PHP Application Security: Top 10 Vulnerabilities and Protection

Online Python Trainer for Beginners

Learn Python easily without overwhelming theory. Solve practical tasks with automatic checking, get hints in Russian, and write code directly in your browser — no installation required.

Start Course

Top 10 PHP Application Vulnerabilities: How to Protect Your Code

PHP remains one of the most popular languages for web development. However, its flexibility and simplicity often lead to critical vulnerabilities. According to OWASP statistics, more than 70% of web applications have at least one serious security breach. In this article, we will analyze the 10 most common PHP application vulnerabilities, show examples of dangerous code, and provide practical recommendations for protection.

1. SQL Injection

The most well-known and dangerous attack. An attacker injects SQL code through user input.

Dangerous code:

<?php$id = $_GET['id'];$query = "SELECT * FROM users WHERE id = $id";$result = mysqli_query($conn, $query);?>

Secure code (using prepared statements):

<?php$stmt = $conn->prepare("SELECT * FROM users WHERE id = ?");$stmt->bind_param("i", $_GET['id']);$stmt->execute();$result = $stmt->get_result();?>

Recommendations:

Always use prepared statements (PDO or MySQLi).
Never concatenate user data into SQL queries.
Validate data types (e.g., is_numeric() for IDs).

2. XSS (Cross-Site Scripting)

Injecting JavaScript code into a page through unverified data. Cookie theft, redirection to phishing sites.

Dangerous code:

<?phpecho "Hello, " . $_GET['name'];?>

Secure code:

<?phpecho "Hello, " . htmlspecialchars($_GET['name'], ENT_QUOTES, 'UTF-8');?>

Recommendations:

Escape output using htmlspecialchars().
Set Content-Security-Policy (CSP) in headers.
For JSON responses, use json_encode().

3. CSRF (Cross-Site Request Forgery)

An attacker forces an authenticated user to perform an unwanted action (e.g., money transfer).

Example of a form without protection:

<form action="delete.php" method="POST">    <input type="hidden" name="id" value="123">    <input type="submit" value="Delete"></form>

Secure code (with token):

<?phpsession_start();if (empty($_SESSION['token'])) {    $_SESSION['token'] = bin2hex(random_bytes(32));}?><form action="delete.php" method="POST">    <input type="hidden" name="token" value="<?= $_SESSION['token'] ?>">    <input type="hidden" name="id" value="123">    <input type="submit" value="Delete"></form>

Recommendations:

Generate unique CSRF tokens for each form.
Verify tokens on the server before executing actions.
Use SameSite Cookie (Lax or Strict).

4. Incorrect Authentication and Session Management

Weak session protection, identifier leakage, session fixation.

Vulnerable code:

<?phpsession_start();if ($_POST['password'] == 'admin123') {    $_SESSION['logged'] = true;}?>

Secure code:

<?phpsession_start();session_regenerate_id(true); // Change session ID after login

// Password hashing$hash = password_hash($_POST['password'], PASSWORD_BCRYPT);if (password_verify($input_password, $hash)) {    $_SESSION['logged'] = true;    $_SESSION['user_agent'] = $_SERVER['HTTP_USER_AGENT'];}?>

Recommendations: