[eluser]boltsabre[/eluser]
I'd suggest you test EVERYTHING!!!
Firstly, make sure you have a live online "test" server, this should EXACTLY mirror your live server (in terms of php version, you db version, your php .ini file, etc, etc, etc).
Upload it on there and test it. Once it passes test server testing, then you can upload to your live server and test again.
Without knowing anything about your application, how well it is documented, etc, it's hard to tell you what you should be testing.
But some things I would highly suggest are security tests. You'll have to research this yourself, but the 3 most basic things are:
- sql injections
- CSFR
- xss
- $_POST data manipulation testing (it's very easy to alter POST data after the form has been submitted, so for example using html input attribute 'maxlength' is not enough for ensuring strings are not longer than expected, it needs to be checked server side).
You also want to test any and all controller functions that accept a parameter. What happens if you call that controller without the parameter? By default you'll get a .php error message. What happens if you pass in a parameter that you're not expecting? Does this break DB calls or anything?
- SEO Testing? Meta titles and descriptions? SEO onpage and onsite testing in itself is a huge job for a large site.
- User Testing? Getting users to complete various tasks across the site, can the do it? Is it confusing for them? etc etc etc.
- Data Validation Tests? Do ALL of your forms only accept the data that you want? Is it possible to pass a string instead of an int?
- Unit Testing (basically writing tests for every possible outcome of a model/controller and ensuring that under all circumstances you get the desired result, whatever that may be).
- Do you have accurate 404 page handling capability. This also ties into the "parameters in controller" thing mentioned above, if you are expecting one type/value for a parameter but you get something else there is a good chance you'll want to 404 the page.
- Server Load/Strain Testing
- Session Hijacking
Anyway, this is just the tip of the iceburg, you really should research the topic in depth, create a concrete "Test Road Map" and .... test! Without knowing anything about your application it is all mere speculation!
