As it’s only just started to exist, there are no current ESAPI for PHP examples.

I will be porting my old forum, UltimaBB, to ESAPI for PHP and I’ll donate that to OWASP as an example program.

It’ll use:

AccessReferenceMap – for most user CP and admin CP options
AccessController – replacing the current code
Authenticator – replace the current autologin, remember me, change password and other code
Encoder – to replace the current encoding mechanisms, particularly around themes and CSS
Executor – to protect the system() calls used by the optional load banner
HTTP Utilities – to replace its CSRF protection with ESAPI’s, and other things
IntrusionDetector – to replace / beef up the current audit functionality
Logger – to replace / beef up the current logging mechanism
Randomizer – for generating random values for the CAPTCHA
SafeFile – to protect the uploading of attachments, icons and avatars
SecureProperties – for config.php
User – a non-reference implementation that suits me

Essentially, it will over time use all of ESAPI for PHP, albeit with a customized version suitable for it. That forum runs a very large site I run, so it will immediately help me more than any demo application like SwingSet might.