PHP PHP Security & Best Practices 3

Question 1

What is the recommended technique for preventing CSRF attacks in PHP form submissions?

Accepted Answer

Generate and validate unique per-session CSRF tokens in every form

Answer

Validate the HTTP Referer header on every request

Answer

Use HTTPS for all form submissions

Answer

Require users to re-authenticate before each form submission

Question 2

Which PHP function is specifically designed to verify a password against a hash created by password_hash()?

Accepted Answer

password_verify()

Answer

md5_verify()

Answer

strcmp()

Answer

hash_compare()

Question 3

What is a timing attack and why is PHP's hash_equals() function important for preventing it?

Accepted Answer

An attack that infers secret values by measuring how long string comparisons take

Answer

An attack measuring server response time to bypass rate-limiting controls

Answer

A DDoS attack using precisely timed sequences of HTTP requests

Answer

An attack that manipulates PHP session timeout configuration values

Question 4

Which combination of cookie attributes should be set when PHP sets sensitive session cookies?

Accepted Answer

Set the Secure, HttpOnly, and SameSite attributes

Answer

Encode the data with base64 and store in the cookie value

Answer

Store a raw value alongside an MD5 checksum for integrity

Answer

Compress the cookie data to obscure its contents from attackers

Question 5

What was the historical security danger of null byte injection in PHP file path operations?

Accepted Answer

A null byte (\0) in a filename truncated the path at the OS level, bypassing extension validation

Answer

It caused NULL values to be silently inserted into database records

Answer

It caused PHP to skip input validation whenever null values were present

Answer

It overwrote PHP's null coalescing operator (??) behavior unexpectedly

Question 6

How does the Content-Security-Policy (CSP) HTTP header protect PHP applications against XSS attacks?

Accepted Answer

It tells browsers which content sources are trusted, blocking scripts from unauthorized origins

Answer

It encrypts HTTP responses end-to-end to prevent eavesdropping

Answer

It prevents search engines from indexing sensitive application pages

Answer

It limits the size of POST request bodies to prevent buffer overflows

Question 7

Which PHP session configuration directive ensures session cookies are only transmitted over encrypted HTTPS connections?

Accepted Answer

session.cookie_secure = 1

Answer

session.cookie_httponly = 1

Answer

session.use_only_cookies = 1

Answer

session.use_strict_mode = 1