Lab14: DVWA Security Levels Explained 2026 — Low, Medium, High & Impossible Complete Guide

Lab 14 teaches learners to analyze DVWA's PHP source code across four security levels (Low, Medium, High, Impossible) to understand exactly what code changes prevent vulnerabilities, transforming them from attackers who can exploit vulnerabilities into professionals who can write specific remediation recommendations. The lab demonstrates why partial defenses like blacklist filtering and escaping functions fail, and establishes five secure coding patterns that should appear in every penetration test finding.

• Security Levels Progress from No to Complete DefenseLow implements no input validation, no prepared statements, and raw SQL string concatenation; Medium adds bypassable defenses like mysql_real_escape_string() and basic strip_tags(); High uses PDO prepared statements and htmlspecialchars(); Impossible enforces PDO with parameterized queries, htmlspecialchars with ENT_QUOTES, CSRF tokens with session binding, rate limiting with account lockout, and treats all user input as untrusted. This progression shows how each layer of defense attempts to prevent exploitation.
• PDO Prepared Statements Are Only Complete SQL Injection FixLow's raw string concatenation allows direct SQL injection; Medium's mysql_real_escape_string() fails against integer fields without quotes and multi-byte character set encoding attacks; High's use of id from session and LIMIT 1 helps but remains vulnerable in some configurations; Impossible's PDO prepared statement with bindParam() and type binding (PDO::PARAM_INT) fixes the vulnerability completely because the query structure is fixed at compilation and user input is treated as literal value, never executable SQL. The article explicitly identifies this as 'the exact code you recommend in eve
• Blacklist Filtering Always Fails Against XSSLow has no filtering, allowing direct script injection; Medium's str_replace() removing only '' is bypassed by case variation ('', '') or alternative tags (''); High's regex pattern blocking script with intermixed characters still fails against tags without 'script' substring like ''; Impossible uses htmlspecialchars() with ENT_QUOTES and UTF-8 charset, encoding all HTML special characters (, &, ", ') so malicious input displays as literal text and never executes. The article emphasizes htmlspecialchars with ENT_QUOTES and UTF-8 is 'the single most important function in PHP web security for pr
• CSRF Token Implementation Prevents but Can Be BypassedLow implements no CSRF protection at all; High generates md5(uniqid()) per session and stores in $_SESSION, verifying token on each request to reject invalid tokens; Impossible adds this token protection to the brute force module. The article notes that Lab 15 will teach attackers to bypass High's token implementation using Burp macros that extract tokens before each request, making understanding both the attack and complete defense essential for real penetration test reports.
• Account Lockout and Logging Complete Brute Force DefenseLow has no rate limiting or lockout, allowing unlimited login attempts; High adds CSRF tokens but no lockout; Impossible locks account after 3 failed attempts for 15 minutes, logs all failed attempts to database with timestamp and IP address, and uses PDO prepared statements to prevent SQL injection bypass. This makes brute force attacks impractical even if the CSRF token is bypassed, establishing defense in depth.
• Five Secure Coding Patterns for All RecommendationsThe article identifies five patterns worth memorizing for professional penetration test findings: (1) PDO prepared statements with type binding for SQL injection; (2) htmlspecialchars($input, ENT_QUOTES, 'UTF-8') for XSS on all output; (3) cryptographic token per session verified on state-changing requests for CSRF; (4) account lockout after 3-5 failures with delay, IP logging, and alerting for brute force; (5) server-side API verification only for CAPTCHA. These patterns provide specific, actionable recommendations developers can implement immediately.
• View Source Comparison Builds Code Review SkillsThe lab teaches learners to first attempt exploitation, then use View Source to understand why it worked, switch security levels to compare code changes, and identify what attack each added line prevents and whether it can be bypassed. This methodology develops the code review capability needed for real vulnerability analysis and transforms generic recommendations like 'validate all input' into specific ones like 'use htmlspecialchars($output, ENT_QUOTES, 'UTF-8'),' which the author notes improves professional penetration test report quality.
• Medium Defenses Are Fundamentally BypassableThe article emphasizes that Medium-level defenses—including blacklist filtering, context-dependent escaping functions like mysql_real_escape_string(), partial input length limits, and client-side controls—are bypassable with minor technique modifications. This principle applies consistently across SQL injection, XSS, CSRF, and authentication modules, establishing that partial defenses create false security rather than actual protection.

Bottom line: Learners must progress from running attacks to writing specific, code-level remediation recommendations by memorizing and recommending the five Impossible-level secure coding patterns (PDO prepared statements, htmlspecialchars with ENT_QUOTES, CSRF tokens with session binding, account lockout with logging, and server-side CAPTCHA verification) rather than generic advice like 'validate input' or 'escape output.' This shift from script-based exploitation to professional penetration testing depends