← PHP theorytheory 0/50 · 0%

level 1

Curious · 0 XP

streak

perfect

badges

100 XP to Apprentice

Security · medium

30. Preventing SQL Injection & XSS

Core web vulnerabilities.

1 min read2 questionsup to 50 XPtopic 30/50

Read in another language

AI translates the explanation and quiz text while preserving code and answer scoring.

SQL injection occurs when untrusted input is concatenated into SQL queries; it's prevented using prepared statements with bound parameters instead of string interpolation. Cross-site scripting (XSS) occurs when untrusted input is rendered as HTML without escaping.

Use htmlspecialchars() (or a templating engine's auto-escaping) when outputting user-supplied data into HTML to prevent XSS, and always validate/whitelist input on the server side regardless of client-side checks.

How to study this topic

1. Read the explanation once end to end, skipping the code.
2. Re-read the code snippets and say out loud what each line does.
3. Answer the quiz without scrolling back — that is the real check.
4. Read every explanation, even for the answers you got right.

Scoring

· Up to 30 XP from quiz accuracy.
· +15 XP for a perfect first attempt.
· +5 XP while a 3-day streak is running.
· 75% or higher marks the topic complete.

Check your understanding

1. What function helps prevent XSS when echoing user input into HTML?
addslashes()htmlspecialchars()strip_tags() aloneurlencode()
2. What is the primary defense against SQL injection?
Filtering out the word 'SELECT'Prepared statements with parameter bindingUsing a NoSQL databaseClient-side validation

Badges

First light

Pass your first topic

Sharp shooter

3 perfect first-try quizzes

On a roll

Study 3 days in a row

Week warrior

Study 7 days in a row

Grinder

Earn 500 XP

Deep diver

Earn 1500 XP