Alaa Amer

PHP Web Application Security: Comprehensive Protection Guide

PHP Web Application Security: Comprehensive Protection Guide

Specialized Guide by Alaa Amer – Professional Web & App Developer

Application Security is a top priority for any professional PHP developer. In this article, we'll cover the most important security vulnerabilities and how to protect your applications from them.

2️⃣ Protection Against SQL Injection

The Problem:

// Very dangerous - Never do this!
$username = $_POST['username'];
$password = $_POST['password'];

$query = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
$result = mysql_query($query);

Secure Solution:

class SecureAuth {
    private $pdo;

    public function __construct($pdo) {
        $this->pdo = $pdo;
    }

    public function authenticateUser($username, $password) {
        // Use Prepared Statements
        $query = "SELECT id, username, password_hash FROM users WHERE username = :username LIMIT 1";
        $stmt = $this->pdo->prepare($query);
        $stmt->bindParam(':username', $username, PDO::PARAM_STR);
        $stmt->execute();

        $user = $stmt->fetch(PDO::FETCH_ASSOC);

        if ($user && password_verify($password, $user['password_hash'])) {
            return $user;
        }

        return false;
    }

    public function createUser($username, $email, $password) {
        // Hash password
        $hashedPassword = password_hash($password, PASSWORD_DEFAULT);

        $query = "INSERT INTO users (username, email, password_hash, created_at) VALUES (:username, :email, :password, NOW())";
        $stmt = $this->pdo->prepare($query);

        $stmt->bindParam(':username', $username);
        $stmt->bindParam(':email', $email);
        $stmt->bindParam(':password', $hashedPassword);

        return $stmt->execute();
    }
}

4️⃣ Protection Against CSRF Attacks

class CSRFProtection {
    /**
     * Generate CSRF token
     */
    public static function generateToken() {
        if (session_status() == PHP_SESSION_NONE) {
            session_start();
        }

        $token = bin2hex(random_bytes(32));
        $_SESSION['csrf_token'] = $token;
        $_SESSION['csrf_token_time'] = time();

        return $token;
    }

    /**
     * Verify CSRF token
     */
    public static function verifyToken($token) {
        if (session_status() == PHP_SESSION_NONE) {
            session_start();
        }

        // Check if token exists in session
        if (!isset($_SESSION['csrf_token']) || !isset($_SESSION['csrf_token_time'])) {
            return false;
        }

        // Check token expiration (one hour)
        if (time() - $_SESSION['csrf_token_time'] > 3600) {
            unset($_SESSION['csrf_token'], $_SESSION['csrf_token_time']);
            return false;
        }

        // Check token match
        if (hash_equals($_SESSION['csrf_token'], $token)) {
            return true;
        }

        return false;
    }

    /**
     * Create hidden field for form
     */
    public static function getFormField() {
        $token = self::generateToken();
        return "<input type=\"hidden\" name=\"csrf_token\" value=\"{$token}\">";
    }
}

// In form
echo CSRFProtection::getFormField();

// When receiving form
if ($_POST && CSRFProtection::verifyToken($_POST['csrf_token'])) {
    // Process data safely
    processForm();
} else {
    die('Invalid CSRF token');
}

6️⃣ Setting Security Headers

class SecurityHeaders {
    public static function setSecurityHeaders() {
        // Prevent loading page in iframe (Clickjacking protection)
        header('X-Frame-Options: DENY');

        // Prevent MIME type sniffing
        header('X-Content-Type-Options: nosniff');

        // Enable XSS protection in browser
        header('X-XSS-Protection: 1; mode=block');

        // Force HTTPS
        header('Strict-Transport-Security: max-age=31536000; includeSubDomains');

        // Content Security Policy
        header("Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'");

        // Remove server information
        header_remove('X-Powered-By');
    }
}

// Apply headers at the beginning of each page
SecurityHeaders::setSecurityHeaders();

💡 Summary of Security Best Practices

1. Don't trust any user input - Clean and validate everything
2. Always use HTTPS - Especially for sensitive data
3. Apply principle of least privilege - Give minimum necessary permissions
4. Keep applications updated - Follow new security vulnerabilities
5. Use security scanning tools - Like OWASP ZAP

Next Step

Learn Penetration Testing and Security Auditing for PHP applications.

📩 Need security consultation for your application?