PHP Risk Assessment & Management 4

Question 1

Which function should be used in PHP to safely output user-supplied data in an HTML context to prevent XSS?

Accepted Answer

htmlspecialchars()

Answer

htmlspecialchars() converts special characters like <, >, and & into HTML entities, neutralizing script injection attempts.

Question 2

What risk does the PHP directive allow_url_include = On introduce?

Accepted Answer

Remote File Inclusion attacks by loading PHP from attacker-controlled URLs

Answer

Enabling allow_url_include lets PHP include() and require() load files from remote URLs, enabling Remote File Inclusion (RFI) attacks.

Question 3

A risk assessment identifies that a PHP API returns stack traces in JSON error responses to clients. What category of risk is this?

Accepted Answer

Information Disclosure

Answer

Stack traces reveal internal file paths, class names, and library versions, which constitutes an Information Disclosure risk per OWASP.

Question 4

Which of the following best mitigates Cross-Site Request Forgery (CSRF) risk in a PHP form-processing application?

Accepted Answer

Validating a per-session, unpredictable token submitted with every state-changing request

Answer

A cryptographically random, per-session CSRF token tied to the form ensures only requests from your legitimate page can perform state changes.

Question 5

What risk is introduced by using mt_rand() to generate password reset tokens in PHP?

Accepted Answer

The token can be predicted because mt_rand() is not cryptographically secure

Answer

mt_rand() uses a seeded Mersenne Twister PRNG whose output can be predicted if the seed is observed, allowing attackers to guess reset tokens.

PHP - PHP Programming Language Practice Test