What are the first steps in checking the security of a PHP web application?

Question

PHP

Your development team asks you to check your newly written web application for security. The web application is very dynamic and includes modules like booking, reservation, payment, authentication, registration, etc.
The use of static and dynamic code analyzers is not allowed.
Question : What patterns to look for in the code, what to look for, any first steps to assess security.
Thank you.

Answer 1

Incorrect templating settings, gluing query pieces as strings, no action rights check at the very beginning of each controller action, no owner check when linking the target object to the selected one, deliberately left bookmarks (suspicious places where the code is unreadable).

Answer 2

take OWASP top 10 and read first