Attack TypeDescriptionPrevention
SQL Injection (SQLi)Injecting SQL queries through user input.Use prepared statements (PDO/MySQLi), parameterized queries, validate input.
Cross-Site Scripting (XSS)Injecting malicious JavaScript into web pages.Use htmlspecialchars(), validate input, implement Content Security Policy (CSP).
Cross-Site Request Forgery (CSRF)Tricks users into submitting unwanted requests.Use CSRF tokens, verify request origin, use SameSite cookies.
File Upload AttackUploading malicious files such as PHP shells.Allow only safe file types, check MIME type, rename files, store uploads outside the web root.
Remote Code Execution (RCE)Executing attacker-controlled code on the server.Avoid eval(), keep PHP updated, validate input, use least privilege.
Command InjectionExecuting operating system commands through user input.Avoid system(), exec(), shell_exec(), or escape arguments with escapeshellarg().
Session HijackingStealing a user's session ID.Use HTTPS, regenerate session IDs, set HttpOnly, Secure, and SameSite cookie flags.
Directory TraversalAccessing files outside the intended directory using paths like ../../.Validate file paths, use allowlists, never trust user-supplied filenames.
Brute Force AttackRepeated attempts to guess passwordsRate limiting, account lockout, CAPTCHA, Multi-Factor Authentication (MFA).
Denial of Service (DoS/DDoS)Overloading the server with excessive requests.Use firewalls, rate limiting, CDNs, and Web Application Firewalls (WAFs).