Security Best Practices 🔒

<?php
// === SQL INJECTION: never paste user input straight into a query ===
// Imagine this email arrived from a login form ($_POST['email']).
$email = "' OR '1'='1";   // attacker input, not a real address

// ❌ VULNERABLE: the input becomes PART OF the SQL command.
$badSql = "SELECT * FROM users WHERE email = '{$email}'";
echo "Vulnerable query sent to the database:\n  {$badSql}\n";
echo "  -> 'OR 1=1' is always true, so the WHERE matches EVERY row.\n";
echo "  -> the attacker is logged in as the first user, no password needed.\n\n";

// ✅ FIXED: a prepared statement sends the SQL and the value on SEPARATE
// channels. The ? is a placeholder; the value can never become code.
//   \$pdo  = new PDO('mysql:host=localhost;dbname=app', \$user, \$pass);
//   \$stmt = \$pdo->prepare('SELECT * FROM users WHERE email = ?');
//   \$stmt->execute([\$email]);          // value bound, structure fixed
//   \$row  = \$stmt->fetch();
echo "Fixed: prepare('... WHERE email = ?') then execute([\$email]).\n";
echo "The database treats \$email as DATA, never as part of the query.\n";

Vulnerable query sent to the database:
  SELECT * FROM users WHERE email = '' OR '1'='1'
  -> 'OR 1=1' is always true, so the WHERE matches EVERY row.
  -> the attacker is logged in as the first user, no password needed.

Fixed: prepare('... WHERE email = ?') then execute([$email]).
The database treats $email as DATA, never as part of the query.

<?php
// === XSS (Cross-Site Scripting): escape untrusted data before output ===
// This comment text supposedly came from a visitor ($_GET['msg']).
$comment = '<script>steal(document.cookie)</script>';

// ❌ VULNERABLE: echoing raw input puts the attacker's <script> into the
// page. Every other visitor's browser then RUNS it.
$vulnerable = "<p>{$comment}</p>";

// ✅ FIXED: htmlspecialchars() turns < > " ' & into harmless HTML entities,
// so the browser shows the text instead of executing it.
$safe = "<p>" . htmlspecialchars($comment, ENT_QUOTES, 'UTF-8') . "</p>";

echo "Raw (vulnerable): {$vulnerable}\n";
echo "Escaped (safe):   {$safe}\n";
echo "\n";
echo "Defence in depth: also send a Content-Security-Policy header\n";
echo "  header(\"Content-Security-Policy: default-src 'self'\");\n";
echo "so even an injected <script> is blocked by the browser.\n";

Raw (vulnerable): <p><script>steal(document.cookie)</script></p>
Escaped (safe):   <p>&lt;script&gt;steal(document.cookie)&lt;/script&gt;</p>

Defence in depth: also send a Content-Security-Policy header
  header("Content-Security-Policy: default-src 'self'");
so even an injected <script> is blocked by the browser.

<?php
// === CSRF (Cross-Site Request Forgery): prove the request came from YOU ===
// A CSRF attack tricks a logged-in user's browser into submitting a form to
// your site (e.g. "transfer money") without them meaning to. A secret token
// that only your real pages know stops it.

// session_start();   // (skipped here so this runs as a plain script)

// On GET: generate a random token, store it, put it in a hidden form field.
$token = bin2hex(random_bytes(32));    // 64 hex chars, unguessable
echo "Hidden field: <input type=\"hidden\" name=\"csrf\" value=\"" . substr($token, 0, 12) . "...\">\n\n";

// On POST: compare the submitted token with the stored one.
$stored    = $token;     // would be \$_SESSION['csrf']
$submitted = $token;     // would be \$_POST['csrf']

// ❌ WRONG: a plain === leaks timing information about the secret.
// ✅ RIGHT: hash_equals() compares in constant time.
$ok = hash_equals($stored, $submitted);
echo "Submitted token matches the session token? " . var_export($ok, true) . "\n";

$forged = hash_equals($stored, 'attacker-guessed-value');
echo "A forged request's token matches?            " . var_export($forged, true) . "\n";

Hidden field: <input type="hidden" name="csrf" value="a1b2c3d4e5f6...">

Submitted token matches the session token? true
A forged request's token matches?            false

<?php
// === PASSWORD HASHING: never store the real password ===
$password = 'MyS3cur3P@ss';

// ❌ NEVER: md5()/sha1() are fast checksums — a GPU cracks billions/sec.
//    \$bad = md5(\$password);

// ✅ Registration: password_hash() uses bcrypt/argon2 — slow and salted FOR you.
$hash = password_hash($password, PASSWORD_DEFAULT);
echo "Stored hash (~60 chars, different every run):\n  " . substr($hash, 0, 30) . "...\n\n";

