Why security is critical in PHP - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to start a PHP session, which is important for managing user security.

PHP

<?php
session_[1]();
?>

Drag options to blanks, or click blank then click option'

Aopen

Bstart

Cinit

Dbegin

Attempts:

3 left

💡 Hint

Common Mistakes

Using session_open() or session_init() which do not exist.

Forgetting to start the session before using session variables.

In PHP, session_start() is used to begin a session, which helps track user data securely.

2fill in blank

medium

Complete the code to safely get a value from user input to prevent security risks.

PHP

<?php
$user_input = filter_input(INPUT_GET, '[1]', FILTER_SANITIZE_STRING);
?>

Drag options to blanks, or click blank then click option'

Aemail

Bpassword

Cusername

Did

Attempts:

3 left

💡 Hint

Common Mistakes

Not sanitizing user input which can lead to security vulnerabilities.

Using incorrect input names that do not match the form.

Using filter_input with INPUT_GET and FILTER_SANITIZE_STRING helps clean the 'username' input to avoid harmful data.

3fill in blank

hard

Fix the error in the code to prevent SQL injection by using prepared statements.

PHP

<?php
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email');
$stmt->execute(['[1]' => $email]);
$results = $stmt->fetchAll();
?>

Drag options to blanks, or click blank then click option'

Aemail

Bemail_address

Cuser_email

Dmail

Attempts:

3 left

💡 Hint

Common Mistakes

Using a different key than the placeholder causes errors.

Not using prepared statements leads to SQL injection risks.

The placeholder in the SQL query is ':email', so the key in the execute array must be 'email' to match it exactly.

4fill in blank

hard

Fill both blanks to create a secure password hash and verify it correctly.

PHP

<?php
$hash = password_[1]($password, PASSWORD_DEFAULT);
if (password_[2]($password, $hash)) {
    echo 'Password is valid';
}
?>

Drag options to blanks, or click blank then click option'

Ahash

Bverify

Ccheck

Dencrypt

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect function names like password_encrypt or password_check.

Not verifying the password properly.

password_hash creates a secure hash, and password_verify checks if the password matches the hash.

5fill in blank

hard

Fill all three blanks to safely escape output and prevent cross-site scripting (XSS).

PHP

<?php
$user_input = '<script>alert(1);</script>';
$safe_output = htmlspecialchars($user_input, [1], [2], [3]);
echo $safe_output;
?>

Drag options to blanks, or click blank then click option'

AENT_QUOTES

BUTF-8

Ctrue

DENT_NOQUOTES

Attempts:

3 left

💡 Hint

Common Mistakes

Not escaping output leads to XSS vulnerabilities.

Using wrong flags or encoding causes improper escaping.

htmlspecialchars uses ENT_QUOTES to convert quotes, UTF-8 as charset, and true for double_encode to safely escape output.

Practice

1. Why is security especially important when programming in PHP?

easy

A. Because PHP code runs only on the client side

B. Because PHP often handles user input that can be unsafe

C. Because PHP automatically prevents all security issues

D. Because PHP does not support databases

Solution

1. Step 1: Understand PHP's role in web applications

   PHP runs on the server and often processes data sent by users, which can be unsafe if not handled properly.

2. Step 2: Recognize the risk of unsafe user input

   Unsafe user input can lead to security problems like code injection or data theft if not checked.

3. Final Answer:

   Because PHP often handles user input that can be unsafe -> Option B

4. Quick Check:

   PHP handles user input = Security is critical [OK]

Hint: Remember: user input can be unsafe, so secure it [OK]

Common Mistakes:

• Thinking PHP runs only on client side
• Assuming PHP prevents all security issues automatically
• Believing PHP cannot connect to databases

2. Which PHP function helps prevent Cross-Site Scripting (XSS) by escaping HTML special characters?

easy

A. htmlspecialchars()

B. strtolower()

C. trim()

D. strip_tags()

Solution

1. Step 1: Identify the function that escapes HTML characters

   htmlspecialchars() converts special HTML characters to safe codes, preventing malicious scripts.

2. Step 2: Compare with other functions

   strip_tags() removes HTML tags but doesn't escape characters; trim() removes spaces; strtolower() changes case.

3. Final Answer:

   htmlspecialchars() -> Option A

4. Quick Check:

   Escape HTML special chars = htmlspecialchars() [OK]

Hint: Escape HTML with htmlspecialchars() to stop XSS [OK]

Common Mistakes:

• Using strip_tags() which removes tags but not all risks
• Confusing trim() or strtolower() with security functions
• Not escaping user input before output

3. What will be the output of this PHP code?

$input = "<script>alert('Hi');</script>";
echo htmlspecialchars($input);

medium

A. SyntaxError

B.

C. alert('Hi');

D. <script>alert('Hi');</script>

Solution

1. Step 1: Understand htmlspecialchars() effect

   This function converts special HTML characters like < and > into safe codes like &lt; and &gt;.

2. Step 2: Apply htmlspecialchars() to the input string

   The input string's <script> tags become &lt;script&gt; and &lt;/script&gt;, so the script won't run.

3. Final Answer:

   &lt;script&gt;alert('Hi');&lt;/script&gt; -> Option D

4. Quick Check:

   htmlspecialchars() escapes tags = safe output [OK]

Hint: htmlspecialchars() changes < and > to &lt; and &gt; [OK]

Common Mistakes:

• Expecting the script to run instead of being escaped
• Confusing output with original input
• Thinking it causes syntax errors

4. Identify the security issue in this PHP code snippet:

$name = $_GET['name'];
echo "Hello, $name!";

medium

A. Syntax error in echo statement

B. Missing semicolon after variable assignment

C. No input validation, risk of XSS attack

D. Using $_GET instead of $_POST

Solution

1. Step 1: Analyze how user input is handled

   The code directly outputs user input without cleaning or escaping it.

2. Step 2: Recognize the risk of XSS

   Without validation or escaping, malicious scripts can be injected via the 'name' parameter.

3. Final Answer:

   No input validation, risk of XSS attack -> Option C

4. Quick Check:

   Direct output of user input = XSS risk [OK]

Hint: Never output user input without validation or escaping [OK]

Common Mistakes:

• Thinking missing semicolon causes error here
• Believing $_GET is always unsafe without context
• Ignoring XSS risks from direct echo

5. You want to safely display user comments on your PHP website. Which approach best prevents security issues?

hard

A. Use htmlspecialchars() on comments before displaying

B. Store comments as plain text and display directly

C. Remove all spaces from comments before saving

D. Use strtolower() on comments before displaying

Solution

1. Step 1: Understand the risk of displaying user comments

   User comments may contain harmful HTML or scripts that can cause XSS attacks if shown directly.

2. Step 2: Choose a method to neutralize harmful content

   htmlspecialchars() converts special characters to safe codes, preventing scripts from running.

3. Step 3: Evaluate other options

   Displaying plain text directly risks XSS; removing spaces or changing case does not improve security.

4. Final Answer:

   Use htmlspecialchars() on comments before displaying -> Option A

5. Quick Check:

   Escape user content before display = htmlspecialchars() [OK]

Hint: Escape user comments with htmlspecialchars() before output [OK]

Common Mistakes:

• Displaying raw comments without escaping
• Thinking removing spaces improves security
• Using string case functions for security