SQL injection is the most common and dangerous vulnerability in student PHP projects. It occurs when user input is inserted directly into a SQL query using string concatenation. An attacker can type ' OR '1'='1 into a login form and bypass authentication entirely — or worse, dump your entire database.

// VULNERABLE — never do this
$id = $_GET['id'];  // Could be: 1 OR 1=1
$sql = "SELECT * FROM customers WHERE id = '$id'";
mysqli_query($conn, $sql);

// Login bypass: enter username: admin'-- and any password
$sql = "SELECT * FROM users WHERE username='$u' AND password='$p'";
// With u = "admin'--", the password check is commented out!

// FIXED — always use prepared statements
$id = (int)$_GET['id']; // Cast to int for numeric IDs — fastest fix

// For strings: use prepared statement with ? placeholder
$stmt = mysqli_prepare($conn,
    "SELECT * FROM customers WHERE id = ?");
mysqli_stmt_bind_param($stmt, 'i', $id); // 'i'=int, 's'=string
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

Storing passwords as plain text means that anyone who accesses your database — through a SQL injection attack, a server breach, or even a careless phpMyAdmin session left open — can read every user’s password instantly. MD5 and SHA1 are also insecure — they are too fast to compute and have been cracked extensively. PHP’s password_hash() uses bcrypt by default, which is deliberately slow and virtually impossible to crack at scale.

// VULNERABLE — all three of these are wrong
$password = $_POST['password'];           // Plain text — worst
$password = md5($_POST['password']);     // MD5 — broken, do NOT use
$password = sha1($_POST['password']);    // SHA1 — also broken
$sql = "SELECT * FROM users WHERE password='$password'";

// FIXED — use password_hash() to store, password_verify() to check
// When creating/saving a password:
$hash = password_hash($_POST['password'], PASSWORD_DEFAULT);
// Store $hash in database — it looks like: $2y$10$abc123...

// When verifying login:
$stmt = mysqli_prepare($conn,
    "SELECT password_hash FROM users WHERE username = ?");
mysqli_stmt_bind_param($stmt, 's', $username);
mysqli_stmt_execute($stmt);
$user = mysqli_fetch_assoc(mysqli_stmt_get_result($stmt));
if ($user && password_verify($_POST['password'], $user['password_hash'])) {
    // Login successful
}

XSS occurs when user-submitted content is displayed on a page without escaping. If a user enters <script>alert('hacked')</script> into a name field and you display it directly, the script executes in every visitor’s browser. In real attacks, XSS is used to steal session cookies (and thus hijack logged-in accounts) or redirect users to malicious sites.

// VULNERABLE — direct echo of user data
echo "Welcome, " . $_SESSION['username'];
echo "<td>" . $row['customer_name'] . "</td>";
echo "Search results for: " . $_GET['q']; // Reflected XSS

// FIXED — wrap every output of user-supplied data in htmlspecialchars()
echo "Welcome, " . htmlspecialchars($_SESSION['username'], ENT_QUOTES, 'UTF-8');
echo "<td>" . htmlspecialchars($row['customer_name'], ENT_QUOTES, 'UTF-8') . "</td>";

// Shorthand helper function — define once, use everywhere:
function h($str) {
    return htmlspecialchars((string)$str, ENT_QUOTES, 'UTF-8');
}
echo "Welcome, " . h($_SESSION['username']); // Clean!

CSRF (Cross-Site Request Forgery) tricks a logged-in user into unknowingly submitting a form on your site. An attacker embeds a hidden form on their own website that POSTs to your delete or update endpoint. If the victim visits their page while logged into yours, the action executes as that user. CSRF tokens prevent this by requiring a secret value that only your site knows.

// VULNERABLE — no CSRF token — anyone can submit this form remotely
if ($_POST['delete_customer']) {
    $id = (int)$_POST['id'];
    mysqli_query($conn, "DELETE FROM customers WHERE id='$id'");
}

// FIXED — generate token in session, embed in form, verify on submission
if (session_status() === PHP_SESSION_NONE) session_start();

// Generate token once per session (in your auth_check.php or similar):
if (!isset($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}

// In your HTML form — add this hidden input:
// <input type="hidden" name="csrf_token"
//        value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">

// On form submission — verify before doing anything:
if (!isset($_POST['csrf_token'])
    || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
    die('CSRF token mismatch — request rejected.');
}
// Safe to proceed with the action now

If a session ID is not regenerated immediately after login, an attacker who obtained the pre-login session ID (perhaps via XSS on the login page) can use it to hijack the authenticated session. This is called session fixation. The fix is one line added immediately after successful authentication.

