Securing PHP Applications 🛡️

Defend against advanced attack vectors — second-order injection, stored XSS, file inclusion, session fixation — and harden your PHP configuration.

What You'll Learn in This Lesson

• Second-order SQL injection and persistent XSS
• File inclusion (LFI/RFI) and insecure deserialization
• Security headers: CSP, HSTS, X-Frame-Options
• php.ini hardening for production servers
• A complete security audit checklist

Note: PHP runs on a server. Our examples simulate PHP logic using JavaScript. To run real PHP, install PHP.

🎯 Real-World Analogy: Defense in depth is like a medieval castle. The moat (input validation) stops most attackers. The walls (prepared statements) block those who get past. The guards (security headers) watch for suspicious behavior. The alarm bells (logging) alert you when something goes wrong. No single layer is perfect, but together they're formidable.

Advanced Attack Vectors

Beyond basic SQL injection and XSS, advanced attacks exploit subtle trust assumptions. Second-order injection uses data that was safely stored but unsafely retrieved. File inclusion exploits dynamic include() calls. Understanding these vectors is essential for building truly secure applications.

Try It: Attack Vectors & Headers

Explore advanced attacks and security header configuration

Try it Yourself »

JavaScript

// Advanced Attack Vectors & Defenses
console.log("=== Beyond the Basics: Advanced Attacks ===");
console.log();

console.log("1️⃣ SECOND-ORDER SQL INJECTION");
console.log("──────────────────────────────");
console.log("Attack: Malicious data is stored safely, then used unsafely later");
console.log("  Registration: name = "admin'--" (stored in DB, escaped on insert)");
console.log("  Later query: SELECT * FROM users WHERE name = '$storedName'");
console.log("  → The stored value breaks out of 
...

PHP Hardening & Defense in Depth

Security isn't a single technique — it's layers of defense. Harden your php.ini, sanitize inputs with filter functions, encode outputs, set secure cookie flags, and audit your dependencies. Each layer catches what the previous one missed.

Try It: Hardening & Sanitization

Harden php.ini, sanitize inputs, and run through a security checklist

Try it Yourself »

JavaScript

// PHP Hardening & Defense in Depth
console.log("=== Defense in Depth ===");
console.log();
console.log("Layer 1: Input Validation (front gate)");
console.log("Layer 2: Parameterized Queries (database armor)");
console.log("Layer 3: Output Encoding (display protection)");
console.log("Layer 4: Security Headers (browser instructions)");
console.log("Layer 5: Logging & Monitoring (detection)");
console.log();

console.log("=== php.ini Hardening ===");
console.log();
let phpIni = [
  ["expose_php",
...

⚠️ Common Mistakes

⚠️

Trusting "sanitized" data later — data that was safe at insert time may be unsafe in a different context. Always encode for the output context (HTML, URL, JS, SQL).

⚠️

Security through obscurity — hiding PHP version or renaming admin URLs is NOT security. It's a speedbump. Focus on proper authentication, authorization, and input validation.

💡

Pro Tip: Run composer audit regularly to find vulnerable dependencies. Automate it in CI/CD so no vulnerable package reaches production.

📋 Quick Reference — Security

Attack	Defense
2nd-order SQLi	Prepared statements everywhere
Stored XSS	htmlspecialchars() + CSP header
File inclusion	Whitelist allowed files
Session fixation	session_regenerate_id(true)
Deserialization	Use json_decode(), never unserialize()
Clickjacking	X-Frame-Options: DENY

🎉 Lesson Complete!

You can now defend against advanced attacks! Next, learn password hashing with Argon2 and secure credential storage.