Input validation and sanitization in PHP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this PHP code with input sanitization?

Consider the following PHP code that sanitizes user input before outputting it. What will be printed?

PHP

<?php
$user_input = "<script>alert('XSS');</script>";
$sanitized = filter_var($user_input, FILTER_SANITIZE_STRING);
echo $sanitized;
?>

A <script>alert('XSS');</script>

B alert('XSS');</script>

C alert('XSS');

D SyntaxError

💡 Hint

FILTER_SANITIZE_STRING removes tags but keeps the text inside.

The filter FILTER_SANITIZE_STRING removes HTML tags but keeps the text inside. So the script tags are removed but the alert text remains.

❓ Predict Output

intermediate

What error does this PHP code raise when validating an email?

What error will this PHP code produce when validating an invalid email?

PHP

<?php
$email = "invalid-email@";
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    throw new Exception("Invalid email format");
}
echo "Valid email";
?>

A Warning: filter_var expects parameter 2 to be int

B Exception with message 'Invalid email format'

C Parse error

D Valid email

💡 Hint

FILTER_VALIDATE_EMAIL returns false if the email is invalid.

The code throws an Exception when filter_var returns false for invalid email format.

🔧 Debug

advanced

Why does this PHP code fail to sanitize input correctly?

Find the reason why this PHP code does not sanitize the input as expected.

PHP

<?php
$input = "<b>Hello</b>";
$clean = filter_var($input, FILTER_SANITIZE_EMAIL);
echo $clean;
?>

A FILTER_SANITIZE_EMAIL removes all characters except letters, digits and !#$%&'*+-/=?^_`{|}~@.[] so tags remain

B FILTER_SANITIZE_EMAIL removes tags but leaves text inside

C FILTER_SANITIZE_EMAIL is deprecated and causes a warning

D The variable $input is not defined

💡 Hint

Check what FILTER_SANITIZE_EMAIL actually removes.

FILTER_SANITIZE_EMAIL only removes characters not valid in emails. It does not remove HTML tags, so <b> remains.

❓ Predict Output

advanced

What is the output of this PHP code using htmlspecialchars?

What will this PHP code print?

PHP

<?php
$input = "<a href='test'>Test</a> & \"Quotes\"";
$escaped = htmlspecialchars($input, ENT_QUOTES);
echo $escaped;
?>

A <a href='test'>Test</a> & "Quotes"

B SyntaxError

C &lt;a href='test'&gt;Test&lt;/a&gt; & "Quotes"

D &lt;a href=&#039;test&#039;&gt;Test&lt;/a&gt; &amp; &quot;Quotes&quot;

💡 Hint

htmlspecialchars converts special characters to HTML entities.

htmlspecialchars with ENT_QUOTES converts <, >, &, ' and " to HTML entities.

🧠 Conceptual

expert

Which PHP function best prevents SQL injection by sanitizing input?

Which of the following PHP functions is the best choice to prevent SQL injection attacks by properly sanitizing user input before using it in SQL queries?

A mysqli_real_escape_string()

B htmlspecialchars()

C filter_var() with FILTER_SANITIZE_STRING

D addslashes()

💡 Hint

Think about functions designed specifically for SQL context.

mysqli_real_escape_string() escapes special characters for SQL queries, preventing injection. htmlspecialchars() and filter_var() sanitize for HTML or general input, not SQL. addslashes() is less safe and not recommended.