Securing Forms in PHP

PHP

"PHP is a server-side programming language that is flexible, easy to learn, and still the backbone of many websites, even though it is often thought to be outdated"

Hey, PHP warrior!  Ready to shield your forms from evil hackers? Forms are prime targets for cyberattacks like SQL Injection, Cross-Site Scripting (XSS), and CSRF. But don’t worry! By the end of this guide, you’ll turn your PHP forms into Fort Knox-level secure. Let’s dive in! 

Why Secure Your Forms? 

Forms are the gateway to your database! Without security, hackers can:  Steal user data, Inject malicious scripts, Deface your website.

So, let’s put on our security armor and build a super-secure PHP form! 

Setting Up a Secure HTML Form

<form action="secure-form.php" method="post">
    <label for="username">Username:</label>
    <input type="text" name="username" required>
    
    <label for="email">Email:</label>
    <input type="email" name="email" required>
    
    <button type="submit">Submit</button>
</form>

Never trust user input! Always sanitize it before processing. Let’s secure it in PHP!

Prevent SQL Injection

SQL Injection is when attackers insert malicious SQL queries into your form inputs. Here’s how to prevent it:

$conn = new mysqli("localhost", "root", "", "secure_db");
if ($conn->connect_error) die("Connection failed: " . $conn->connect_error);

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $username = $conn->real_escape_string($_POST["username"]);
    $email = $conn->real_escape_string($_POST["email"]);
    
    $stmt = $conn->prepare("INSERT INTO users (username, email) VALUES (?, ?)");
    $stmt->bind_param("ss", $username, $email);
    $stmt->execute();
    
    echo "<p style='color: green;'>User registered securely!</p>";
}

Use prepared statements to prevent SQL injection!

Prevent Cross-Site Scripting (XSS)

Hackers can inject JavaScript into your form fields! Block XSS using:

function sanitizeInput($data) {
    return htmlspecialchars(strip_tags(trim($data)));
}

$username = sanitizeInput($_POST["username"]);
$email = sanitizeInput($_POST["email"]);

Escapes HTML characters, preventing script injections!

Prevent CSRF Attacks

CSRF (Cross-Site Request Forgery) tricks users into executing unintended actions! Protect against it using tokens:

Step 1: Generate a CSRF Token (secure-form.php)

session_start();
$_SESSION["csrf_token"] = bin2hex(random_bytes(32));

Step 2: Add CSRF Token to Form

<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token']; ?>">

Step 3: Verify Token in PHP

if ($_POST["csrf_token"] !== $_SESSION["csrf_token"]) {
    die("<p style='color: red;'>CSRF attack detected!</p>");
}

Protects users from unwanted actions!

Validate & Sanitize All Inputs

if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    die("Invalid email format!");
}
if (!preg_match("/^[a-zA-Z0-9]*$/", $username)) {
    die("Invalid username!");
}

Ensures inputs are safe & formatted correctly!

 Today, you learned:  How to prevent SQL Injection, How to block XSS attacks, How to stop CSRF exploits, How to validate & sanitize input.