A Comparative Analysis of SQL Injection and XSS Vulnerabilities: From Exploitation to Secure Implementation in PHP Applications

Publication Details

Publication Date

10/08/2026

Volume / Issue

Vol 1, Issue 3 (2026)

Article No.

005

Journal

British Journal of Contemporary Research

DOI

https://doi.org/10.67693/BJCR-D756D3BR

Received

06 Jul 2026

Views

84

Downloads

17

Abstract

SQL Injection (SQLi) and Cross-Site Scripting (XSS) persist as key security vulnerabilities in web applications, continuously featured in the OWASP Top 10. This research offers a thorough comparative investigation of these vulnerabilities by developing a dual-version PHP/MySQL web application-one designed to be vulnerable and the other safely implemented. The research illustrates SQL injection exploitation through authentication circumvention, UNION-based data retrieval, and Boolean-based blind injection methods, in addition to stored and reflected cross-site scripting assaults. The susceptible version utilizes insecure coding methodologies, such as string concatenation in SQL queries, unsanitized output, raw password storage, and absent access controls. The secure version employs prepared statements via PDO, output encoding with htmlspecialchars(), bcrypt for password hashing, session-based authentication, CSRF tokens, and extensive security headers. Experimental findings indicate that the secure implementation effectively neutralizes all exhibited attack avenues, attaining a 95% enhancement in security compared to the susceptible version. The automated testing suite, created with cURL and PHP, programmatically checks both versions, underscoring the significance of including security testing into the development lifecycle. This research offers pragmatic, evidence-based recommendations for developers creating secure PHP applications and enhances the scholarly discussion on online application security.

License

This article is published under the Creative Commons Attribution 4.0 International License . Free to read, share, and adapt with attribution.