PHP Application Security: Top 10 Vulnerabilities in Practice

Online Python Trainer for Beginners

Learn Python easily without overwhelming theory. Solve practical tasks with automatic checking, get hints in Russian, and write code directly in your browser — no installation required.

Start Course

PHP Application Security: Top 10 Vulnerabilities in Practice

PHP remains one of the most popular languages for web development, but its flexibility often leads to serious security issues. According to OWASP, 80% of attacks on web applications are related to vulnerabilities that can be prevented at the code writing stage. In this article, we will break down the 10 most common PHP application vulnerabilities with real code examples and protection methods. The material will be useful for both beginner and experienced developers.

1. SQL Injection

The most dangerous and common vulnerability. An attacker injects SQL code through input fields, gaining access to the database.

Vulnerable code:

$username = $_POST['username'];$query = "SELECT * FROM users WHERE username = '$username'";

Attack: Inputting ' OR '1'='1 turns the query into SELECT * FROM users WHERE username = '' OR '1'='1', returning all users.

Protection: Use prepared statements with PDO:

$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");$stmt->execute(['username' => $_POST['username']]);

2. XSS (Cross-Site Scripting)

An attacker injects JavaScript code that executes in the victim's browser. There are three types: reflected, stored, and DOM-based.

Vulnerable code (stored XSS):

echo "<div>" . $comment . "</div>";

Protection: Escape output using htmlspecialchars():

echo "<div>" . htmlspecialchars($comment, ENT_QUOTES, 'UTF-8') . "</div>";

For HTML content, use libraries like HTML Purifier.

3. CSRF (Cross-Site Request Forgery)

An attack forces an authenticated user to perform an unwanted action on the site, such as changing a password or transferring funds.

Protection: Implement CSRF tokens:

// Generate token$_SESSION['csrf_token'] = bin2hex(random_bytes(32));

// In the formecho '<input type="hidden" name="csrf_token" value="' . $_SESSION['csrf_token'] . '">';

// Verificationif ($_POST['csrf_token'] !== $_SESSION['csrf_token']) {    die('CSRF attack detected');}

4. Path Traversal

An attacker manipulates file paths to gain access to system files (/etc/passwd, etc.).

Vulnerable code:

$file = $_GET['file'];include("pages/" . $file);

Protection: Use whitelists or the basename() function:

$allowed = ['home', 'about', 'contact'];$file = basename($_GET['file']);if (in_array($file, $allowed)) {    include("pages/$file.php");} else {    die('Invalid file');}

5. File Upload Vulnerabilities

An attacker uploads a PHP script instead of an image, gaining remote access to the server.

Protection:

Check the file MIME type: $_FILES['file']['type']
Use finfo to determine the actual type
Disable script execution in the upload folder via .htaccess
Generate unique file names: md5(uniqid()) . '.jpg'

$finfo = finfo_open(FILEINFO_MIME_TYPE);$mime = finfo_file($finfo, $_FILES['file']['tmp_name']);$allowed = ['image/jpeg', 'image/png'];if (!in_array($mime, $allowed)) {    die('Invalid file type');}