Final Project 🏆

<?php
// 🧱 MILESTONE 1 — Schema + a single, reusable PDO connection.
// Run this on onecompiler.com/php to SEE the plan; run the SQL
// against MySQL/SQLite in your real project via $pdo->exec().

declare(strict_types=1);

// 1) The SQL that creates our two tables. A heredoc ( <<<SQL ... SQL; )
//    keeps multi-line text readable. owner_id links a task to a user.
$schema = <<<SQL
CREATE TABLE users (
    id            INTEGER PRIMARY KEY AUTOINCREMENT,
    name          TEXT NOT NULL,
    email         TEXT UNIQUE NOT NULL,
    password_hash TEXT NOT NULL,
    created_at    TEXT DEFAULT CURRENT_TIMESTAMP
);

CREATE TABLE tasks (
    id         INTEGER PRIMARY KEY AUTOINCREMENT,
    owner_id   INTEGER NOT NULL REFERENCES users(id),
    title      TEXT NOT NULL,
    status     TEXT NOT NULL DEFAULT 'todo',
    created_at TEXT DEFAULT CURRENT_TIMESTAMP
);
SQL;

// 2) ONE place that builds the database connection. Returning a
//    configured PDO object means every file uses the same safe setup.
function db(): PDO
{
    // In a real app the DSN/credentials come from environment variables,
    // never hard-coded. SQLite is shown so this runs anywhere.
    $pdo = new PDO("sqlite::memory:");

    // ERRMODE_EXCEPTION: turn silent SQL failures into catchable errors.
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    // FETCH_ASSOC: rows come back as ["title" => ...], not numbered.
    $pdo->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC);

    return $pdo;
}

$pdo = db();
$pdo->exec($schema);                       // create the tables once
$tables = $pdo->query("SELECT name FROM sqlite_master WHERE type='table'")
              ->fetchAll(PDO::FETCH_COLUMN);

echo "Connected. Tables created: " . implode(", ", $tables) . "\n";
?>

Connected. Tables created: users, tasks

<?php
// 🧱 MILESTONE 2 — MVC layout + a tiny front-controller router.
// Folder layout (every request enters through public/index.php):
//   public/index.php        <- the ONLY file the web server runs
//   app/Controllers/...     <- decide what happens for a request
//   app/Models/...          <- talk to the database
//   app/Views/...           <- the HTML templates

declare(strict_types=1);

final class Router
{
    /** @var array<string, callable> "VERB path" => handler */
    private array $routes = [];

    // Register "GET /tasks" -> a function. add() returns nothing.
    public function add(string $method, string $path, callable $handler): void
    {
        $this->routes["$method $path"] = $handler;
    }

    // Match the incoming request to a route, or return a 404 message.
    public function dispatch(string $method, string $path): string
    {
        $key = "$method $path";
        if (!isset($this->routes[$key])) {
            return "404 Not Found: $key";
        }
        return ($this->routes[$key])();      // run the matched handler
    }
}

$router = new Router();
$router->add("GET",  "/",      fn() => "Home: welcome to TaskFlow");
$router->add("GET",  "/tasks", fn() => "TaskController@index -> list of tasks");
$router->add("POST", "/tasks", fn() => "TaskController@store  -> task created");

// Simulate three incoming requests (the web server normally feeds these in):
echo $router->dispatch("GET",  "/") . "\n";
echo $router->dispatch("GET",  "/tasks") . "\n";
echo $router->dispatch("POST", "/tasks") . "\n";
echo $router->dispatch("GET",  "/nope") . "\n";
?>

Home: welcome to TaskFlow
TaskController@index -> list of tasks
TaskController@store  -> task created
404 Not Found: GET /nope

<?php
// 🧱 MILESTONE 3 — Register & log in with password_hash + sessions.
// GOLDEN RULE: never store a raw password. Hash it one way; you can
// verify a guess against the hash but you can never read it back.

declare(strict_types=1);

// REGISTER — turn a plaintext password into a safe, salted hash.
function registerUser(PDO $pdo, string $email, string $password): int
{
    // password_hash() picks a strong algorithm and a random salt for you.
    $hash = password_hash($password, PASSWORD_DEFAULT);

