46.4 Web Servers and MySQL Interview Questions

Q31. Apache versus Nginx – what do you say in one minute?

Both are web servers. Apache is common with .htaccess style per-directory tricks; Nginx is popular for reverse proxy and static efficiency. I can host static and PHP sites on either. Before reload I always run sudo nginx -t or sudo apachectl configtest.

Q32. How do you change the Nginx document root safely?

I edit the server block root to something like /var/www/sahyadri, run sudo nginx -t, then sudo service nginx reload. If the test fails I fix the config before reload. SELinux contexts may need attention on enforcing systems.

Q33. What is a virtual host or server block?

It is a configuration that maps a hostname or port to a site root so one machine can host multiple sites. For Raja-Rani I might have shop.example.com and warehouse.example.com with separate roots and logs.

Q34. How do you explain SQL injection at a defensive interview level?

SQL injection happens when untrusted input is concatenated into a query string so the database executes attacker-controlled SQL. Defence: prepared statements / parameterised queries, least-privilege DB users, input validation, and WAF as defence-in-depth. I practise on OWN DVWA only.

Q35. Prepared statements versus escaping – which do you prefer?

Prepared statements are the default answer. Escaping is easy to get wrong per charset. In PHP I use PDO or mysqli with bound parameters for Sahyadri order lookup pages.

Q36. DELETE versus TRUNCATE versus DROP TABLE?

DELETE removes rows (can be filtered with WHERE); TRUNCATE empties a table fast and resets auto-increment in many engines; DROP removes the table structure. In production I never run mass deletes without backups and a WHERE I can defend.

Q37. What are primary key, foreign key, and unique key?

Primary key uniquely identifies a row. Foreign key links to a parent key for referential integrity. Unique key enforces uniqueness without being the primary identifier. I design Raja-Rani orders with id PK and customer_id FK when teaching schema.

Q38. What is SQL_SAFE_UPDATES and why does MySQL error 1175 appear?

Safe updates mode blocks UPDATE/DELETE without a key-based WHERE, which protects beginners from wiping a table. Error 1175 is that guard. I fix the query properly instead of blindly disabling safe mode forever.

Q39. Should RDS or MySQL listen on the public internet?

No. Bind to private interfaces, place RDS in private subnets, and allow 3306 only from the app security group. Public MySQL is a classic breach pattern for small shops.

Q40. How do you test PHP syntax before deploy?

I run php -l file.php on the server or in CI. Syntax OK does not mean secure, but it catches silly outages. Then I re-test login and order pages on the lab URL.

Q41. What headers or cookie flags do you mention for session security?

HttpOnly and Secure on cookies, SameSite where fit, and HTTPS everywhere. Session fixation and XSS cookie theft are reduced when cookies are not readable by JavaScript and not sent on clear HTTP.

Q42. How do you harden a default web server install?

Remove default pages, hide version tokens where practical, disable directory listing, run as non-root, keep packages updated, restrict verbs if needed, and put TLS on. Logs go to a place Blue can ship to SIEM.