Here is a set of 100 multiple-choice questions rigorously designed to align with the provided focus areas
and exam pattern.
---
Section 1: HTML and the DOM Structure (30 Questions)
1. What is the primary purpose of the <!DOCTYPE html> declaration?
a) To link the HTML document to a CSS file.
b) To tell the browser which version of HTML to expect.
c) To create the root element of the page.
d) To enable server-side scripting.
Answer: b) To tell the browser which version of HTML to expect.
2. In the browser, the 'window' object represents:
a) The entire HTML document's content.
b) The browser's tab or the window itself.
c) A frame inside the page.
d) The browser's history stack.
Answer: b) The browser's tab or the window itself.
3. Which statement accurately describes the relationship between the 'document' object and the
'window' object?
a) They are the same object and can be used interchangeably.
b) The 'window' object is a property of the 'document' object.
c) The 'document' object is a property of the 'window' object.
d) The 'document' object contains the 'window' object.
Answer: c) The 'document' object is a property of the 'window' object.
4. Which of the following is a valid and complete HTML element?
a) <p>
b) </p>
c) <p>This is a paragraph.</p>
d) p
Answer: c) <p>This is a paragraph.</p>
5. A user sees "Hello World" in bold on a webpage. What is the most fundamental structure that caused
this?
a) A CSS rule declaring font-weight: bold.
b) A JavaScript function modifying the DOM.
c) A DOM node represented by a <b> tag in the HTML source.
d) An HTTP request header specifying text formatting.
Answer: c) A DOM node represented by a <b> tag in the HTML source.
6. In the DOM tree, what are the direct children of the html element?
a) head and body
b) title and h1
c) meta and div
d) window and document
Answer: a) head and body
7. The [Link] property can be used to:
a) Get or set the URL of the current page.
b) Access the browser's geolocation.
c) Reference the physical file path on the server.
d) Determine the screen coordinates of the window.
Answer: a) Get or set the URL of the current page.
8. A web developer wants to store data on the user's browser with no expiration date. Which object
should they use?
a) [Link]
b) [Link]
c) [Link]
d) [Link]
Answer: a) [Link]
9. Which method is used to select a single HTML element from the DOM using a CSS selector string?
a) [Link]
b) [Link]
c) [Link]
d) [Link]
Answer: b) [Link]
10. If a tag is not closed properly, what is the most likely outcome?
a) The browser will throw a fatal JavaScript error.
b) The browser will attempt to render it correctly but the DOM structure may be unpredictable.
c) The page will fail to load entirely.
d) The server will automatically correct the code before sending it.
Answer: b) The browser will attempt to render it correctly but the DOM structure may be unpredictable.
11. Which method creates a new HTML element that is not yet attached to the document?
a) [Link]('div')
b) [Link]('div')
c) [Link]('<div></div>')
d) new HTMLDivElement()
Answer: a) [Link]('div')
12. What does the [Link] object allow a script to do?
a) Delete the user's browsing history.
b) Move the user forward or backward in their session history for the tab.
c) Access the URLs of all previously visited websites.
d) Modify the content of previously visited pages.
Answer: b) Move the user forward or backward in their session history for the tab.
13. In an HTML document, the <title> element is placed inside:
a) The <body> section.
b) The <head> section.
c) Anywhere, as it is not a structural element.
d) The <footer> section.
Answer: b) The <head> section.
14. The [Link] object provides information about:
a) The browser window's current dimensions.
b) The user's entire display/screen dimensions.
c) The visible area of the webpage.
d) The number of iframes on the page.
Answer: b) The user's entire display/screen dimensions.
15. Which statement about DOM nodes is true?
a) Only HTML elements are considered nodes.
b) Text content and comments are also types of nodes.
c) Nodes only exist after JavaScript manipulates them.
d) Every node must have a closing tag.
Answer: b) Text content and comments are also types of nodes.
16. The [Link]('main') method will return:
a) An array of all elements with the ID 'main'.
b) The first element with the class 'main'.
c) A single element object with the ID 'main'.
d) A NodeList of all elements with the ID 'main'.
