PHP Risk Assessment & Management 3 — Questions and Answers
Question 1: A developer uses $pdo->query('SELECT * FROM users WHERE id=' . $_GET['id']). What is the primary risk?
- SQL Injection (Correct answer)
- Cross-Site Scripting
- CSRF
- Path Traversal
Correct answer: SQL Injection
Concatenating unsanitized user input directly into an SQL query allows attackers to manipulate the query logic and access or modify data.
Question 2: Which PHP session setting prevents JavaScript from reading the session cookie, reducing XSS-based session theft risk?
- session.cookie_httponly = 1 (Correct answer)
- session.cookie_secure = 1
- session.use_strict_mode = 1
- session.save_handler = files
Correct answer: session.cookie_httponly = 1
The HttpOnly flag instructs browsers to block JavaScript access to the cookie, limiting what an XSS payload can steal.
Question 3: When should session_regenerate_id(true) be called in a PHP application to mitigate session fixation?
- Immediately after a successful login (Correct answer)
- Only when the session expires
- Before displaying any HTML output
- When the user changes their email
Correct answer: Immediately after a successful login
Regenerating the session ID upon privilege escalation (login) invalidates any pre-authentication token an attacker may have planted.
Question 4: What risk does a PHP application face if it unserializes untrusted data from user input using unserialize()?
- Object injection leading to arbitrary code execution (Correct answer)
- Buffer overflow in the PHP runtime
- SQL injection via serialized query strings
- Denial of service only, no code execution
Correct answer: Object injection leading to arbitrary code execution
PHP's unserialize() can instantiate arbitrary classes and invoke magic methods, enabling attackers to chain gadgets into remote code execution.
Question 5: Which Content-Security-Policy directive most directly reduces the risk of reflected XSS by restricting inline script execution?
- script-src 'self' (Correct answer)
- frame-ancestors 'none'
- default-src *
- img-src data:
Correct answer: script-src 'self'
Setting script-src to 'self' (without 'unsafe-inline') blocks inline and externally hosted scripts not from the same origin, breaking most XSS payloads.
Question 6: What is the risk associated with exposing a PHP application's phpinfo() output to the public?
- It discloses configuration, paths, and enabled extensions that attackers can use for targeted exploits (Correct answer)
- It allows remote code execution directly
- It enables SQL injection via PHP version strings
- It causes denial of service by consuming server memory
Correct answer: It discloses configuration, paths, and enabled extensions that attackers can use for targeted exploits
phpinfo() reveals server paths, PHP version, loaded modules, and configuration values that help attackers craft targeted attack vectors.
Question 7: A PHP application stores uploaded files in the web root without validating MIME type or extension. What is the primary risk?
- Remote code execution via uploaded PHP webshell (Correct answer)
- SQL injection through file metadata
- CSRF via the file upload form
- Session fixation through the uploaded filename
Correct answer: Remote code execution via uploaded PHP webshell
An attacker can upload a .php webshell that the server executes when requested, granting full server-side code execution.
PHP Risk Assessment & Management 3
A developer uses $pdo->query('SELECT * FROM users WHERE id=' . $_GET['id']).
What is the primary risk?