    // Prepared statement: the email is data, never glued into the SQL.
    $stmt = $pdo->prepare("INSERT INTO users (name, email, password_hash) VALUES (?, ?, ?)");
    $stmt->execute(["New User", $email, $hash]);

    return (int) $pdo->lastInsertId();       // the new user's id
}

// LOGIN — look up the user, then verify the typed password vs the hash.
function login(PDO $pdo, string $email, string $password): bool
{
    $stmt = $pdo->prepare("SELECT id, password_hash FROM users WHERE email = ?");
    $stmt->execute([$email]);
    $user = $stmt->fetch();

    // password_verify() re-hashes the guess and compares safely.
    if ($user && password_verify($password, $user["password_hash"])) {
        // Real app: session_start(); then $_SESSION["user_id"] = $user["id"];
        $_SESSION["user_id"] = $user["id"];  // "remember who is logged in"
        return true;
    }
    return false;                            // wrong email OR wrong password
}

$pdo = db();                                 // db() from Milestone 1
$pdo->exec("CREATE TABLE users (id INTEGER PRIMARY KEY AUTOINCREMENT,
    name TEXT, email TEXT UNIQUE, password_hash TEXT)");

$id = registerUser($pdo, "ada@example.com", "correct horse battery");
echo "Registered user #$id\n";
echo login($pdo, "ada@example.com", "correct horse battery") ? "Login OK\n" : "Denied\n";
echo login($pdo, "ada@example.com", "wrong-password")        ? "Login OK\n" : "Denied\n";
?>

Registered user #1
Login OK
Denied

<?php
// 🧱 MILESTONE 4 — CRUD with prepared statements, validation & XSS escaping.
// Two non-negotiables: (1) every value goes in as a bound parameter (?),
// (2) every value coming OUT to HTML is escaped with htmlspecialchars().

declare(strict_types=1);

// VALIDATE first — trim, check it's not empty, cap the length.
function validateTitle(string $raw): string
{
    $title = trim($raw);
    if ($title === "")        throw new InvalidArgumentException("Title is required.");
    if (mb_strlen($title) > 300) throw new InvalidArgumentException("Title too long.");
    return $title;
}

// CREATE — bound parameters make SQL injection impossible here.
function createTask(PDO $pdo, int $ownerId, string $rawTitle): int
{
    $title = validateTitle($rawTitle);
    $stmt = $pdo->prepare("INSERT INTO tasks (owner_id, title, status) VALUES (?, ?, 'todo')");
    $stmt->execute([$ownerId, $title]);
    return (int) $pdo->lastInsertId();
}

// READ — fetch this user's tasks only (never trust the caller for ownerId).
function listTasks(PDO $pdo, int $ownerId): array
{
    $stmt = $pdo->prepare("SELECT id, title, status FROM tasks WHERE owner_id = ? ORDER BY id");
    $stmt->execute([$ownerId]);
    return $stmt->fetchAll();
}

$pdo = db();
$pdo->exec("CREATE TABLE tasks (id INTEGER PRIMARY KEY AUTOINCREMENT,
    owner_id INTEGER, title TEXT, status TEXT)");

createTask($pdo, 1, "  Write the README  ");          // trimmed by validate
createTask($pdo, 1, "Ship <script>alert(1)</script>"); // a hostile title

// ESCAPE on output — htmlspecialchars() turns < into &lt; so the
// browser shows the text instead of RUNNING it (this stops XSS).
foreach (listTasks($pdo, 1) as $task) {
    $safe = htmlspecialchars($task["title"], ENT_QUOTES, "UTF-8");
    echo "#{$task['id']} [{$task['status']}] $safe\n";
}
?>

#1 [todo] Write the README
#2 [todo] Ship <script>alert(1)</script>

<?php
// 🧱 MILESTONE 5 — A JSON API endpoint. Same data, machine-readable.
// A real endpoint sends a Content-Type header and the right status code,
// then echoes json_encode(...). We print the pieces so you can verify them.

declare(strict_types=1);

// Build one consistent response shape for every API reply.
function jsonResponse(array $data, int $status = 200): array
{
    // Real app:
    //   header("Content-Type: application/json");
    //   http_response_code($status);
    //   echo json_encode($payload);
    return [
        "status" => $status,
        "body"   => json_encode($data, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES),
    ];
}

// GET /api/tasks — return the logged-in user's tasks as JSON.
function apiListTasks(PDO $pdo, int $ownerId): array
{
    $tasks = listTasks($pdo, $ownerId);      // reuse Milestone 4's query
    return jsonResponse(["data" => $tasks, "count" => count($tasks)]);
}

