db_column_exists')) { function db_column_exists($t, $c) { return false; } }
+if (!function_exists('api_plugin_db_add_column')) { function api_plugin_db_add_column($p, $t, $d) { return true; } }
+if (!function_exists('api_plugin_db_table_create')) { function api_plugin_db_table_create($p, $t, $d) { return true; } }
+if (!function_exists('read_config_option')) { function read_config_option($n, $f = false) { return ''; } }
+if (!function_exists('set_config_option')) { function set_config_option($n, $v) {} }
+if (!function_exists('html_escape')) { function html_escape($s) { return htmlspecialchars($s, ENT_QUOTES | ENT_HTML5, 'UTF-8'); } }
+if (!function_exists('__')) { function __($t, $d = '') { return $t; } }
+if (!function_exists('__esc')) { function __esc($t, $d = '') { return htmlspecialchars($t, ENT_QUOTES | ENT_HTML5, 'UTF-8'); } }
+if (!function_exists('cacti_log')) { function cacti_log($m, $p = false, $t = '', $l = 0) {} }
+if (!function_exists('cacti_sizeof')) { function cacti_sizeof($a) { return is_array($a) ? count($a) : 0; } }
+if (!function_exists('is_realm_allowed')) { function is_realm_allowed($r) { return true; } }
+if (!function_exists('raise_message')) { function raise_message($i, $t = '', $l = 0) {} }
+if (!function_exists('get_request_var')) { function get_request_var($n) { return ''; } }
+if (!function_exists('get_nfilter_request_var')) { function get_nfilter_request_var($n) { return ''; } }
+if (!function_exists('get_filter_request_var')) { function get_filter_request_var($n) { return ''; } }
+if (!function_exists('form_input_validate')) { function form_input_validate($v, $n, $r, $o, $e) { return $v; } }
+if (!function_exists('is_error_message')) { function is_error_message() { return false; } }
+if (!function_exists('sql_save')) { function sql_save($a, $t, $k = 'id') { return isset($a['id']) ? $a['id'] : 1; } }
+if (!defined('CACTI_PATH_BASE')) { define('CACTI_PATH_BASE', '/var/www/html/cacti'); }
+if (!defined('POLLER_VERBOSITY_LOW')) { define('POLLER_VERBOSITY_LOW', 2); }
+if (!defined('POLLER_VERBOSITY_MEDIUM')) { define('POLLER_VERBOSITY_MEDIUM', 3); }
+if (!defined('POLLER_VERBOSITY_DEBUG')) { define('POLLER_VERBOSITY_DEBUG', 5); }
+if (!defined('POLLER_VERBOSITY_NONE')) { define('POLLER_VERBOSITY_NONE', 6); }
+if (!defined('MESSAGE_LEVEL_ERROR')) { define('MESSAGE_LEVEL_ERROR', 1); }