// VULNERABLE — session ID is the same before and after login
if ($user && password_verify($password, $user['hash'])) {
    $_SESSION['user_id'] = $user['id'];  // Old session ID still valid!
    header('Location: dashboard.php');
}

// FIXED — one line immediately after successful login
if ($user && password_verify($password, $user['hash'])) {
    session_regenerate_id(true); // ← THIS LINE — new ID, old one invalid
    $_SESSION['user_id'] = $user['id'];
    header('Location: dashboard.php');
}

A file upload form without validation allows an attacker to upload a PHP file disguised as a profile photo. If that PHP file lands in a web-accessible directory, the attacker can execute arbitrary code on your server by visiting the uploaded file’s URL. This is one of the most devastating web vulnerabilities.

// VULNERABLE — no type check, uses original filename (attacker controls)
move_uploaded_file($_FILES['photo']['tmp_name'],
    'uploads/' . $_FILES['photo']['name']); // Can be "shell.php"!

// FIXED — validate type via MIME and extension, rename to safe filename
$allowed_types = ['image/jpeg', 'image/png', 'image/gif'];
$allowed_exts  = ['jpg', 'jpeg', 'png', 'gif'];
$max_size      = 2 * 1024 * 1024; // 2MB

$file    = $_FILES['photo'];
$mime    = mime_content_type($file['tmp_name']); // Check actual file content
$ext     = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));

if (!in_array($mime, $allowed_types)
    || !in_array($ext, $allowed_exts)
    || $file['size'] > $max_size) {
    die('Invalid file type or size.');
}
// Rename to prevent path traversal and PHP execution
$safe_name = uniqid('img_', true) . '.' . $ext;
move_uploaded_file($file['tmp_name'], 'uploads/' . $safe_name);

Database passwords, Gmail app passwords, and API keys committed to a public GitHub repository are exposed to automated bots that scan GitHub continuously. These bots find credentials within minutes and use them to access your database or send spam emails from your account. The fix is to add config files to .gitignore before the first commit — fixing it after the commit requires deleting the entire git history, which is complex.

# Add this to your .gitignore file
config/dbconnection.php
config/email_config.php
*.env
.env
config.php
# Template versions (no real credentials) are fine to commit:
# config/dbconnection.example.php

When PHP errors are displayed on screen in production, they reveal your file structure, database names, and code logic to visitors. An attacker can deliberately trigger errors to gather information about your system. Add this to the top of your main config file on the live server:

// In your config or bootstrap file — production settings
ini_set('display_errors', '0');      // Hide from browser
ini_set('log_errors', '1');          // Log to server file instead
error_reporting(E_ALL);              // Still record all errors
// On XAMPP (development): set display_errors to '1' for debugging

Even with prepared statements, accepting any value in a form field causes problems. An age field that accepts -9999 or a status field that accepts '; DROP TABLE can cause data corruption or unexpected application behaviour. Validate that inputs match the expected type and range before processing.

// Validate expected data types before using them
$age    = filter_input(INPUT_POST, 'age', FILTER_VALIDATE_INT,
              ['options' => ['min_range' => 1, 'max_range' => 120]]);
$email  = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
$status = in_array($_POST['status'], ['active', 'inactive', 'suspended'])
          ? $_POST['status'] : null; // Whitelist allowed values

if (!$age || !$email || !$status) {
    $errors[] = 'Please provide valid input for all fields.';
}

HTTP security headers instruct the browser to apply extra protections. They are set in PHP with header() and provide a significant security improvement for minimal effort. Add them to your auth_check.php or a global header file so they apply to every page.

// Add to your auth_check.php or main config — applies to every page
header('X-Content-Type-Options: nosniff');     // Prevent MIME sniffing
header('X-Frame-Options: DENY');                // Block clickjacking iframes
header('X-XSS-Protection: 1; mode=block');      // Browser XSS filter
header("Referrer-Policy: strict-origin-when-cross-origin");
header("Content-Security-Policy: default-src 'self'; "
     . "script-src 'self' cdn.jsdelivr.net; "  // Allow Bootstrap CDN
     . "style-src 'self' 'unsafe-inline' cdn.jsdelivr.net");