// ✅ Login: verify the typed password against the stored hash.
echo "Correct password verifies? " . var_export(password_verify('MyS3cur3P@ss', $hash), true) . "\n";
echo "Wrong password verifies?   " . var_export(password_verify('wrongpass',    $hash), true) . "\n\n";

// === SECURE SESSIONS & COOKIES ===
// Set these BEFORE session_start() so the session cookie is locked down:
//   session_set_cookie_params([
//     'httponly' => true,    // JavaScript can't read it -> blunts XSS cookie theft
//     'secure'   => true,    // only sent over HTTPS
//     'samesite' => 'Strict' // not sent on cross-site requests -> blunts CSRF
//   ]);
//   session_start();
//   session_regenerate_id(true);   // new ID after login -> stops session fixation
echo "Cookie flags to set: httponly, secure, samesite=Strict.\n";

Stored hash (~60 chars, different every run):
  $2y$10$Q8s1Z3kf9aB2cD4eF6gH7u...

Correct password verifies? true
Wrong password verifies?   false

Cookie flags to set: httponly, secure, samesite=Strict.

<?php
// === NEVER TRUST INPUT: validate, then act ===
// filter_var() checks the SHAPE of a value and returns false if it's wrong.
$emails = ['good@mail.com', 'not-an-email'];
foreach ($emails as $e) {
    $ok = filter_var($e, FILTER_VALIDATE_EMAIL) !== false;
    echo str_pad($e, 16) . " -> valid email? " . var_export($ok, true) . "\n";
}
echo "age '42'  is an int? " . var_export(filter_var('42',  FILTER_VALIDATE_INT) !== false, true) . "\n";
echo "age '4.2' is an int? " . var_export(filter_var('4.2', FILTER_VALIDATE_INT) !== false, true) . "\n\n";

// === FILE UPLOADS: trust the bytes, not the name ===
// ❌ "photo.jpg.php" looks like an image but RUNS as PHP if you keep the name.
// ✅ Check the real MIME type, give it a random name, store OUTSIDE the webroot:
//   \$mime = (new finfo(FILEINFO_MIME_TYPE))->file(\$tmp);   // read the bytes
//   if (!in_array(\$mime, ['image/jpeg','image/png'])) reject();
//   \$safeName = bin2hex(random_bytes(16)) . '.jpg';
//   move_uploaded_file(\$tmp, '/var/uploads/' . \$safeName);
echo "Upload rule: check MIME, rename randomly, store outside the webroot.\n";

// === SSRF: never fetch a URL the user supplied without checking it ===
// An attacker passes http://169.254.169.254/ to reach internal cloud metadata.
// ✅ Allow-list the hosts you intend to call; block private/loopback IPs.
echo "SSRF rule: allow-list outbound URLs; reject internal/private addresses.\n";

// === SECURITY HEADERS: set them before ANY output ===
//   header('X-Content-Type-Options: nosniff');
//   header('X-Frame-Options: DENY');
//   header('Strict-Transport-Security: max-age=31536000');
//   header(\"Content-Security-Policy: default-src 'self'\");
echo "Send security headers on every response.\n";

good@mail.com    -> valid email? true
not-an-email     -> valid email? false
age '42'  is an int? true
age '4.2' is an int? false

Upload rule: check MIME, rename randomly, store outside the webroot.
SSRF rule: allow-list outbound URLs; reject internal/private addresses.
Send security headers on every response.

<?php
// 🎯 YOUR TURN — make the user's comment safe to print.
// The attacker tucked a <script> tag inside their "comment".

$comment = $_GET['comment'] ?? '<script>alert(1)</script>';

// 1) Escape $comment so the browser shows it as text, not code.
//    Use htmlspecialchars() with ENT_QUOTES and the 'UTF-8' charset.
$safe = ___;            // 👉 htmlspecialchars($comment, ENT_QUOTES, 'UTF-8')

echo "<p>{$safe}</p>\n";

// ✅ Expected output:
//    <p>&lt;script&gt;alert(1)&lt;/script&gt;</p>

<p>&lt;script&gt;alert(1)&lt;/script&gt;</p>

<?php
// 🎯 YOUR TURN — rewrite a dangerous query as a prepared statement.
// $username comes from a login form, so it can NOT be trusted.

$username = "admin' --";   // attacker input that comments out the rest

// ❌ The vulnerable version (do NOT use):
//    \$sql = "SELECT * FROM users WHERE name = '{\$username}'";

// 1) Replace the value with a ?  placeholder in the SQL string:
$sql = "SELECT * FROM users WHERE name = ___";   // 👉 put a single ?  where the value goes

// 2) Pass the real value to execute() as an array element:
//    \$stmt = \$pdo->prepare(\$sql);
//    \$stmt->execute([___]);                     // 👉 \$username

echo "Prepared SQL: {$sql}\n";

// ✅ Expected output:
//    Prepared SQL: SELECT * FROM users WHERE name = ?

Prepared SQL: SELECT * FROM users WHERE name = ?