PHP PHP Security & Best Practices

Question 1

What is the primary security benefit of using prepared statements in PHP database queries?

Accepted Answer

They prevent SQL injection by separating SQL code from data

Answer

Prepared statements separate SQL code from user-supplied data, ensuring input is never interpreted as executable SQL regardless of its content.

Question 2

Which PHP function converts special characters to HTML entities to prevent XSS attacks?

Accepted Answer

htmlspecialchars()

Answer

htmlspecialchars() converts characters like <, >, &, and quotes to their HTML entity equivalents, neutralizing XSS payloads when output to a browser.

Question 3

What is a Cross-Site Request Forgery (CSRF) attack in the context of PHP web applications?

Accepted Answer

Tricking an authenticated user's browser into making unauthorized requests to a trusted site

Answer

CSRF tricks an authenticated user's browser into submitting requests to a site where they're logged in without their knowledge or consent.

Question 4

Which PHP session configuration setting helps mitigate session hijacking via XSS attacks?

Accepted Answer

session.cookie_httponly = 1

Answer

Setting session.cookie_httponly = 1 prevents JavaScript from accessing session cookies, stopping XSS attacks from stealing session identifiers.

Question 5

What hashing algorithm does PHP's password_hash() function use by default (PASSWORD_DEFAULT)?

Accepted Answer

bcrypt

Answer

password_hash() uses PASSWORD_DEFAULT, which is currently bcrypt — an adaptive, intentionally slow algorithm designed to resist brute-force attacks.

PHP - PHP Programming Language Practice Test