PHP PHP Security & Best Practices 1 — Questions and Answers
Question 1: What is the primary security benefit of using prepared statements in PHP database queries?
- They improve query readability and structure
- They prevent SQL injection by separating SQL code from data (Correct answer)
- They cache database queries for better performance
- They reduce server memory usage during queries
Correct answer: They prevent SQL injection by separating SQL code from data
Prepared statements separate SQL code from user-supplied data, ensuring input is never interpreted as executable SQL regardless of its content.
Question 2: Which PHP function converts special characters to HTML entities to prevent XSS attacks?
- strip_tags()
- addslashes()
- htmlspecialchars() (Correct answer)
- urlencode()
Correct answer: htmlspecialchars()
htmlspecialchars() converts characters like <, >, &, and quotes to their HTML entity equivalents, neutralizing XSS payloads when output to a browser.
Question 3: What is a Cross-Site Request Forgery (CSRF) attack in the context of PHP web applications?
- Injecting malicious scripts into pages viewed by other users
- Tricking an authenticated user's browser into making unauthorized requests to a trusted site (Correct answer)
- Stealing session cookies via JavaScript execution
- Bypassing authentication by modifying URL parameters directly
Correct answer: Tricking an authenticated user's browser into making unauthorized requests to a trusted site
CSRF tricks an authenticated user's browser into submitting requests to a site where they're logged in without their knowledge or consent.
Question 4: Which PHP session configuration setting helps mitigate session hijacking via XSS attacks?
- session.use_cookies = 0
- session.cookie_httponly = 1 (Correct answer)
- session.use_trans_sid = 1
- session.save_path = /tmp
Correct answer: session.cookie_httponly = 1
Setting session.cookie_httponly = 1 prevents JavaScript from accessing session cookies, stopping XSS attacks from stealing session identifiers.
Question 5: What hashing algorithm does PHP's password_hash() function use by default (PASSWORD_DEFAULT)?
- MD5
- SHA-256
- bcrypt (Correct answer)
- SHA-1
Correct answer: bcrypt
password_hash() uses PASSWORD_DEFAULT, which is currently bcrypt — an adaptive, intentionally slow algorithm designed to resist brute-force attacks.
Question 6: What is the correct approach to validating user-uploaded files in PHP for security?
- Check only the file extension in the uploaded filename
- Trust the MIME type stored in $_FILES['file']['type']
- Inspect actual file content with finfo_file() and use an allowed-type whitelist (Correct answer)
- Store files in the web root using their original filenames
Correct answer: Inspect actual file content with finfo_file() and use an allowed-type whitelist
Attackers can spoof file extensions and MIME types, so actual file content must be inspected with finfo_file() and only whitelisted types accepted.
Question 7: What is the recommended PHP error display configuration for production environments?
- Set display_errors = On to help users report bugs
- Set display_errors = Off and log errors server-side to a file (Correct answer)
- Use trigger_error() to display detailed messages to end users
- Disable all error reporting with error_reporting(0)
Correct answer: Set display_errors = Off and log errors server-side to a file
In production, display_errors should be Off to avoid leaking sensitive stack traces or file paths, while errors are logged server-side for developer review only.
PHP PHP Security & Best Practices 1
What is the primary security benefit of using prepared statements in PHP database queries?