PHP Application Security: Top 10 Vulnerabilities and Protection

PHP Application Security: Top 10 Vulnerabilities and Protection Methods

PHP remains one of the most popular languages for web development, however its flexibility often leads to vulnerabilities. According to security reports, more than 70% of web applications have at least one critical vulnerability. In this article, we will analyze the top 10 most dangerous PHP vulnerabilities, provide real code examples, and show how to effectively protect your application.

1. SQL Injection

The most common and dangerous vulnerability. An attacker can inject arbitrary SQL code through user input.

Vulnerable code:

<?php$id = $_GET['id'];$query = "SELECT * FROM users WHERE id = $id";$result = mysqli_query($conn, $query);?>

Protection: using Prepared Statements:

<?php$stmt = $conn->prepare("SELECT * FROM users WHERE id = ?");$stmt->bind_param("i", $_GET['id']);$stmt->execute();$result = $stmt->get_result();?>

2. XSS (Cross-Site Scripting)

Injection of malicious scripts into web pages. There are three types: reflected, stored, and DOM-based.

Vulnerable code:

<?phpecho "Hello, " . $_GET['name'];?>

Protection: output escaping:

<?phpecho "Hello, " . htmlspecialchars($_GET['name'], ENT_QUOTES, 'UTF-8');?>

3. CSRF (Cross-Site Request Forgery)

An attack where an attacker forces a user to perform unwanted actions on a site where they are authenticated.

Protection: using CSRF tokens:

<?phpsession_start();if (empty($_SESSION['csrf_token'])) {    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));}

// Verification on form submissionif ($_POST['csrf_token'] !== $_SESSION['csrf_token']) {    die('CSRF attack detected!');}?>

<form method="POST">    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">    <button type="submit">Submit</button></form>

4. Path Traversal

A vulnerability that allows reading arbitrary files on the server.

Vulnerable code:

<?php$file = $_GET['file'];include("pages/" . $file);?>

Protection: validation and path restriction:

<?php$allowed_files = ['about.php', 'contact.php', 'home.php'];$file = basename($_GET['file']);

if (in_array($file, $allowed_files)) {    include("pages/" . $file);} else {    die('Access denied');}?>

5. File Upload

Unsafe file upload can lead to arbitrary code execution on the server.

Protection: checking MIME type and extension:

<?php$allowed_types = ['image/jpeg', 'image/png', 'image/gif'];$max_size = 5 * 1024 * 1024; // 5 MB

if ($_FILES['file']['size'] > $max_size) {    die('File is too large');}

$finfo = finfo_open(FILEINFO_MIME_TYPE);$mime_type = finfo_file($finfo, $_FILES['file']['tmp_name']);

if (!in_array($mime_type, $allowed_types)) {    die('Invalid file type');}

// Rename the file for security$extension = pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION);$new_name = md5(uniqid()) . '.' . $extension;move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/' . $new_name);?>

6. Session Fixation

An attack where an attacker imposes a known session ID on the user.

Protection: session ID regeneration:

<?phpsession_start();

// After successful authenticationi