PHP PHP Security & Best Practices 2

Question 1

What is the best practice for storing sensitive configuration values like database passwords in PHP applications?

Accepted Answer

Use environment variables or config files stored outside the web root

Answer

Hard-code them directly in PHP source files

Answer

Store them in .htaccess files inside the web root

Answer

Encode them with base64_encode() before embedding in source files

Question 2

What major security risk does PHP's eval() function introduce when used with user input?

Accepted Answer

It executes its argument as PHP code, enabling arbitrary code injection

Answer

It causes memory leaks in long-running PHP scripts

Answer

It only accepts integer values and rejects strings

Answer

It significantly increases server CPU usage

Question 3

Which HTTP security header prevents clickjacking attacks by controlling whether a page can be embedded in iframes?

Accepted Answer

X-Frame-Options

Answer

Content-Security-Policy

Answer

X-XSS-Protection

Answer

Strict-Transport-Security

Question 4

What is the purpose of PHP's filter_var() and filter_input() functions in secure development?

Accepted Answer

To validate and sanitize user input using predefined filter constants

Answer

To format output data for display in templates

Answer

To encode sensitive data before database storage

Answer

To compress data payloads before HTTP transmission

Question 5

What security vulnerability can arise when user-controlled input is passed to PHP's include() or require()?

Accepted Answer

Local or remote file inclusion attacks that execute unintended code

Answer

Performance degradation from repeated file parsing overhead

Answer

Syntax errors that permanently crash the application

Answer

Circular dependency issues between included files

Question 6

What does the PHP configuration directive open_basedir accomplish from a security standpoint?

Accepted Answer

Restricts PHP file system operations to one or more specified directory trees

Answer

Sets the maximum allowed file size for uploads

Answer

Opens a shared base directory accessible to all web users

Answer

Sets the default working directory for PHP CLI scripts

Question 7

Which PHP session directive prevents session fixation attacks by rejecting attacker-supplied session IDs?

Accepted Answer

session.use_strict_mode = 1

Answer

session.cookie_secure = 0

Answer

session.gc_maxlifetime = 3600

Answer

session.name = MYSESSID