PHP Security Vulnerabilities: Top Exploits, Modern Solutions & Developer FAQs

SQL Injection occurs when untrusted user input is directly concatenated or interpolated into a raw SQL query string. Attackers craft inputs containing single quotes ('), comments (--), or union operators to bypass authentication, dump databases, or modify records.

// DANGEROUS: Direct input interpolation
$email = $_POST['email'];
$password = $_POST['password'];

// Attacker sends: ' OR '1'='1' -- 
$sql = "SELECT * FROM users WHERE email = '$email' AND password = '$password'";
$result = $pdo->query($sql);
$user = $result->fetch();
// Result: Attacker bypasses authentication completely!

// SECURE: Parameterized query & password hashing
$email = trim($_POST['email']);
$password = trim($_POST['password']);

$stmt = $pdo->prepare("SELECT id, password_hash, role FROM users WHERE email = ?");
$stmt->execute([$email]);
$user = $stmt->fetch();

if ($user && password_verify($password, $user['password_hash'])) {
    // Authenticated safely
}

Cross-Site Scripting (XSS) happens when unsanitized user data is embedded directly into web pages. When viewed by other users or administrators, the browser executes the injected JavaScript, allowing attackers to steal session cookies, capture keystrokes, or redirect visitors to phishing portals.

// DANGEROUS: Echoing raw input
$search = $_GET['q'];
?>
<h1>Search Results for: <?php echo $search; ?></h1>

<!-- Attacker injects:
?q=<script>fetch('/log?c='+document.cookie)</script> -->

// SECURE: htmlspecialchars with ENT_QUOTES & UTF-8
function sanitize_html($data) {
    return htmlspecialchars((string)$data, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
}
?>
<h1>Search Results for: <?php echo sanitize_html($_GET['q'] ?? ''); ?></h1>
<!-- Renders as harmless HTML entities: &lt;script&gt; -->

Allowing users to upload files without rigorous validation is one of the quickest paths to full server takeover. If an attacker uploads a script named backdoor.php and the application stores it inside a publicly accessible directory, the attacker can navigate directly to uploads/backdoor.php to execute arbitrary operating system commands.

// DANGEROUS: Naive extension check & public directory
$filename = $_FILES['avatar']['name'];
$ext = pathinfo($filename, PATHINFO_EXTENSION);

// Attacker uploads: payload.php
$target = 'uploads/' . time() . '.' . $ext;
move_uploaded_file($_FILES['avatar']['tmp_name'], $target);

// Attacker visits: /uploads/1718000000.php?cmd=whoami

$allowed_exts = ['jpg', 'jpeg', 'png', 'webp'];
$allowed_mimes = ['image/jpeg', 'image/png', 'image/webp'];

$tmp = $_FILES['avatar']['tmp_name'];
$ext = strtolower(pathinfo($_FILES['avatar']['name'], PATHINFO_EXTENSION));

// 1. Strict extension whitelist
if (!in_array($ext, $allowed_exts, true)) {
    throw new Exception("Invalid file extension.");
}

// 2. Server-side MIME inspection via Fileinfo
$finfo = new finfo(FILEINFO_MIME_TYPE);
$mime = $finfo->file($tmp);
if (!in_array($mime, $allowed_mimes, true)) {
    throw new Exception("Invalid MIME type.");
}

// 3. Generate randomized unique filename
$safe_name = bin2hex(random_bytes(16)) . '.' . $ext;
move_uploaded_file($tmp, UPLOAD_DIR . '/' . $safe_name);

Cross-Site Request Forgery (CSRF) tricks a logged-in user into executing unwanted administrative actions on a web application in which they are currently authenticated. If an admin visits an external phishing site containing a hidden form or an image tag pointing to admin/delete.php?id=10, the victim's browser sends the request with their active session cookie.

// DANGEROUS: State modification via GET without tokens
if (isset($_GET['action']) && $_GET['action'] === 'delete') {
    $id = intval($_GET['id']);
    $pdo->prepare("DELETE FROM posts WHERE id = ?")->execute([$id]);
}

<!-- Malicious third-party website: -->
<img src="https://freshdeveloper.in/admin/posts.php?action=delete&id=1" style="display:none;">

// 1. Generate token on session init
if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}

// 2. Validate token on POST requests
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $token = $_POST['csrf_token'] ?? '';
    if (!hash_equals($_SESSION['csrf_token'], $token)) {
        http_response_code(403);
        die("CSRF Token Verification Failed.");
    }
    // Proceed safely with deletion
}

Session Fixation occurs when an attacker sets a victim's session identifier to a predetermined value before the victim logs in. If the application fails to renew the session identifier upon successful login, the attacker uses the fixed ID to hijack the authenticated session.

// Apply BEFORE session_start()
ini_set('session.use_strict_mode', 1);
ini_set('session.cookie_httponly', 1); // Disallows JavaScript access to cookie
ini_set('session.cookie_secure', 1);   // Transmit ONLY over HTTPS
ini_set('session.cookie_samesite', 'Strict'); // Protects against cross-site leakage

session_start();

// On Successful User Authentication:
if (password_verify($password, $user['password'])) {
    // Regenerate session ID and delete old session data to prevent fixation
    session_regenerate_id(true);
    $_SESSION['user_id'] = $user['id'];
}

Leaving database dumps (database.sql), environment files (.env), or configuration backups inside the public web document root allows search engines and malicious scanners to download raw secrets.

# 1. Deny access to dotfiles (.git, .env, .htaccess)
<FilesMatch "^\.">
    Order allow,deny
    Deny from all
</FilesMatch>

# 2. Deny direct download of database dumps, logs, and configs
<FilesMatch "\.(sql|bak|config|log|env|yml|yaml|ini)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# 3. Disable directory browsing
Options -Indexes