diff --git a/_includes/databases.md b/_includes/databases.md
index 858926a..8504ba7 100644
--- a/_includes/databases.md
+++ b/_includes/databases.md
@@ -6,17 +6,21 @@ More importantly, `PDO` allows you to safely inject foreign input (e.g. IDs) int
Let's assume a PHP script receives a numeric ID as a query parameter. This ID should be used to fetch a user record from a database. This is the `wrong` way to do this:
+{% highlight php %}
query("SELECT name FROM users WHERE id = " . $_GET['id']); // <-- NO!
+{% endhighlight %}
This is terrible code. You are inserting a raw query parameter into a SQL query. This will get you hacked in a heartbeat. Instead, you should sanitize the ID input using PDO bound parameters.
+{% highlight php %}
prepare('SELECT name FROM users WHERE id = :id');
$stmt->bindParam(':id', filter_input(INPUT_GET, 'id', FILTER_SANITIZE_NUMBER_INT), PDO::PARAM_INT);
$stmt->execute();
+{% endhighlight %}
This is correct code. It uses a bound parameter on a PDO statement. This escapes the foreign input ID before it is introduced to the database preventing potential SQL injection attacks.
diff --git a/_includes/dependency-management.md b/_includes/dependency-management.md
index a5c6893..d8bdf54 100644
--- a/_includes/dependency-management.md
+++ b/_includes/dependency-management.md
@@ -20,19 +20,26 @@ This will download `composer.phar` (a PHP binary archive). You can run this with
First, create a `composer.json` file in the same directory as `composer.phar`. Here's an example that lists [Twig][2] as a project dependency.
+{% highlight json %}
{
"require": {
"twig/twig": ">=1.8.0,<2.0-dev"
}
}
+{% endhighlight %}
Next, run this command from your project root directory.
+{% highlight bash %}
> php composer.phar install
+{% endhighlight %}
This will download and install the project dependencies into a `vendors/` directory. Next, add this line to your application's primary PHP file; this will tell PHP to use Composer's autoloader for your project dependencies.
+{% highlight php %}
+ php -i
+{% endhighlight %}
The `-i` option will print your PHP configuration just like the [`phpinfo`][phpinfo] function. There are a number of other useful [command line options][cli-options], too.
Let's write a simple "Hello, $name" CLI program. To try it out, create a file named `hello.php`, as below.
+{% highlight php %}
php hello.php
Usage: php hello.php [name]
> php hello.php world
Hello, world
-
+{% endhighlight %}
### Built-in, command line web server
Starting with PHP 5.4, you can develop locally on a PHP-enabled web server without the hassle of installing and configuring a full-fledged web server. To start the server, from your web root:
+{% highlight bash %}
> php -S localhost:8000
+{% endhighlight %}
* [Learn about running PHP from the command line][php-cli]
* [Learn about the built-in, command line web server][cli-server]
diff --git a/_layouts/default.html b/_layouts/default.html
index a8d3340..6ce843f 100644
--- a/_layouts/default.html
+++ b/_layouts/default.html
@@ -13,6 +13,7 @@
+