Answer: c) A single element object with the ID 'main'.
17. If a script attempts to modify an element before the DOM is fully constructed, what can happen?
a) The change will be queued and applied later automatically.
b) The script will throw an error because the element does not yet exist.
c) The browser will crash.
d) The change will be applied to the next page loaded.
Answer: b) The script will throw an error because the element does not yet exist.
18. What is the purpose of semantic HTML tags like <article>, <nav>, and <aside>?
a) They apply specific styling like italics or bold.
b) They provide meaning and structure to the content for browsers and assistive technologies.
c) They are required for the page to validate on W3C.
d) They are obsolete tags replaced by <div> in HTML5.
Answer: b) They provide meaning and structure to the content for browsers and assistive technologies.
19. Which object provides a method to control repetitive actions, like setInterval?
a) document
b) console
c) window
d) element
Answer: c) window
20. An HTML attribute is best defined as:
a) The content between the opening and closing tags.
b) The tag name itself, like img.
c) Additional information provided inside the opening tag to configure the element.
d) A CSS property applied to the element.
Answer: c) Additional information provided inside the opening tag to configure the element.
21. What is the primary function of the window object's addEventListener method?
a) To add a new HTML element to the document.
b) To attach a function that will be called when a specified event occurs.
c) To add a new property to the window object itself.
d) To log events to the browser's console.
Answer: b) To attach a function that will be called when a specified event occurs.
22. In a URL, the fragment identifier (the part after a #) can be accessed via JavaScript using:
a) [Link]
b) [Link]
c) [Link]
d) [Link]
Answer: c) [Link]
23. The document object's title property:
a) Is read-only and cannot be changed.
b) Gets or sets the text of the <title> tag.
c) Returns the filename of the HTML document.
d) Is used to set the browser tab's icon.
Answer: b) Gets or sets the text of the <title> tag.
24. Which of the following is NOT a core component of the Document Object Model?
a) Nodes
b) Elements
c) Compilers
d) Attributes
Answer: c) Compilers
25. If an HTML tag has an attribute like disabled, what does this typically indicate?
a) The tag will not be rendered by the browser.
b) The element is present but cannot be interacted with.
c) The element's content is hidden.
d) The tag is invalid HTML.
Answer: b) The element is present but cannot be interacted with.
26. The [Link]() method is used to:
a) Open a file from the local file system.
b) Open a new browser window or tab.
c) Open the browser's developer tools.
d) Open a connection to the server.
Answer: b) Open a new browser window or tab.
27. What does the [Link] property return?
a) A single object representing the first <script> tag.
b) A collection of all <script> elements on the page.
c) The source code of all scripts running on the page.
d) A boolean value indicating if scripts are enabled.
Answer: b) A collection of all <script> elements on the page.
28. The DOM represents an HTML document as:
a) A flat list of tags.
b) A tree structure.
c) A series of text files.
d) A set of instructions for the printer.
Answer: b) A tree structure.
29. To get the text content of a DOM node and all its descendants, you would use the property:
a) [Link]
b) [Link]
c) [Link]
d) [Link]
Answer: c) [Link]
30. What is the role of the browser's rendering engine concerning the DOM?
a) It creates the DOM from the HTML source.
b) It executes JavaScript code.
c) It manages network requests.
d) It stores cookies and session data.
Answer: a) It creates the DOM from the HTML source.
---
Section 2: JavaScript (Function Scope, Event Loop, DOM Manipulation, Math) (25 Questions)
31. What is the fundamental difference between var and let when declaring a variable inside a block
{ ... }?
a) There is no difference; they are interchangeable.
b) var is block-scoped, let is function-scoped.
c) var is function-scoped, let is block-scoped.
d) var cannot be reassigned, let can.
Answer: c) var is function-scoped, let is block-scoped.
