PHP Risk Assessment & Management 2 — Questions and Answers
Question 1: Which PHP configuration directive should be disabled in production to prevent leaking sensitive error details to users?
- display_errors (Correct answer)
- log_errors
- error_reporting
- error_log
Correct answer: display_errors
display_errors outputs error messages to the browser; disabling it in production prevents attackers from gleaning server internals.
Question 2: What is the recommended way to store user passwords in a PHP application to minimize risk from a database breach?
- password_hash() with PASSWORD_BCRYPT or PASSWORD_ARGON2ID (Correct answer)
- md5() with a static salt
- sha256() without a salt
- base64_encode()
Correct answer: password_hash() with PASSWORD_BCRYPT or PASSWORD_ARGON2ID
password_hash() with a strong algorithm like bcrypt or Argon2 produces adaptive, salted hashes that are resistant to brute-force attacks.
Question 3: A PHP application accepts a filename from a GET parameter and passes it to include(). What risk does this introduce?
- Local/Remote File Inclusion (LFI/RFI) (Correct answer)
- SQL Injection
- Cross-Site Request Forgery
- XML External Entity injection
Correct answer: Local/Remote File Inclusion (LFI/RFI)
Passing unsanitized user input to include() allows attackers to include arbitrary local or remote files, potentially executing malicious code.
Question 4: Which HTTP header should a PHP application send to instruct browsers to only connect over HTTPS, mitigating SSL-stripping attacks?
- Strict-Transport-Security (Correct answer)
- Content-Security-Policy
- X-Frame-Options
- X-Content-Type-Options
Correct answer: Strict-Transport-Security
The Strict-Transport-Security (HSTS) header tells browsers to enforce HTTPS-only connections for the specified duration.
Question 5: What risk arises when a PHP session ID is transmitted over an unencrypted HTTP connection?
- Session hijacking via network eavesdropping (Correct answer)
- SQL injection through the session token
- Remote code execution via the session file
- Cross-site scripting via the session cookie
Correct answer: Session hijacking via network eavesdropping
An attacker who intercepts an unencrypted session ID can impersonate the authenticated user by replaying that token.
Question 6: Which PHP function is safest for comparing user-supplied hash values to prevent timing attacks?
- hash_equals() (Correct answer)
- strcmp()
- md5() with ==
- sha1() with ===
Correct answer: hash_equals()
hash_equals() performs a constant-time comparison, preventing attackers from inferring correct bytes by measuring response time differences.
Question 7: What is the primary risk of using eval() with user-supplied input in PHP?
- Arbitrary code execution (Correct answer)
- SQL injection
- Path traversal
- Session fixation
Correct answer: Arbitrary code execution
eval() executes a string as PHP code, so injecting malicious input allows attackers to run any PHP commands on the server.
PHP Risk Assessment & Management 2
Which PHP configuration directive should be disabled in production to prevent leaking sensitive error details to users?