I got a small project where I just have to make their authentication . They are quite serious about their security and they want raw-php as well .

I tried my best to implement maximum steps to make it hard secure

• I did validate and sanitize the inputs both in client (using validatorjs) and in server as well
• Added CSRF token protection
• Encrypted maximum things as possible
• Added recaptcha also
• bcrypted encrypted passwords
• have email verification authentication as well
• added filters and validators for sql injection and XSS protection.

Is there any major or minor thing I am missing ? Or please do suggest your measures. and also if any php security library can be mentioned would be helpful. They are mainly concern about their data as their data would be quite important and they do want security from any kind of breach or flaws

Thanks