PHP PHP Security & Best Practices 2

Question 1

What is the best practice for storing sensitive configuration values like database passwords in PHP applications?

Accepted Answer

Use environment variables or config files stored outside the web root

Answer

Environment variables or config files outside the web root prevent credential exposure through source code leaks or web server misconfigurations that accidentally serve PHP as text.

Question 2

What major security risk does PHP's eval() function introduce when used with user input?

Accepted Answer

It executes its argument as PHP code, enabling arbitrary code injection

Answer

eval() interprets its string argument as PHP code, so if user-controlled input reaches eval(), attackers can execute arbitrary server-side commands.

Question 3

Which HTTP security header prevents clickjacking attacks by controlling whether a page can be embedded in iframes?

Accepted Answer

X-Frame-Options

Answer

X-Frame-Options controls whether a page can be loaded inside a frame or iframe, preventing clickjacking by denying embedding on third-party sites.

Question 4

What is the purpose of PHP's filter_var() and filter_input() functions in secure development?

Accepted Answer

To validate and sanitize user input using predefined filter constants

Answer

filter_var() and filter_input() provide standardized validation and sanitization of external data using PHP's built-in Filter extension, reducing injection vulnerabilities.

Question 5

What security vulnerability can arise when user-controlled input is passed to PHP's include() or require()?

Accepted Answer

Local or remote file inclusion attacks that execute unintended code

Answer

When user input controls the file path in include/require, attackers can include remote malicious files (RFI) or traverse directories to access sensitive local files (LFI).

PHP - PHP Programming Language Practice Test

PHP - PHP Programming Language Practice Test

PHP PHP Security & Best Practices 2