32. Given the code: let x = 10; function test() { let x = 20; } test(); [Link](x); What is the output?
a) 20
b) undefined
c) 10
d) ReferenceError
Answer: c) 10
33. What is a closure in JavaScript?
a) A function that has access to variables from its outer (enclosing) scope even after the outer function
has returned.
b) A way to close the browser window.
c) A method for ending a loop prematurely.
d) A syntax error where brackets are not closed.
Answer: a) A function that has access to variables from its outer (enclosing) scope even after the outer
function has returned.
34. Which of the following is a correct description of the Event Loop?
a) A queue that holds all the global variables.
b) A mechanism that continuously checks the call stack and the callback queue, moving callbacks to the
stack when it is empty.
c) A loop that iterates over every HTML element on the page.
d) The process of looping through an array.
Answer: b) A mechanism that continuously checks the call stack and the callback queue, moving
callbacks to the stack when it is empty.
35. What will [Link](2 + '2') output?
a) 4
b) '22'
c) 22
d) NaN
Answer: b) '22'
36. The [Link]() function in JavaScript returns:
a) A random integer between 0 and 1.
b) A pseudo-random number between 0 (inclusive) and 1 (exclusive).
c) A random number between 1 and 100.
d) A cryptographically secure random number.
Answer: b) A pseudo-random number between 0 (inclusive) and 1 (exclusive).
37. How would you generate a random integer between 1 and 10 (inclusive)?
a) [Link]([Link]() * 10)
b) [Link]([Link]() * 10)
c) [Link]([Link]() * 10) + 1
d) [Link]([Link]() * 10)
Answer: c) [Link]([Link]() * 10) + 1
38. What is the primary purpose of the [Link]('myDiv').innerHTML = '<p>New</p>';
statement?
a) To change the CSS style of the element.
b) To parse the string as HTML and replace the content of the element.
c) To add a new attribute to the element.
d) To remove the element from the DOM.
Answer: b) To parse the string as HTML and replace the content of the element.
39. In the context of the Event Loop, where are callback functions from asynchronous operations (like
setTimeout) placed when they are ready to be executed?
a) The Call Stack
b) The Memory Heap
c) The Callback Queue (or Task Queue)
d) The Garbage Collector
Answer: c) The Callback Queue (or Task Queue)
40. What is the result of [Link]() called with no arguments?
a) 0
b) undefined
c) -Infinity
d) Infinity
Answer: c) -Infinity
41. Which statement correctly manipulates the DOM by adding a new class to an element?
a) [Link]('box').className = 'new-class';
b) [Link]('box').[Link]('new-class');
c) [Link]('box').[Link] = 'new-class';
d) [Link]('box').setClass('new-class');
Answer: b) [Link]('box').[Link]('new-class');
42. What is the output of this code? for (var i = 0; i < 3; i++) { setTimeout(() => { [Link](i); }, 100); }
a) 0, 1, 2
b) 3, 3, 3
c) 1, 2, 3
d) undefined, undefined, undefined
Answer: b) 3, 3, 3 (Explanation: var is function-scoped, so by the time the callback runs, the loop has
finished and i is 3.)
43. If you change var to let in the previous loop, what will be the output?
a) 3, 3, 3
b) 0, 1, 2
c) 1, 2, 3
d) ReferenceError
Answer: b) 0, 1, 2 (Explanation: let is block-scoped, creating a new binding for i in each iteration of the
loop.)
44. The [Link](4.9) method returns:
a) 5
b) 4.9
c) 4
d) 5.0
Answer: c) 4
45. To remove an element from the DOM, you would:
a) Set its innerHTML to an empty string.
b) Use the removeChild() or remove() method on its parent or itself.
c) Set its display style to none.
d) Set its hidden attribute to false.
Answer: b) Use the removeChild() or remove() method on its parent or itself.
46. What does the [Link](2, 3) function return?
a) 6
b) 8
c) 9
d) 2/3
Answer: b) 8
47. Which of the following is NOT a valid way to create a function in JavaScript?
a) function myFunc() {}
b) let myFunc = function() {};
c) let myFunc = () => {};
d) function: myFunc() {}
Answer: d) function: myFunc() {}
48. The global isNaN() function checks if a value:
a) Is equal to NaN.
b) Is not a number.
c) Is an empty string.
d) Is an infinite number.
