Building a Secure Online Exam System with PHP

Online exams have become increasingly popular due to their convenience and efficiency. However, building a secure online exam system is crucial to ensure the integrity of the examination process. In this blog series, we will explore how to build a secure online exam system using PHP, covering everything from database setup to user authentication, displaying questions, handling answers, and calculating results. We will also discuss the importance of security measures such as prepared statements.

In this blog post, we discuss how to build an online exam system with JavaScript and local storage. While that approach can be quick and easy, it has several drawbacks when it comes to security and data integrity.

Why Use PHP Instead of JavaScript?

JavaScript and local storage are often used for building quick and simple web applications. However, when it comes to an online exam system, this approach has several drawbacks:

• Security Issues:
  • Client-Side Execution: JavaScript runs on the client-side, meaning the code is accessible to users. This makes it easier for malicious users to tamper with the code and manipulate the exam process.
  • Local Storage Vulnerabilities: Storing sensitive information such as student credentials and exam questions in local storage is not secure, as this data can be easily accessed and modified by users.
• Data Integrity:
  • Lack of Centralized Storage: Local storage is specific to individual users and browsers. This can lead to data inconsistency and difficulty in managing the exam data centrally.
  • No Server-Side Processing: With JavaScript and local storage, there is no robust mechanism for server-side processing, which is essential for securely handling user authentication, storing answers, and calculating results.

Benefits of Using PHP for Online Exams

• Server-Side Execution:

  PHP code runs on the server, making it inaccessible to users. This ensures that the exam logic and data handling remain secure and are not exposed to potential tampering.

• Centralized Database:

  Using PHP with a MySQL database allows for centralized storage and management of all exam-related data, including student credentials, questions, and answers. This enhances data integrity and consistency.

• Enhanced Security:
  • Prepared Statements: PHP allows the use of prepared statements, which help prevent SQL injection attacks by securely handling user inputs.
  • Password Hashing: PHP provides functions for hashing passwords, ensuring that user credentials are stored securely in the database.

Procedures for Building a PHP-Based Online Exam System

In this blog series, we will follow these procedures to build a secure online exam system using PHP:

1. Database Setup:
   • Create a database to store student credentials, questions, and answers.
   • Use tables such as students, questions, and answers.
2. User Authentication:
   • Create a PHP script to handle user registration and login.
   • Store user credentials securely in the database using hashing for passwords.
3. Displaying Questions:
   • Fetch questions from the database and display them to the user.
   • Store questions in a PHP array and then encode them in JSON to send to the client side.
4. Handling Answers:
   • Collect user answers and send them back to the server as a JSON array.
   • Process and store the answers in the database.
5. Result Calculation:
   • Write a PHP script to calculate the results based on the stored answers.
   • Display the results to the user.

By using PHP to build your online exam system, you can ensure a more secure and reliable solution compared to JavaScript and local storage. PHP's server-side execution, centralized database management, and security features like prepared statements and password hashing provide a robust foundation for a secure online exam system.

Step 1: Database Setup and Demo Data Insertion

We already discussed the importance of using PHP for building a secure online exam system and the procedures we will follow. Now, let's dive into the database setup and demonstrate how to create the necessary tables and insert demo data.

Database Setup

To get started, we need to create a database to store student credentials, questions, and answers. We will use MySQL for our database management system.

1. Creating the Database

First, create a new database named online_exam. You can do this using the following SQL command:

CREATE DATABASE online_exam;
    USE online_exam;
    

2. Creating the students Table

The students table will store student credentials, including their username, password (hashed), name, and email. Here is the SQL command to create the students table:

CREATE TABLE students (
        id INT AUTO_INCREMENT PRIMARY KEY,
        username VARCHAR(50) NOT NULL UNIQUE,
        password VARCHAR(255) NOT NULL,
        name VARCHAR(100) NOT NULL,
        email VARCHAR(100) NOT NULL
    );
    

3. Creating the questions Table

The questions table will store the exam questions and the correct answers. Here is the SQL command to create the questions table:

CREATE TABLE questions (
        id INT AUTO_INCREMENT PRIMARY KEY,
        question_text TEXT NOT NULL,
        correct_answer VARCHAR(100) NOT NULL
    );
    

4. Creating the answers Table

The answers table will record the answers submitted by students for each question. Here is the SQL command to create the answers table:

CREATE TABLE answers (
        id INT AUTO_INCREMENT PRIMARY KEY,
        student_id INT NOT NULL,
        question_id INT NOT NULL,
        answer_text VARCHAR(100) NOT NULL,
        FOREIGN KEY (student_id) REFERENCES students(id),
        FOREIGN KEY (question_id) REFERENCES questions(id)
    );
    

Inserting Demo Data

Once the tables are created, we can insert some demo data to test our system.

