Why security is critical in PHP - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to start a PHP session, which is important for managing user security.

PHP

<?php
session_[1]();
?>

Drag options to blanks, or click blank then click option'

Aopen

Bstart

Cinit

Dbegin

Attempts:

3 left

💡 Hint

Common Mistakes

Using session_open() or session_init() which do not exist.

Forgetting to start the session before using session variables.

In PHP, session_start() is used to begin a session, which helps track user data securely.

2fill in blank

medium

Complete the code to safely get a value from user input to prevent security risks.

PHP

<?php
$user_input = filter_input(INPUT_GET, '[1]', FILTER_SANITIZE_STRING);
?>

Drag options to blanks, or click blank then click option'

Aemail

Bpassword

Cusername

Did

Attempts:

3 left

💡 Hint

Common Mistakes

Not sanitizing user input which can lead to security vulnerabilities.

Using incorrect input names that do not match the form.

Using filter_input with INPUT_GET and FILTER_SANITIZE_STRING helps clean the 'username' input to avoid harmful data.

3fill in blank

hard

Fix the error in the code to prevent SQL injection by using prepared statements.

PHP

<?php
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email');
$stmt->execute(['[1]' => $email]);
$results = $stmt->fetchAll();
?>

Drag options to blanks, or click blank then click option'

Aemail

Bemail_address

Cuser_email

Dmail

Attempts:

3 left

💡 Hint

Common Mistakes

Using a different key than the placeholder causes errors.

Not using prepared statements leads to SQL injection risks.

The placeholder in the SQL query is ':email', so the key in the execute array must be 'email' to match it exactly.

4fill in blank

hard

Fill both blanks to create a secure password hash and verify it correctly.

PHP

<?php
$hash = password_[1]($password, PASSWORD_DEFAULT);
if (password_[2]($password, $hash)) {
    echo 'Password is valid';
}
?>

Drag options to blanks, or click blank then click option'

Ahash

Bverify

Ccheck

Dencrypt

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect function names like password_encrypt or password_check.

Not verifying the password properly.

password_hash creates a secure hash, and password_verify checks if the password matches the hash.

5fill in blank

hard

Fill all three blanks to safely escape output and prevent cross-site scripting (XSS).

PHP

<?php
$user_input = '<script>alert(1);</script>';
$safe_output = htmlspecialchars($user_input, [1], [2], [3]);
echo $safe_output;
?>

Drag options to blanks, or click blank then click option'

AENT_QUOTES

BUTF-8

Ctrue

DENT_NOQUOTES

Attempts:

3 left

💡 Hint

Common Mistakes

Not escaping output leads to XSS vulnerabilities.

Using wrong flags or encoding causes improper escaping.

htmlspecialchars uses ENT_QUOTES to convert quotes, UTF-8 as charset, and true for double_encode to safely escape output.