Answer: b) Is not a number. (Note: It has coercion quirks, which is why [Link]() is often
preferred.)
49. What will be logged? [Link](0.1 + 0.2 === 0.3);
a) true
b) false
c) 0.3
d) SyntaxError
Answer: b) false (Explanation: Due to floating-point precision issues, 0.1 + 0.2 equals
0.30000000000000004.)
50. Which DOM manipulation method is most efficient for changing multiple properties of an element at
once?
a) Changing innerHTML.
b) Setting each style property individually.
c) Modifying the className or classList.
d) Using [Link]().
Answer: c) Modifying the className or classList.
51. The [Link](25) method returns:
a) 5
b) 12.5
c) 625
d) 5.0
Answer: a) 5
52. What is the purpose of the parseInt('10.5px') function?
a) It returns 10.5.
b) It returns 10 after parsing the string until a non-numeric character.
c) It returns NaN because of the 'px'.
d) It returns the string '10.5px'.
Answer: b) It returns 10 after parsing the string until a non-numeric character.
53. A function defined using arrow syntax, () => {}, differs from a traditional function expression primarily
in how it handles:
a) The return statement.
b) The this keyword.
c) The number of parameters.
d) Its execution speed.
Answer: b) The this keyword. (Arrow functions inherit this from the surrounding scope.)
54. The [Link] property represents:
a) A function to calculate pie charts.
b) The ratio of a circle's circumference to its diameter.
c) A random number between 3 and 4.
d) The mathematical constant for Euler's number.
Answer: b) The ratio of a circle's circumference to its diameter.
55. What is the primary job of the Call Stack in the JavaScript engine?
a) To allocate memory for objects.
b) To keep track of the functions currently being executed.
c) To store callback functions waiting to run.
d) To parse HTML and CSS.
Answer: b) To keep track of the functions currently being executed.
---
Section 3: PHP and Server-Side Logic (SQLi/XSS prevention, Sessions, Cookies, Arrays) (25 Questions)
56. What does SQL Injection (SQLi) allow an attacker to do?
a) Inject malicious JavaScript into a webpage.
b) Manipulate database queries by inserting arbitrary SQL code.
c) Gain administrative access to the web server.
d) Steal session cookies from other users.
Answer: b) Manipulate database queries by inserting arbitrary SQL code.
57. Which is the most effective defense against SQL injection when using PHP and MySQL?
a) Using mysql_real_escape_string() on all user input.
b) Removing all SQL keywords like SELECT and INSERT from user input.
c) Using Prepared Statements with parameterized queries.
d) Disabling error reporting on the production server.
Answer: c) Using Prepared Statements with parameterized queries.
58. In PHP, a session is typically started with the function:
a) session_create()
b) session_start()
c) session_register()
d) session_begin()
Answer: b) session_start()
59. How is session data, like a user's ID, typically stored on the server?
a) In a database, indexed by the session ID.
b) In a file on the server, associated with the session ID.
c) In the server's RAM.
d) All of the above are common methods.
Answer: d) All of the above are common methods.
60. How is the session ID typically maintained on the client side?
a) As a JavaScript global variable.
b) As a URL parameter.
c) As a cookie, often named PHPSESSID.
d) In the browser's local storage.
Answer: c) As a cookie, often named PHPSESSID.
61. Which of the following is a correct way to prevent Cross-Site Scripting (XSS) attacks when displaying
user-generated content?
a) Use htmlspecialchars() or htmlentities() to escape output.
b) Use strip_tags() to remove all HTML tags.
c) Store the data in the database encrypted.
d) Use addslashes() on the output.
Answer: a) Use htmlspecialchars() or htmlentities() to escape output.