1. Inserting Demo Students

Let's insert some demo student data into the students table:

INSERT INTO students (username, password, name, email) VALUES
    ('johndoe', '$2y$10$wHf9E9QRGe2S8P4ul5iHcO/tiZ80s5q1Z7eyD.xIk4c5d7v5LS1k2', 'John Doe', 'john@example.com'),
    ('janedoe', '$2y$10$7u8jBacTsoZb7EY/fQHeQOJrC23YRoDSjQbs0DdV6Y6.QwtyxsIzK', 'Jane Doe', 'jane@example.com');
    

Note: The passwords are hashed using the password_hash function in PHP.

2. Inserting Demo Questions

Next, let's insert some demo questions into the questions table:

INSERT INTO questions (question_text, correct_answer) VALUES
    ('What is the capital of France?', 'Paris'),
    ('What is 2 + 2?', '4');
    

3. Inserting Demo Answers

Finally, let's insert some demo answers into the answers table:

INSERT INTO answers (student_id, question_id, answer_text) VALUES
    (1, 1, 'Paris'),
    (1, 2, '4'),
    (2, 1, 'Berlin'),
    (2, 2, '4');
    

In this Step, we have set up the necessary database and tables for our online exam system, and we have inserted some demo data to test our system. In the next Step, we will cover user authentication, including user registration and login, and how to securely store user credentials in the database using PHP. Now, let's move on to implementing the PHP logic for user authentication, including user registration and login. We will use prepared statements throughout to ensure security.

Students Registration and Login

The user registration process involves collecting user details such as username, password, name, and email, and storing these details securely in the database using hashing for passwords.

PHP Script for User Registration

<?php
// Database connection
$conn = new mysqli('localhost', 'username', 'password', 'online_exam');

if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// User registration
if (isset($_POST['register'])) {
    $username = $_POST['username'];
    $password = password_hash($_POST['password'], PASSWORD_DEFAULT);
    $name = $_POST['name'];
    $email = $_POST['email'];
    $stmt = $conn->prepare("INSERT INTO students (username, password, name, email) VALUES (?, ?, ?, ?)");
    $stmt->bind_param("ssss", $username, $password, $name, $email);
    $stmt->execute();
    echo "Registration successful!";
}
?>

In this script:

• We connect to the database.
• We check if the form is submitted with the 'register' button.
• We hash the password using the password_hash function.
• We insert the user details into the students table using a prepared statement to prevent SQL injection.

User Login

The user login process involves verifying the user's credentials and allowing access to the exam system if the credentials are correct.

PHP Script for User Login

<?php
// Database connection
$conn = new mysqli('localhost', 'username', 'password', 'online_exam');

if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// User login
if (isset($_POST['login'])) {
    $username = $_POST['username'];
    $password = $_POST['password'];
    $stmt = $conn->prepare("SELECT * FROM students WHERE username=?");
    $stmt->bind_param("s", $username);
    $stmt->execute();
    $result = $stmt->get_result();
    $user = $result->fetch_assoc();
    if (password_verify($password, $user['password'])) {
        echo "Login successful!";
    } else {
        echo "Invalid credentials.";
    }
}
?>

In this script:

• We connect to the database.
• We check if the form is submitted with the 'login' button.
• We select the user details from the students table using a prepared statement.
• We verify the password using the password_verify function.

Step 2: Receiving and Displaying Questions

In this step, we will implement the PHP logic for receiving and displaying questions. We will fetch the questions from the database, store them in a PHP array, encode them in JSON, and send them to the client side. We will use prepared statements throughout to ensure security.

