17. Security
What is the difference between Hashing and Encryption?
JuniorAnswer:
- Hashing: A one-way function that produces a fixed-length string from input. It cannot be reversed (e.g.,
password_hash). - Encryption: A two-way function where data can be converted to ciphertext and then decrypted back to plaintext with a key.
Why do we use Salting when hashing passwords?
JuniorAnswer: To prevent attackers from using precomputed tables (like Rainbow Tables) to crack passwords. A unique salt is added to each password before hashing.
What is the difference between htmlspecialchars and strip_tags?
Junior
Answer:
htmlspecialchars(): Converts special characters (like<,>,&) to HTML entities (like<,>,&). This prevents the browser from interpreting them as HTML/JS but preserves the original text for display.strip_tags(): Removes all HTML and PHP tags from a string. It's more destructive and can be used when you want only plain text input.
What is SQL Injection and how to prevent it?
MiddleAnswer: A vulnerability where an attacker can execute malicious SQL statements. Prevented by using prepared statements and parameterized queries.
What is XSS (Cross-Site Scripting) and how to prevent it?
MiddleAnswer: An attack where malicious scripts are injected into web pages. Prevented by escaping output (using htmlspecialchars) and sanitizing user input.
What is CSRF (Cross-Site Request Forgery) and how to prevent it?
MiddleAnswer: An attack that forces an authenticated user to execute unwanted actions on a web application. Prevented by using CSRF tokens.
What is JWT (JSON Web Token)?
MiddleAnswer: A compact, URL-safe means of representing claims to be transferred between two parties. Often used for stateless authentication.
What is the OWASP Top 10?
SeniorAnswer: A standard awareness document for developers and web application security, representing a broad consensus about the most critical security risks to web applications.