62. In PHP, how do you set a cookie named 'theme' with the value 'dark'?
a) setcookie('theme', 'dark');
b) cookie_set('theme', 'dark');
c) $_COOKIE['theme'] = 'dark';
d) set_cookie('theme', 'dark');
Answer: a) setcookie('theme', 'dark');
63. What is the main difference between $_POST and $_GET superglobals?
a) $_GET is faster than $_POST.
b) $_GET passes data in the URL, while $_POST passes data in the HTTP request body.
c) $_POST is more secure and cannot be intercepted.
d) $_GET can only send text, while $_POST can send files.
Answer: b) $_GET passes data in the URL, while $_POST passes data in the HTTP request body.
64. To store a piece of data in a session variable called 'user_id', you would use:
a) session_register('user_id', 123);
b) $_SESSION['user_id'] = 123;
c) session.user_id = 123;
d) set_session('user_id', 123);
Answer: b) $_SESSION['user_id'] = 123;
65. Which PHP function is used to destroy a session entirely, logging a user out?
a) session_destroy()
b) session_unset()
c) session_abort()
d) session_delete()
Answer: a) session_destroy()
66. Consider the code: $arr = ['a', 'b', 'c']; echo $arr[1]; What is the output?
a) a
b) b
c) c
d) Array
Answer: b) b
67. What is an associative array in PHP?
a) An array where elements are stored in a strict numerical order.
b) An array that uses named keys instead of numerical indices.
c) An array that contains only boolean values.
d) An array that is automatically sorted alphabetically.
Answer: b) An array that uses named keys instead of numerical indices.
68. How would you loop through an associative array $ages = ['Alice'=>25, 'Bob'=>30]; to access both
keys and values?
a) foreach($ages as $value) { ... }
b) for($i=0; $i<count($ages); $i++) { ... }
c) foreach($ages as $name => $age) { ... }
d) while($age = current($ages)) { ... }
Answer: c) foreach($ages as $name => $age) { ... }
69. The $_SERVER['REQUEST_METHOD'] variable in PHP can be used to:
a) Get the IP address of the client.
b) Determine if the page was requested via GET, POST, PUT, etc.
c) Get the name of the currently executing script.
d) Get the protocol used (HTTP/1.1 or HTTP/2).
Answer: b) Determine if the page was requested via GET, POST, PUT, etc.
70. Why is using mysql_* functions (like mysql_query) in modern PHP development considered a bad
practice?
a) They are too slow for modern applications.
b) They are deprecated and removed from recent PHP versions, posing a security risk.
c) They cannot connect to MySQL databases.
d) They do not support character encoding.
Answer: b) They are deprecated and removed from recent PHP versions, posing a security risk. (They
also did not support prepared statements well.)
71. What is the purpose of the password_hash() function in PHP?
a) To encrypt data so it can be decrypted later.
b) To create a one-way hash of a password for secure storage.
c) To generate a random password for a user.
d) To hash the contents of a file.
Answer: b) To create a one-way hash of a password for secure storage.
72. Which superglobal contains data from cookies sent by the client?
a) $_REQUEST
b) $_SERVER
c) $_SESSION
d) $_COOKIE
Answer: d) $_COOKIE
73. A developer sees <?php echo $_GET['id']; ?> in a template. This is a security risk because it is
vulnerable to:
a) SQL Injection
b) Cross-Site Request Forgery (CSRF)
c) Cross-Site Scripting (XSS)
d) Local File Inclusion (LFI)
Answer: c) Cross-Site Scripting (XSS) (The output is not escaped.)
74. In PHP, to add an element to the end of a numerically indexed array $items = ['apple'];, you would
use:
a) $items[] = 'banana';
b) array_push('banana', $items);
c) $[Link]('banana');
d) $items[0] = 'banana';
Answer: a) $items[] = 'banana';
75. What is the primary purpose of setting the HttpOnly flag on a cookie?
a) To ensure the cookie is only sent over HTTPS.
b) To prevent client-side scripts from accessing the cookie, mitigating XSS attacks.
c) To set the cookie's expiration date.
d) To limit the cookie to a specific domain.
