PHP Security Best Practices

SQL injection is a severe security vulnerability that allows attackers to manipulate SQL queries and gain unauthorized access to your database. To prevent SQL injection, never concatenate user inputs directly into SQL queries. Instead, use prepared statements with parameterized queries. Here’s an example:

// Vulnerable code (Not recommended)
$username = $_POST[‘username’];
$password = $_POST[‘password’];
$query = “SELECT * FROM users WHERE username=’$username’ AND password=’$password'”;

// Secure code (Recommended)
$stmt = $conn->prepare(“SELECT * FROM users WHERE username=? AND password=?”);
$stmt->bind_param(“ss”, $username, $password);
$stmt->execute();

XSS occurs when attackers inject malicious scripts into web pages viewed by other users. To prevent XSS, always sanitize and escape user inputs before displaying them in the output. Use functions like htmlspecialchars() or HTML Purifier to neutralize potential script tags. Here’s an example:

// Vulnerable code (Not recommended)
$user_input = $_GET[‘input’];
echo $user_input;

// Secure code (Recommended)
$user_input = $_GET[‘input’];
echo htmlspecialchars($user_input, ENT_QUOTES, ‘UTF-8’);

CSRF attacks trick users into performing unintended actions on a website they are logged into. To prevent CSRF, generate and validate unique tokens for each user session to ensure that form submissions originate from your website. Here’s an example:

// Generate CSRF token and store it in the session
if (!isset($_SESSION[‘csrf_token’])) {
$_SESSION[‘csrf_token’] = bin2hex(random_bytes(32));
}

// Include the CSRF token in the form
echo ‘<input type=”hidden” name=”csrf_token” value=”‘ . $_SESSION[‘csrf_token’] . ‘”>’;

// Validate the CSRF token on form submission
if ($_POST[‘csrf_token’] === $_SESSION[‘csrf_token’]) {
// Proceed with form processing
} else {
// CSRF attack detected
// Handle the error
}

Always validate and sanitize user inputs to ensure they meet the expected format and are free from malicious content. Use functions like filter_var() or regular expressions for validation and filter_input() for sanitization. Here’s an example:

// Validate and sanitize email input
$email = $_POST[’email’];
if (filter_var($email, FILTER_VALIDATE_EMAIL)) {
// Valid email address
$clean_email = filter_var($email, FILTER_SANITIZE_EMAIL);
} else {
// Invalid email address
// Handle the error
}