PHP Case Studies & Practical Application 4 — Questions and Answers
Question 1: A PHP application uses include() to load template files based on a URL parameter like ?page=about. What vulnerability does this create?
- Local File Inclusion (LFI), allowing attackers to read arbitrary server files (Correct answer)
- Cross-Site Request Forgery (CSRF)
- XML External Entity injection (XXE)
- Server-Side Template Injection (SSTI)
Correct answer: Local File Inclusion (LFI), allowing attackers to read arbitrary server files
Using unvalidated user input in include() lets attackers traverse the filesystem and read sensitive files like /etc/passwd.
Question 2: You are profiling a PHP application and find that a database query runs 200 times per page load for the same data. What is the best solution?
- Cache the query result in memory (APCu or Redis) for the duration of the request or longer (Correct answer)
- Add more database indexes
- Use a faster ORM
- Split the query into two smaller queries
Correct answer: Cache the query result in memory (APCu or Redis) for the duration of the request or longer
Caching repeated identical queries eliminates redundant database round-trips, the root cause of the N+1 or repeated-fetch problem.
Question 3: A PHP form saves a user bio with HTML tags to a database and later displays it. Which step is critical at display time?
- Escape output with htmlspecialchars() when rendering the bio in HTML (Correct answer)
- Strip all tags with strip_tags() before saving
- Encode the bio with base64 in the database
- Wrap the bio in a JavaScript JSON.stringify call
Correct answer: Escape output with htmlspecialchars() when rendering the bio in HTML
Escaping at output time using htmlspecialchars() converts characters like < and > into safe HTML entities, preventing XSS.
Question 4: Your PHP application generates PDF invoices using a library and temporarily writes them to /tmp. What risk exists if multiple users generate invoices simultaneously?
- Race conditions where one user's file overwrites another's if filenames are not unique (Correct answer)
- PDFs become corrupted when written to /tmp
- The /tmp directory fills up instantly
- PHP cannot write binary files to /tmp
Correct answer: Race conditions where one user's file overwrites another's if filenames are not unique
Using predictable or shared filenames in a temp directory under concurrent load causes file collisions; use tempnam() or a UUID-based name per request.
Question 5: A PHP application must queue background jobs (e.g., sending emails) without blocking the HTTP response. What is the correct approach?
- Push jobs to a message queue like RabbitMQ or Redis List and process them with a worker script (Correct answer)
- Use ignore_user_abort(true) and sleep() inside the HTTP handler
- Call the email function inside a PHP shutdown function
- Use Ajax polling from the browser to trigger the email
Correct answer: Push jobs to a message queue like RabbitMQ or Redis List and process them with a worker script
A message queue decouples job creation from execution, allowing the HTTP response to return immediately while workers process jobs asynchronously.
Question 6: Which PHP OOP principle is violated when a UserService class directly instantiates a MailService object inside its methods?
- Dependency Inversion Principle — depend on abstractions, not concretions (Correct answer)
- Single Responsibility Principle
- Open/Closed Principle
- Liskov Substitution Principle
Correct answer: Dependency Inversion Principle — depend on abstractions, not concretions
Hard-coding the instantiation of a dependency inside a class creates tight coupling; instead, inject the dependency through the constructor.
Question 7: A PHP application stores a user's cart in $_SESSION. A user logs out but the session data is not destroyed. What security problem occurs?
- Session fixation or session reuse — a subsequent user on the same browser may see the previous user's cart (Correct answer)
- The server runs out of disk space from orphaned sessions
- The session cookie is sent over HTTP instead of HTTPS
- PHP's session garbage collector runs too frequently
Correct answer: Session fixation or session reuse — a subsequent user on the same browser may see the previous user's cart
Failing to call session_destroy() on logout leaves session data accessible, enabling data leakage if the browser or session ID is reused.
PHP Case Studies & Practical Application 4
A PHP application uses include() to load template files based on a URL parameter like ?page=about.
What vulnerability does this create?