Answer: b) To prevent client-side scripts from accessing the cookie, mitigating XSS attacks.
76. Which function is used to read the contents of a file in PHP?
a) file_open()
b) file_read()
c) file_get_contents()
d) read_file()
Answer: c) file_get_contents()
77. How can you prevent your site from being framed by malicious sites (clickjacking protection)?
a) Using the X-Frame-Options HTTP header.
b) Using htmlspecialchars() on all output.
c) Using a strong Content Security Policy (CSP) that restricts framing.
d) Both a and c.
Answer: d) Both a and c.
78. What does the PHP code count($myArray) return?
a) The sum of all values in the array.
b) The number of elements in the array.
c) The highest index number in the array.
d) The memory size of the array.
Answer: b) The number of elements in the array.
79. The array_keys() function, when passed an associative array, returns:
a) An array containing only the values.
b) An array containing only the keys.
c) A boolean indicating if the keys are valid.
d) The first key in the array.
Answer: b) An array containing only the keys.
80. To permanently delete a session variable user_id, you would use:
a) unset($_SESSION['user_id']);
b) delete($_SESSION['user_id']);
c) $_SESSION['user_id'] = null;
d) session_remove('user_id');
Answer: a) unset($_SESSION['user_id']);
---
Section 4: CSS and Styling (Selectors, Specificity, z-index, Linking) (15 Questions)
81. Which CSS selector has the highest specificity?
a) div p
b) .container .text
c) #main-content p
d) p
Answer: c) #main-content p (The ID selector gives it the highest specificity of the options.)
82. The 'C' in CSS stands for Cascading. This refers to the process of:
a) Creating animations that flow like a waterfall.
b) Combining multiple style sheets and resolving conflicts based on rules like specificity and source
order.
c) Laying out elements in a column, one after another.
d) The way text flows around a floated image.
Answer: b) Combining multiple style sheets and resolving conflicts based on rules like specificity and
source order.
83. Which property controls the stacking order of positioned elements?
a) position
b) float
c) display
d) z-index
Answer: d) z-index
84. For z-index to have any effect, an element must:
a) Be a block-level element like a <div>.
b) Have a position value other than static (e.g., relative, absolute, fixed).
c) Be transparent.
d) Have a float property set.
Answer: b) Have a position value other than static (e.g., relative, absolute, fixed).
85. What is the correct way to link an external CSS file named '[Link]' to an HTML document?
a) <style src="[Link]"></style>
b) <css>[Link]</css>
c) <link rel="stylesheet" href="[Link]">
d) <link src="[Link]" rel="stylesheet">
Answer: c) <link rel="stylesheet" href="[Link]">
86. A CSS rule p { color: blue; } will affect:
a) All elements with the class p.
b) The first paragraph on the page.
c) Every <p> element on the page.
d) Elements that contain a <p> tag.
Answer: c) Every <p> element on the page.
87. Which selector would select all <h2> elements that are direct children of a <div> with the class
sidebar?
a) [Link] h2
b) .sidebar > h2
c) div > .sidebar > h2
d) h2 [Link]
Answer: b) .sidebar > h2
88. If a paragraph has both a class and an ID, and both define the color property, which one will be
applied if the ID selector has higher specificity?
a) The class style.
b) The ID style.
c) The browser default.
d) The style defined last in the CSS file.
Answer: b) The ID style.
89. The CSS property z-index can accept which of the following values?
a) Keywords like top, bottom
b) Percentages like 50%
c) Integers (positive, negative, or zero)
d) Lengths like 10px
Answer: c) Integers (positive, negative, or zero)
90. What does the selector a[href="[Link] do?
a) Selects all links that contain "[Link]" in their URL.
b) Selects all links whose href attribute is exactly [Link]
c) Selects all links that point to a secure site.
d) Selects all anchor elements that have an href attribute.
