Essential PHP Security Practices: Input Validation, XSS Prevention, SQL Injection Defense, and Session Protection

In today’s internet era, PHP is widely used for web development, but rising security threats make it essential to harden PHP projects at the code level.

Input Validation

Validate the type and format of user input to prevent malformed data from causing vulnerabilities. The filter_var function can be used for email, URL, and IP validation.

<code>$email = $_POST['email'];
if (filter_var($email, FILTER_VALIDATE_EMAIL)) {
    // Email address is valid
} else {
    // Email address is invalid
}</code>

Filter dangerous characters using functions such as mysqli_real_escape_string or htmlspecialchars to guard against SQL injection and XSS.

<code>$name = mysqli_real_escape_string($conn, $_POST['name']);</code>

Cross‑Site Scripting (XSS) Prevention

Encode output data with htmlspecialchars before rendering it in the browser.

<code>echo htmlspecialchars($data);</code>

Set cookies with the HttpOnly flag to prevent JavaScript access.

<code>setcookie('name', 'value', time() + 3600, '/', '', '', true);</code>

SQL Injection Prevention

Use prepared statements (e.g., PDO) to bind parameters safely.

<code>$stmt = $conn->prepare('SELECT * FROM users WHERE username = :username AND password = :password');
$stmt->bindParam(':username', $username);
$stmt->bindParam(':password', $password);
$stmt->execute();</code>

Limit database user privileges to the minimum required for the application.

Session Protection

Verify the session’s origin by checking the stored IP address and User‑Agent against the current request.

<code>if ($_SESSION['ip_address'] !== $_SERVER['REMOTE_ADDR'] ||
    $_SESSION['user_agent'] !== $_SERVER['HTTP_USER_AGENT']) {
    // Illegal session source
    session_destroy();
}</code>

Set a reasonable session timeout to expire inactive sessions.

<code>ini_set('session.gc_maxlifetime', 3600);
session_set_cookie_params(3600);
session_start();</code>

Conclusion

Ensuring PHP project security requires diligent input validation, XSS and SQL injection defenses, and robust session handling, along with regular updates and vulnerability patches to keep applications reliable and safe.