PHP PHP Security & Best Practices 2 — Questions and Answers
Question 1: What is the best practice for storing sensitive configuration values like database passwords in PHP applications?
- Hard-code them directly in PHP source files
- Store them in .htaccess files inside the web root
- Use environment variables or config files stored outside the web root (Correct answer)
- Encode them with base64_encode() before embedding in source files
Correct answer: Use environment variables or config files stored outside the web root
Environment variables or config files outside the web root prevent credential exposure through source code leaks or web server misconfigurations that accidentally serve PHP as text.
Question 2: What major security risk does PHP's eval() function introduce when used with user input?
- It causes memory leaks in long-running PHP scripts
- It executes its argument as PHP code, enabling arbitrary code injection (Correct answer)
- It only accepts integer values and rejects strings
- It significantly increases server CPU usage
Correct answer: It executes its argument as PHP code, enabling arbitrary code injection
eval() interprets its string argument as PHP code, so if user-controlled input reaches eval(), attackers can execute arbitrary server-side commands.
Question 3: Which HTTP security header prevents clickjacking attacks by controlling whether a page can be embedded in iframes?
- Content-Security-Policy
- X-Frame-Options (Correct answer)
- X-XSS-Protection
- Strict-Transport-Security
Correct answer: X-Frame-Options
X-Frame-Options controls whether a page can be loaded inside a frame or iframe, preventing clickjacking by denying embedding on third-party sites.
Question 4: What is the purpose of PHP's filter_var() and filter_input() functions in secure development?
- To format output data for display in templates
- To validate and sanitize user input using predefined filter constants (Correct answer)
- To encode sensitive data before database storage
- To compress data payloads before HTTP transmission
Correct answer: To validate and sanitize user input using predefined filter constants
filter_var() and filter_input() provide standardized validation and sanitization of external data using PHP's built-in Filter extension, reducing injection vulnerabilities.
Question 5: What security vulnerability can arise when user-controlled input is passed to PHP's include() or require()?
- Performance degradation from repeated file parsing overhead
- Local or remote file inclusion attacks that execute unintended code (Correct answer)
- Syntax errors that permanently crash the application
- Circular dependency issues between included files
Correct answer: Local or remote file inclusion attacks that execute unintended code
When user input controls the file path in include/require, attackers can include remote malicious files (RFI) or traverse directories to access sensitive local files (LFI).
Question 6: What does the PHP configuration directive open_basedir accomplish from a security standpoint?
- Sets the maximum allowed file size for uploads
- Restricts PHP file system operations to one or more specified directory trees (Correct answer)
- Opens a shared base directory accessible to all web users
- Sets the default working directory for PHP CLI scripts
Correct answer: Restricts PHP file system operations to one or more specified directory trees
open_basedir restricts PHP's file system access to specified directories, preventing directory traversal attacks from reaching sensitive system files outside the web application.
Question 7: Which PHP session directive prevents session fixation attacks by rejecting attacker-supplied session IDs?
- session.use_strict_mode = 1 (Correct answer)
- session.cookie_secure = 0
- session.gc_maxlifetime = 3600
- session.name = MYSESSID
Correct answer: session.use_strict_mode = 1
session.use_strict_mode = 1 causes PHP to reject any session ID that was not generated by the server, preventing attackers from pre-setting a known session ID.
PHP PHP Security & Best Practices 2
What is the best practice for storing sensitive configuration values like database passwords in PHP applications?