digininja/DVWA ? reverse-engineered prompt

Build me a simple PHP and MariaDB web app for security training that is intentionally full of common web vulnerabilities, so people can practice in a safe local environment.

I want it to feel like a small real site with a login screen, setup page, basic dashboard, and a few challenge pages where users can switch between easy and harder difficulty levels. Include the usual insecure training examples like broken authentication, SQL injection, XSS, file upload issues, command injection, CSRF, and weak session handling. Make it clear in the app that it is for local use only, not for public hosting.

Please also make it easy to run with Docker and Docker Compose, and include the database setup so someone can get started quickly. Keep the interface straightforward and old school, with enough documentation in the app to help students and teachers understand what each section is for. If you need to check current PHP or Docker setup details, look them up online first.