Answer: b) Selects all links whose href attribute is exactly [Link]
91. The > symbol in a CSS selector (e.g., ul > li) is known as the:
a) Descendant combinator.
b) Child combinator.
c) Adjacent sibling combinator.
d) General sibling combinator.
Answer: b) Child combinator.
92. If two CSS rules have the same specificity, which one is applied?
a) The one defined first in the HTML style attribute.
b) The one defined last in the CSS file.
c) The one with the most important property.
d) The one that applies to the most elements.
Answer: b) The one defined last in the CSS file.
93. What is the primary function of a CSS reset stylesheet (like [Link] or a simple * { margin:0;
padding:0; })?
a) To make all websites look identical.
b) To remove the browser's default styling to create a consistent baseline across different browsers.
c) To reset all CSS properties to their initial values.
d) To clear the browser's cache for styles.
Answer: b) To remove the browser's default styling to create a consistent baseline across different
browsers.
94. Which of the following is NOT a valid way to include CSS in a webpage?
a) Inline styles using the style attribute.
b) Internal styles using the <style> tag in the <head>.
c) External styles using the <link> tag.
d) Compiled styles using the <compile> tag.
Answer: d) Compiled styles using the <compile> tag.
95. An element with position: absolute is positioned relative to:
a) The viewport.
b) Its closest positioned ancestor (any ancestor with a position other than static).
c) Its parent element, regardless of its position.
d) The document's root element.
Answer: b) Its closest positioned ancestor (any ancestor with a position other than static).
---
Section 5: Comprehensive & Security-Focused Scenario Questions (5 Questions)
96. A developer stores a user's role (e.g., 'admin', 'user') in a cookie named user_role. The server then
checks this cookie to grant admin privileges. What is the primary security flaw?
a) Cookies cannot store text, only numbers.
b) The cookie data is stored on the client and can be easily manipulated by the user.
c) This is not a flaw; it's a standard practice.
d) Cookies expire too quickly to be useful for authentication.
Answer: b) The cookie data is stored on the client and can be easily manipulated by the user.
97. A login form submits data via POST to [Link]. In [Link], the code directly uses
$_POST['username'] in an SQL query string. What is this code vulnerable to?
a) Cross-Site Scripting (XSS)
b) Cross-Site Request Forgery (CSRF)
c) SQL Injection (SQLi)
d) Remote Code Execution (RCE)
Answer: c) SQL Injection (SQLi)
98. Which combination of actions represents the best practice for a secure login system?
a) Store passwords in plain text, use $_GET for the login form, validate data on the client-side only.
b) Hash passwords with password_hash(), use $_POST for the form, use prepared statements for the
database query, and use session_start() to manage the logged-in state.
c) Encrypt passwords with a custom algorithm, disable sessions for performance, and store session IDs in
local storage.
d) Use md5() for password hashing, check user input against a blocklist of SQL keywords, and trust all
client-side validation.
Answer: b) Hash passwords with password_hash(), use $_POST for the form, use prepared statements
for the database query, and use session_start() to manage the logged-in state.
99. Consider a user profile page that displays the user's 'About Me' text, which was submitted via a
form. A developer uses echo $userBio; to display it. What is the primary risk, and how should the code
be fixed?
a) Risk of SQLi. Fix by using mysqli_real_escape_string().
b) Risk of XSS. Fix by using htmlspecialchars($userBio).
c) Risk of session fixation. Fix by regenerating the session ID.
d) There is no risk; echoing text is safe.
Answer: b) Risk of XSS. Fix by using htmlspecialchars($userBio).
100. An attacker tricks a user into clicking a link like: [Link]
confirm=yes. If the user is currently logged into '[Link]', the account is deleted. This attack
exploits the fact that the site probably:
a) Uses GET requests for state-changing actions without CSRF tokens.
b) Has a cross-site scripting vulnerability.
c) Stores passwords in plain text.
d) Uses an outdated version of PHP.
Answer: a) Uses GET requests for state-changing actions without CSRF tokens. (This is a classic CSRF
vulnerability scenario.)