PHP Script to Fetch Questions

<?php
    // Database connection
    $conn = new mysqli('localhost', 'username', 'password', 'online_exam');
    
    if ($conn->connect_error) {
        die("Connection failed: " . $conn->connect_error);
    }
    
    // Fetch questions from the database
    $stmt = $conn->prepare("SELECT * FROM questions");
    $stmt->execute();
    $result = $stmt->get_result();
    
    // Store questions in a PHP array
    $questions = array();
    while ($row = $result->fetch_assoc()) {
        $questions[] = $row;
    }
    
    // Encode the PHP array in JSON format
    $questions_json = json_encode($questions);
    
    // Send the JSON data to the client side
    echo $questions_json;
    ?>
    

Client-side JavaScript to Display Questions

<!DOCTYPE html>
    <html lang="en">
    <head>
        <meta charset="UTF-8">
        <meta name="viewport" content="width=device-width, initial-scale=1.0">
        <title>Online Exam</title>
    </head>
    <body>
        <h1>Online Exam</h1>
        <div id="questions-container"></div>
    
        <script>
            // Fetch questions from the server
            fetch('path/to/your/php/script.php')
                .then(response => response.json())
                .then(questions => {
                    // Display questions to the user
                    const container = document.getElementById('questions-container');
                    questions.forEach(question => {
                        const questionElement = document.createElement('div');
                        questionElement.innerHTML = `
                            <p>${question.question_text}</p>
                            <input type="text" id="answer-${question.id}">
                        `;
                        container.appendChild(questionElement);
                    });
                })
                .catch(error => console.error('Error:', error));
        </script>
    </body>
    </html>
    

Step 3: Sending Answers to Server, Verifying, and Displaying Results

In this step, we will implement the PHP logic for sending answers to the server, verifying and processing the answers, and calculating and displaying the results. We will use prepared statements throughout to ensure security.

Sending Answers to Server and Verifying

We will collect user answers on the client side, send them to the server as a JSON array, and process and store them in the database.

Client-side JavaScript to Collect and Send Answers

<button onclick="submitAnswers()">Submit</button>

<script>
    function submitAnswers() {
        const answers = questions.map(question => {
            return {
                question_id: question.id,
                answer_text: document.getElementById(`answer-${question.id}`).value
            };
        });

        fetch('submit_answers.php', {
            method: 'POST',
            headers: {
                'Content-Type': 'application/json'
            },
            body: JSON.stringify(answers)
        })
        .then(response => response.text())
        .then(data => alert(data))
        .catch(error => console.error('Error:', error));
    }
</script>

PHP Script to Process and Store Answers (submit_answers.php)

<?php
// Database connection
$conn = new mysqli('localhost', 'username', 'password', 'online_exam');

if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Get the raw POST data
$rawData = file_get_contents("php://input");
$answers = json_decode($rawData, true);

// Assuming student_id is available through session or other means
$student_id = 1; // Replace with actual student ID

foreach ($answers as $answer) {
    $question_id = $answer['question_id'];
    $answer_text = $answer['answer_text'];

    $stmt = $conn->prepare("INSERT INTO answers (student_id, question_id, answer_text) VALUES (?, ?, ?)");
    $stmt->bind_param("iis", $student_id, $question_id, $answer_text);
    $stmt->execute();
}

echo "Answers submitted successfully!";
?>

Calculating and Displaying Results

Fetch the stored answers, calculate the results, and display them to the user.

PHP Script to Calculate Results (calculate_results.php)

<?php
// Database connection
$conn = new mysqli('localhost', 'username', 'password', 'online_exam');

if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Assuming student_id is available through session or other means
$student_id = 1; // Replace with actual student ID

// Fetch answers submitted by the student
$stmt = $conn->prepare("SELECT a.question_id, a.answer_text, q.correct_answer FROM answers a
                        JOIN questions q ON a.question_id = q.id
                        WHERE a.student_id = ?");
$stmt->bind_param("i", $student_id);
$stmt->execute();
$result = $stmt->get_result();

$total_questions = 0;
$correct_answers = 0;

while ($row = $result->fetch_assoc()) {
    $total_questions++;
    if ($row['answer_text'] === $row['correct_answer']) {
        $correct_answers++;
    }
}

// Calculate score
$score = ($correct_answers / $total_questions) * 100;

echo "You answered $correct_answers out of $total_questions questions correctly.<br>";
echo "Your score is $score%.";
?>

Client-side HTML to Display Results

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Exam Results</title>
</head>
<body>
    <h1>Exam Results</h1>
    <div id="results-container"></div>

    <script>
        // Fetch results from the server
        fetch('calculate_results.php')
            .then(response => response.text())
            .then(data => {
                // Display results to the user
                document.getElementById('results-container').innerHTML = data;
            })
            .catch(error => console.error('Error:', error));
    </script>
</body>
</html>

Till now, we have completed the PHP logic for sending answers to the server, verifying and processing the answers, and calculating and displaying the results. By using prepared statements, we ensure that our system is secure and protected against SQL injection attacks. In the next Step, we will conclude the blog series by discussing the importance of using prepared statements, who will find this solution useful, and why a PHP-based online exam system is more secure than one using JavaScript and local storage.

