PHP PHP Security & Best Practices

Question 1

What is the primary security benefit of using prepared statements in PHP database queries?

Accepted Answer

They prevent SQL injection by separating SQL code from data

Answer

They improve query readability and structure

Answer

They cache database queries for better performance

Answer

They reduce server memory usage during queries

Question 2

Which PHP function converts special characters to HTML entities to prevent XSS attacks?

Accepted Answer

htmlspecialchars()

Answer

strip_tags()

Answer

addslashes()

Answer

urlencode()

Question 3

What is a Cross-Site Request Forgery (CSRF) attack in the context of PHP web applications?

Accepted Answer

Tricking an authenticated user's browser into making unauthorized requests to a trusted site

Answer

Injecting malicious scripts into pages viewed by other users

Answer

Stealing session cookies via JavaScript execution

Answer

Bypassing authentication by modifying URL parameters directly

Question 4

Which PHP session configuration setting helps mitigate session hijacking via XSS attacks?

Accepted Answer

session.cookie_httponly = 1

Answer

session.use_cookies = 0

Answer

session.use_trans_sid = 1

Answer

session.save_path = /tmp

Question 5

What hashing algorithm does PHP's password_hash() function use by default (PASSWORD_DEFAULT)?

Accepted Answer

bcrypt

Answer

MD5

Answer

SHA-256

Answer

SHA-1

Question 6

What is the correct approach to validating user-uploaded files in PHP for security?

Accepted Answer

Inspect actual file content with finfo_file() and use an allowed-type whitelist

Answer

Check only the file extension in the uploaded filename

Answer

Trust the MIME type stored in $_FILES['file']['type']

Answer

Store files in the web root using their original filenames

Question 7

What is the recommended PHP error display configuration for production environments?

Accepted Answer

Set display_errors = Off and log errors server-side to a file

Answer

Set display_errors = On to help users report bugs

Answer

Use trigger_error() to display detailed messages to end users

Answer

Disable all error reporting with error_reporting(0)