AI-Generated PHP: 6 Dangerous Code Patterns You Must Never Copy Blindly

Why AI-Written PHP Looks Fine Locally But Explodes in Production

Core logic: AI optimizes for "runnable" code, not "secure" code. It defaults to the simplest path, omitting validation, boundary checks, and security hardening. PHP's weak typing hides hazards locally; they detonate in production with malicious input.

Key principle: If you don't explicitly ask for security, AI won't provide it.

Six Categories of AI-Generated PHP Code You Must Never Copy Blindly

1. Database Queries: SQL Concatenation Is a Minefield

AI often concatenates user input directly into SQL:

$id = $_GET["id"]; $sql = "SELECT * FROM user WHERE id = $id";

Works with numeric IDs locally, but attackers can inject SQL via crafted input, exposing the entire database.

Correct practice: Enforce parameter binding or framework ORM; never concatenate SQL strings. Reject any AI code that builds queries via string concatenation.

2. File Uploads: Suffix-Only Validation Opens the Door to Webshells

AI typically checks only file extensions (e.g., .jpg, .png). Attackers upload files like xxx.php.jpg or info.png.php; under certain server configurations these execute as PHP, planting a webshell.

Correct practice: Validate MIME type and file magic bytes, rename uploaded files, and disable script execution in the upload directory. Treat every AI file-upload snippet as incomplete until manually hardened.

3. Authentication & Authorization: Loose Comparison (==) Enables Privilege Escalation

AI loves loose comparison for role checks: if ($user["level"] == 1) // admin Due to PHP's type juggling, an attacker sending level=1abc gets coerced to integer 1, granting admin rights to a regular user.

Correct practice: Always use strict comparison === for permission and identity checks; enable strict mode for critical business logic.

4. Payment & Order Amount Logic: Floating-Point Math and Missing Idempotency Cause Financial Accidents

AI may calculate amounts with floating-point numbers or trust client-sent totals, often omitting idempotency keys. In production, payment errors are not mere bugs—they are financial incidents.

Correct practice: Represent money as integer cents or strings, recalculate totals server-side, and enforce idempotency controls on order creation. Treat AI output in money-related code as reference only; require line-by-line human review.

5. Dangerous Functions: eval, unserialize, exec, system Without Filtering

For convenience, AI may call high-risk functions without any input sanitization. If user-controllable data reaches these functions, it leads to arbitrary code execution and server compromise.

Correct practice: Avoid unless absolutely necessary; if used, apply strict allow-list filtering. Whenever these functions appear in AI output, pause and ask: "Is the input user-controllable?"

6. Hardcoded Secrets: Leaving Keys in the Codebase

AI sometimes embeds database passwords, payment keys, or encryption salts directly in business logic. Once committed to Git, secrets are exposed.

Correct practice: Store all sensitive configuration in environment variables ( .env); keep zero plaintext secrets in code.

Quick Triage: Three-Second Safety Check for Any AI Snippet

Before merging, run these three checks:

Input validation: Are all user inputs validated and sanitized?

Error handling: Do database calls and third-party integrations have try-catch blocks and logging?

Secrets: Does the code contain any plaintext credentials?

Then classify by risk tier:

Safe to use directly: Pure utility helpers with no user input (array manipulation, string formatting).

Use after review: General business logic and data processing; focus on edge cases and fault tolerance.

Never use without line-by-line audit: Database access, file uploads, auth/authorization, payment amounts, dangerous functions—require full human review before deployment.

Prompt Template to Make AI Produce Safer PHP (Copy-Paste Ready)

Append this to your requirement:

"Write PHP code to production standards: validate and sanitize all user inputs; use parameter binding for all database operations, never concatenate SQL; use strict comparison (===) for permission checks; allow-list any dangerous functions; store secrets in environment variables; include exception handling and logging; after the code, list the potential risk points of this snippet."

Pro tip: Don't ask AI to generate a whole large module at once. Request a skeleton first, then generate piece by piece, reviewing each segment separately—this dramatically improves controllability.

Final Reality Check

AI is not unusable; you just need to know what to trust and what to guard yourself.

Simple rule: The closer the code is to money, permissions, or data security, the more you must own it.

Delegate repetitive CRUD, boilerplate, and documentation to AI; keep architecture, business rules, and security reviews for yourself.

AI output is a draft; only human-reviewed code earns the right to go live.

Bookmark this article and run through the checklist before pasting any AI-generated PHP—it could save you from several on-call nightmares.