🔐 PHP Security Interview Questions

🟢 Beginner Level

1. What is SQL Injection?

👉 A vulnerability where attacker inserts malicious SQL into input fields to manipulate database.

2. How do you prevent SQL Injection in PHP?

👉 Using:

Prepared Statements (PDO / MySQLi)
Parameterized queries

3. What is XSS?

👉 Cross-Site Scripting allows attackers to inject JavaScript into web pages viewed by other users.

4. How to prevent XSS in PHP?

👉 Use:

htmlspecialchars($data, ENT_QUOTES, 'UTF-8');

5. What is CSRF?

👉 Cross-Site Request Forgery tricks users into performing unwanted actions.

6. How to prevent CSRF?

👉 Use CSRF tokens stored in session and validated on form submission.

7. What is password hashing?

👉 Converting password into secure hash so original password is not stored.

8. Which function is used for password hashing in PHP?

👉 password_hash()

9. How to verify password?

👉 password_verify()

10. What is data sanitization?

👉 Cleaning user input to remove unwanted or harmful data.

🟡 Intermediate Level

11. Difference between sanitization and validation?

👉

Validation → Check if data is correct
Sanitization → Clean the data

12. What is session hijacking?

👉 Attacker steals session ID to impersonate user.

13. How to prevent session hijacking?

👉

Use HTTPS
Regenerate session ID
Set secure cookies

14. What are secure cookies?

👉 Cookies with:

session_set_cookie_params([
    'secure' => true,
    'httponly' => true,
    'samesite' => 'Strict'
]);

15. What is SameSite cookie attribute?

👉 Prevents CSRF by restricting cross-site cookie sending.

16. What is clickjacking?

👉 Attacker tricks user into clicking hidden elements.

17. How to prevent clickjacking?

header("X-Frame-Options: SAMEORIGIN");

18. What is Content Security Policy (CSP)?

👉 A security layer to prevent XSS by controlling resources.

19. What is file upload vulnerability?

👉 Uploading malicious files (like .php) to server.

20. How to secure file uploads?

👉

Validate file type
Rename file
Store outside public folder

🔴 Advanced Level

21. What is prepared statement internally?

👉 SQL query compiled first, then parameters safely bound → prevents injection.

22. What is output escaping vs input filtering?

👉

Input filtering → Clean data before saving
Output escaping → Secure display

23. What is the difference between htmlentities() and htmlspecialchars()?

👉

htmlspecialchars() → Converts basic characters
htmlentities() → Converts all HTML entities

24. What is timing attack in password comparison?

👉 Attacker measures response time to guess password.

👉 Prevent using:

hash_equals()

25. What is CORS and is it a security feature?

👉 Cross-Origin Resource Sharing
❗ Not a security feature, just controlled access mechanism

26. What is rate limiting?

👉 Limiting number of requests per user/IP to prevent abuse.

27. How to secure APIs in PHP?

👉

API keys / tokens
JWT authentication
Rate limiting
HTTPS

28. What is JWT?

👉 JSON Web Token used for secure authentication.

29. What are common PHP security best practices?

👉

Disable display_errors
Use HTTPS
Keep PHP updated
Validate all inputs
Use least privilege DB access

30. What is OWASP?

👉 Organization that lists top web security risks (OWASP Top 10)

💡 Pro Interview Tips

👉 Always mention:

Prepared Statements
CSRF Token
XSS Prevention
Password Hashing

👉 Real-world example = BIG PLUS ⭐

🇮🇳 Amazon India 🌍 Amazon Global

PHP Security Interview Questions (Beginner → Advanced)