$pdo = db();
$pdo->exec("CREATE TABLE tasks (id INTEGER PRIMARY KEY AUTOINCREMENT,
    owner_id INTEGER, title TEXT, status TEXT)");
createTask($pdo, 1, "Write the README");     // createTask() from Milestone 4

$response = apiListTasks($pdo, 1);
echo "HTTP {$response['status']}\n";
echo $response["body"] . "\n";
?>

HTTP 200
{
    "data": [
        {
            "id": 1,
            "title": "Write the README",
            "status": "todo"
        }
    ],
    "count": 1
}

<?php
// 🧱 MILESTONE 6 — Deploy & security checklist as runnable code.
// This prints your go-live gate. Each line is a real habit, not a slogan.

declare(strict_types=1);

$checklist = [
    "Secrets"     => "DB password & API keys in env vars, NOT in the repo",
    "Errors"      => "display_errors = Off in production; log to a file instead",
    "HTTPS"       => "Force TLS; set session.cookie_secure & cookie_httponly = 1",
    "SQL"         => "Every query uses prepared statements (zero string-glued SQL)",
    "Output"      => "Every echo into HTML wrapped in htmlspecialchars()",
    "Passwords"   => "password_hash() to store, password_verify() to check",
    "Validation"  => "Validate & length-cap all input on the server side",
    "Updates"     => "composer update for security patches; pin PHP version",
];

echo "=== TaskFlow go-live checklist ===\n";
$n = 0;
foreach ($checklist as $area => $rule) {
    $n++;
    printf("[%d] %-10s -> %s\n", $n, $area, $rule);
}
echo "\nShip it. " . count($checklist) . " gates passed.\n";
?>

=== TaskFlow go-live checklist ===
[1] Secrets    -> DB password & API keys in env vars, NOT in the repo
[2] Errors     -> display_errors = Off in production; log to a file instead
[3] HTTPS      -> Force TLS; set session.cookie_secure & cookie_httponly = 1
[4] SQL        -> Every query uses prepared statements (zero string-glued SQL)
[5] Output     -> Every echo into HTML wrapped in htmlspecialchars()
[6] Passwords  -> password_hash() to store, password_verify() to check
[7] Validation -> Validate & length-cap all input on the server side
[8] Updates    -> composer update for security patches; pin PHP version

Ship it. 8 gates passed.

<?php
// 🎯 YOUR TURN — finish the UPDATE in our CRUD. Fill each ___ , then run.
// You are toggling a task's status to "done" — safely, with bound params.

declare(strict_types=1);

function completeTask(PDO $pdo, int $ownerId, int $taskId): void
{
    // 1) Write the UPDATE. owner_id in the WHERE stops users editing
    //    each other's tasks. Use ? placeholders, never string-glued values.
    $sql = "UPDATE tasks SET status = 'done' WHERE id = ___ AND owner_id = ___";
    //                                                  👆           👆
    //                                          replace each ___ with a  ?
    $stmt = $pdo->prepare($sql);

    // 2) Bind the values in the SAME ORDER as the ? marks: id first, owner second.
    $stmt->execute([___, ___]);   // 👉 e.g.  [$taskId, $ownerId]
}

$pdo = db();
$pdo->exec("CREATE TABLE tasks (id INTEGER PRIMARY KEY AUTOINCREMENT,
    owner_id INTEGER, title TEXT, status TEXT)");
$pdo->exec("INSERT INTO tasks (owner_id, title, status) VALUES (1, 'Demo', 'todo')");

completeTask($pdo, 1, 1);
$row = $pdo->query("SELECT title, status FROM tasks WHERE id = 1")->fetch();
echo "{$row['title']}: {$row['status']}\n";

// ✅ Expected output:
//    Demo: done
?>

Demo: done

<?php
// 🎯 YOUR TURN — write the "auth guard" that protects private pages.
// A guard checks the session BEFORE a controller runs. Fill the ___ .

declare(strict_types=1);

function requireLogin(array $session): string
{
    // 1) Is a logged-in user id present in the session?
    if (___($session["user_id"])) {        // 👉 use isset(...) to test it
        return "Allowed: user #" . $session["user_id"];
    }

    // 2) No user id -> block the request.
    return "___";                          // 👉 return the text:  Redirect to /login
}

// A logged-in request carries the user id; a guest's session is empty.
echo requireLogin(["user_id" => 7]) . "\n";
echo requireLogin([]) . "\n";

// ✅ Expected output:
//    Allowed: user #7
//    Redirect to /login
?>

Allowed: user #7
Redirect to /login