PHP PHP Security & Best Practices 3

Question 1

What is the recommended technique for preventing CSRF attacks in PHP form submissions?

Accepted Answer

Generate and validate unique per-session CSRF tokens in every form

Answer

CSRF tokens are unique, unpredictable session-bound values embedded in forms; server-side validation confirms the request originated from the legitimate application page.

Question 2

Which PHP function is specifically designed to verify a password against a hash created by password_hash()?

Accepted Answer

password_verify()

Answer

password_verify() safely checks a plain-text password against a stored hash using constant-time comparison to protect against timing side-channel attacks.

Question 3

What is a timing attack and why is PHP's hash_equals() function important for preventing it?

Accepted Answer

An attack that infers secret values by measuring how long string comparisons take

Answer

Standard string comparison exits early on the first mismatch, leaking timing information about how many characters matched; hash_equals() always takes the same time regardless of the difference.

Question 4

Which combination of cookie attributes should be set when PHP sets sensitive session cookies?

Accepted Answer

Set the Secure, HttpOnly, and SameSite attributes

Answer

Secure restricts transmission to HTTPS, HttpOnly blocks JavaScript access, and SameSite prevents the cookie from being sent with cross-site requests automatically.

Question 5

What was the historical security danger of null byte injection in PHP file path operations?

Accepted Answer

A null byte (\0) in a filename truncated the path at the OS level, bypassing extension validation

Answer

In older PHP versions, null bytes caused file paths to be truncated at the operating system level, so 'shell.php\0.jpg' was treated as 'shell.php', bypassing extension-based upload checks.

PHP - PHP Programming Language Practice Test

PHP - PHP Programming Language Practice Test

PHP PHP Security & Best Practices 3