Step 4: Conclusion and Security Considerations

In this blog series, we've covered the essential steps to build a secure online exam system using PHP. From setting up the database and creating user authentication to fetching and displaying questions, collecting and storing answers, and finally calculating and displaying results, we've ensured that each step is designed with security in mind. In this final Step, we'll discuss the importance of using prepared statements, the audience who will find this solution useful, and why a PHP-based online exam system is more secure than one using JavaScript and local storage.

Importance of Using Prepared Statements

Prepared statements are a key security feature in PHP that helps protect against SQL injection attacks. SQL injection is a type of attack where malicious users can execute arbitrary SQL code on the database by manipulating input fields. By using prepared statements, we ensure that user inputs are safely handled and separated from SQL code. This prevents attackers from injecting harmful SQL commands and helps maintain the integrity and security of the database.

Benefits of Prepared Statements

• Prevents SQL Injection: Prepared statements automatically escape user inputs, ensuring that they are treated as data and not executable code.
• Enhanced Security: By using prepared statements, we add an extra layer of security to our application, making it more resilient against common attacks.
• Improved Code Maintainability: Prepared statements simplify the process of binding parameters and executing SQL queries, making the code more readable and maintainable.

Audience for This Solution

This solution is ideal for:

• Educators and Institutions: Schools, colleges, and educational institutions looking to conduct secure online exams can benefit from this solution.
• Developers: Web developers who want to build robust and secure online exam systems for clients or personal projects.
• Businesses: Organizations that need to conduct internal assessments, training programs, or certification exams securely and efficiently.

Why PHP-Based Online Exam Systems are More Secure Than JavaScript and Local Storage

• Server-Side Execution: PHP runs on the server, making the code inaccessible to users. This ensures that critical logic and data handling are protected from tampering.
• Centralized Database Management: Using PHP with a MySQL database allows for centralized storage and management of all exam-related data. This enhances data integrity and consistency.
• Enhanced Security Features:
  • Prepared Statements: Prepared statements help prevent SQL injection attacks.
  • Password Hashing: PHP provides functions for hashing passwords, ensuring that user credentials are stored securely in the database.
  • HTTPS: Ensuring that data is transmitted securely using HTTPS prevents man-in-the-middle attacks and eavesdropping.
• Data Integrity: Local storage is specific to individual users and browsers, leading to potential data inconsistency. A centralized database ensures that all data is consistent and easily manageable.
• Scalability: PHP-based systems can handle a larger number of users and data compared to local storage, making them suitable for scalable applications.

Project File Structure

online_exam_system/
├── css/
│   └── styles.css              # (Optional) CSS file for styling the frontend
├── js/
│   └── script.js               # (Optional) JavaScript file for additional client-side functionality
├── php/
│   ├── db_connection.php       # Database connection script
│   ├── register.php            # User registration script
│   ├── login.php               # User login script
│   ├── fetch_questions.php     # Script to fetch questions from the database
│   ├── submit_answers.php      # Script to submit and store answers
│   ├── calculate_results.php   # Script to calculate and display results
├── index.html                  # Main HTML file for the exam system
├── exam.html                   # HTML file for displaying exam questions
├── results.html                # HTML file for displaying exam results
└── README.md                   # Project documentation

Click Here to download the Online Exam with PHP Codes Zip file.

Conclusion:

By building an online exam system using PHP, we've created a secure, reliable, and scalable solution that addresses the limitations and security vulnerabilities of JavaScript and local storage. Prepared statements, password hashing, and centralized database management are key features that enhance the security of our system.

Thank you for reading the blog. We hope that you find this information useful and that it helps you build a secure online exam system for your needs. If you have any questions or need further assistance, feel free to reach out!

If you have any questions or need further assistance, feel free to ask!