Why security is critical in PHP - Challenge Your Understanding

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this PHP code with SQL injection risk?

Consider this PHP code snippet that takes user input and queries a database. What will be the output if the input is 1 OR 1=1?

PHP

<?php
$user_input = "1 OR 1=1";
$query = "SELECT * FROM users WHERE id = $user_input";
echo $query;
?>

A Syntax error in query

B SELECT * FROM users WHERE id = '1 OR 1=1'

C SELECT * FROM users WHERE id = 1

D SELECT * FROM users WHERE id = 1 OR 1=1

💡 Hint

Look at how the variable is inserted directly into the query string.

The code directly inserts the user input without quotes or escaping, so the query becomes: SELECT * FROM users WHERE id = 1 OR 1=1, which can return all rows, showing SQL injection risk.

🧠 Conceptual

intermediate

Why is input validation important in PHP?

Which of the following best explains why input validation is critical in PHP applications?

A It automatically encrypts user passwords.

B It makes the website load faster by reducing input size.

C It prevents malicious data from causing unexpected behavior or security breaches.

D It allows users to enter any data without restrictions.

💡 Hint

Think about what happens if bad data is accepted without checks.

Input validation ensures that only safe and expected data is processed, preventing attacks like cross-site scripting or SQL injection.

🔧 Debug

advanced

Identify the security flaw in this PHP password handling code

What is the main security problem with this PHP code snippet for storing passwords?

PHP

<?php
$password = $_POST['password'];
$stored = md5($password);
// Store $stored in database
?>

A The password is not encrypted before hashing.

B Using md5 for passwords is insecure and can be easily cracked.

C The code does not check if the password is empty.

D The password is stored in plain text.

💡 Hint

Consider modern best practices for password hashing.

MD5 is a fast hash and vulnerable to attacks. Modern PHP uses password_hash() for secure password storage.

📝 Syntax

advanced

What error does this PHP code produce?

What error will this PHP code cause?

PHP

<?php
if(isset($_GET['id'])) {
  $id = $_GET['id'];
  $query = "SELECT * FROM users WHERE id = '$id";
  // execute query
}
?>

A Syntax error due to missing closing quote in SQL query string.

B Undefined variable error for $id.

C Parse error due to missing semicolon.

D No error, code runs fine.

💡 Hint

Look carefully at the quotes inside the query string.

The SQL query string is missing a closing single quote after $id, causing a syntax error in the query.

🚀 Application

expert

How many items are in the resulting array after this PHP code runs?

Given this PHP code that filters user input, how many items will be in the $safe_inputs array?

PHP

<?php
$inputs = ['<script>', 'hello', '123', 'DROP TABLE users;', 'world'];
$safe_inputs = array_filter($inputs, function($item) {
  return !preg_match('/<|>|DROP|TABLE/i', $item);
});
echo count($safe_inputs);
?>

A 3

B 2

C 4

D 5

💡 Hint

Count how many items do NOT match the pattern.

The items '