PHP Risk Assessment & Management 2

Question 1

Which PHP configuration directive should be disabled in production to prevent leaking sensitive error details to users?

Accepted Answer

display_errors

Answer

display_errors outputs error messages to the browser; disabling it in production prevents attackers from gleaning server internals.

Question 2

What is the recommended way to store user passwords in a PHP application to minimize risk from a database breach?

Accepted Answer

password_hash() with PASSWORD_BCRYPT or PASSWORD_ARGON2ID

Answer

password_hash() with a strong algorithm like bcrypt or Argon2 produces adaptive, salted hashes that are resistant to brute-force attacks.

Question 3

A PHP application accepts a filename from a GET parameter and passes it to include(). What risk does this introduce?

Accepted Answer

Local/Remote File Inclusion (LFI/RFI)

Answer

Passing unsanitized user input to include() allows attackers to include arbitrary local or remote files, potentially executing malicious code.

Question 4

Which HTTP header should a PHP application send to instruct browsers to only connect over HTTPS, mitigating SSL-stripping attacks?

Accepted Answer

Strict-Transport-Security

Answer

The Strict-Transport-Security (HSTS) header tells browsers to enforce HTTPS-only connections for the specified duration.

Question 5

What risk arises when a PHP session ID is transmitted over an unencrypted HTTP connection?

Accepted Answer

Session hijacking via network eavesdropping

Answer

An attacker who intercepts an unencrypted session ID can impersonate the authenticated user by replaying that token.

PHP - PHP Programming Language Practice Test