Level 3 exam — PHP · GUIDINEE.COM

Exam — fresh questions

12 questions to validate Databases & OOP: PDO and prepared statements, OOP, namespaces and Composer, XSS/CSRF/hashing security.
Answer everything, then click Check: your score and explanations will appear.

3.1 · Recall

1. A PDO prepared statement is first and foremost…

An SMS sent to the database SQL with placeholders (prepare) + data sent separately (execute) A colour printout of the tables A server restart

Code and data separated: the database treats values as pure data.

3.1 · Application

2. Riad looks up a client by entered email. He writes…

$pdo->imprimer('SELECT …' . $emailSaisi); $pdo->eteindre($emailSaisi); $pdo->prepare('SELECT … WHERE email = :email'); then execute(['email' => $emailSaisi]); $pdo->couleur($emailSaisi);

Named placeholder + execute(): no concatenation, no injection.

3.1 · Arbitration

3. A colleague concatenates the input “just for testing”. Correct call?

Writing the real password in the code to go fast Refusing: prepare + execute always, even in tests Printing the query to check it by eye Accepting, tests are never attacked

Test code ends up in production; injection is born from concatenation.

3.2 · Recall

4. Encapsulation recommends…

No classes, only arrays One plain-text password per object Public properties modifiable everywhere Private properties + validating getters/setters

The object protects its state: the invalid is refused at the source.

3.2 · Application

5. Riad creates a specialized admin from Utilisateur. He writes…

class Admin extends Utilisateur { … override … } class Admin imprime Utilisateur class Admin efface Utilisateur class Admin colorie Utilisateur

Extends = reuse and specialize (“is a” relationship).

3.2 · Application

6. Riad wants a Notifiable contract for several classes. He writes…

Copy-pasting the method everywhere A password shared between classes interface Notifiable { public function getEmail(): string; } then implements A comment saying 'roughly notifiable'

The interface contracts: classes commit, code decouples.

3.3 · Recall

7. Namespaces are first for…

Colouring the project files Organising classes into spaces and avoiding name conflicts Shutting down the server cleanly Printing classes on paper

Two Users coexist in different spaces (use to import).

3.3 · Application

8. Riad installs a sending library via Composer. He writes…

composer imprimer la bibliothèque Downloading a ZIP and opening it by hand composer require vendor/package then require 'vendor/autoload.php'; Copying a neighbour's vendor/ from a USB stick

Composer installs, resolves and generates the PSR-4 autoloader.

3.3 · Arbitration

9. Should vendor/ be versioned in Git? Correct call?

Yes, always, with the passwords inside Yes, printed and bound Neither — everything in memory No: version composer.json + composer.lock, regenerate with install

Vendor/ is regenerable; the lock guarantees reproducibility.

3.4 · Recall

10. Against XSS on output, the reflex is…

htmlspecialchars() on all untrusted data Displaying as-is, the database is mine Removing the visitor's screen Changing the comment font

Escaped, the injected script becomes harmless text.

3.4 · Application

11. Riad stores a password at registration. He writes…

Sending the password by carrier pigeon Storing the password in plain text to reread it Writing the password hardcoded in the code $hash = password_hash($motDePasse, PASSWORD_DEFAULT); then storing the hash via prepared statement

Hashed at storage, verified by password_verify(): never plain text.

3.4 · Arbitration

12. Before going live, the shop displays raw pseudos and has no CSRF token. Correct call?

Escaping each output + verified CSRF token before opening Opening anyway, we'll see later Deleting the pseudos and the forms Printing the passwords to keep them

XSS and CSRF close before opening: each output has its defence.

What's next?

Score ≥ 80%: move to Level 4 — MVC, Laravel/Symfony and REST APIs (building on sound, safe foundations).
Score 50-79%: revisit the failed sections (prepared in 3.1, encapsulation in 3.2, PSR-4/Composer in 3.3, security quartet in 3.4) then retake the test.
Score < 50%: reread level 2 (forms, sessions, inclusions) then replay each 48h challenge in order.