PHP Risk Assessment & Management 4 — Questions and Answers
Question 1: Which function should be used in PHP to safely output user-supplied data in an HTML context to prevent XSS?
- htmlspecialchars() (Correct answer)
- strip_tags()
- addslashes()
- urlencode()
Correct answer: htmlspecialchars()
htmlspecialchars() converts special characters like <, >, and & into HTML entities, neutralizing script injection attempts.
Question 2: What risk does the PHP directive allow_url_include = On introduce?
- Remote File Inclusion attacks by loading PHP from attacker-controlled URLs (Correct answer)
- SQL injection through included remote files
- Denial of service via infinite include loops
- CSRF token bypass via remote templates
Correct answer: Remote File Inclusion attacks by loading PHP from attacker-controlled URLs
Enabling allow_url_include lets PHP include() and require() load files from remote URLs, enabling Remote File Inclusion (RFI) attacks.
Question 3: A risk assessment identifies that a PHP API returns stack traces in JSON error responses to clients. What category of risk is this?
- Information Disclosure (Correct answer)
- Injection
- Broken Authentication
- Security Misconfiguration
Correct answer: Information Disclosure
Stack traces reveal internal file paths, class names, and library versions, which constitutes an Information Disclosure risk per OWASP.
Question 4: Which of the following best mitigates Cross-Site Request Forgery (CSRF) risk in a PHP form-processing application?
- Validating a per-session, unpredictable token submitted with every state-changing request (Correct answer)
- Checking the HTTP Referer header only
- Requiring HTTPS for all requests
- Using POST instead of GET for all forms
Correct answer: Validating a per-session, unpredictable token submitted with every state-changing request
A cryptographically random, per-session CSRF token tied to the form ensures only requests from your legitimate page can perform state changes.
Question 5: What risk is introduced by using mt_rand() to generate password reset tokens in PHP?
- The token can be predicted because mt_rand() is not cryptographically secure (Correct answer)
- The token is too short for a URL
- mt_rand() produces duplicate tokens on the same request
- The token expires too quickly
Correct answer: The token can be predicted because mt_rand() is not cryptographically secure
mt_rand() uses a seeded Mersenne Twister PRNG whose output can be predicted if the seed is observed, allowing attackers to guess reset tokens.
Question 6: When performing a risk assessment on a PHP application's dependency chain, what tool should be used to check for known vulnerable packages?
- composer audit (Correct answer)
- phpstan --level=9
- php -l
- php-cs-fixer check
Correct answer: composer audit
composer audit (available in Composer 2.4+) checks installed packages against the PHP Security Advisories Database for known CVEs.
Question 7: What is the risk of a PHP application that grants database accounts full DBA privileges for routine read/write operations?
- A successful SQL injection could drop tables or exfiltrate the entire database (Correct answer)
- Query performance degrades due to privilege checking overhead
- PHP PDO cannot use DBA accounts securely
- Sessions become corrupted when stored in the database
Correct answer: A successful SQL injection could drop tables or exfiltrate the entire database
Overprivileged database accounts violate least privilege; an SQL injection then has the power to destroy or exfiltrate all data.
PHP Risk Assessment & Management 4
Which function should be used in PHP to safely output user-supplied data in an HTML context to prevent XSS?