Learn PHP Programming

<?php
// VULNERABLE - Never do this!
$email = $_GET['email'];
$sql = "SELECT * FROM users WHERE email = '$email'";  // Attacker can inject SQL
$result = $pdo->query($sql);  // Dangerous!

// SAFE - Use prepared statements with named placeholders
$email = $_GET['email'];
$stmt = $pdo->prepare("SELECT * FROM users WHERE email = :email");
$stmt->execute([':email' => $email]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);

// SAFE - Positional placeholders for multiple parameters
$stmt = $pdo->prepare("SELECT * FROM users WHERE age > ? AND status = ?");
$stmt->execute([$_GET['min_age'], 'active']);
$users = $stmt->fetchAll(PDO::FETCH_ASSOC);

// SAFE - Using bindParam for explicit type control
$stmt = $pdo->prepare("SELECT * FROM products WHERE id = :id");
$stmt->bindParam(':id', $_GET['id'], PDO::PARAM_INT);
$stmt->execute();
?>

<?php
// VULNERABLE - Directly outputting user input
$name = $_GET['name'];
echo "<h1>Welcome, $name</h1>";  // Attacker can inject: <script>alert('XSS')</script>

// SAFE - Escape all output with htmlspecialchars
$name = $_GET['name'];
$safeName = htmlspecialchars($name, ENT_QUOTES, 'UTF-8');
echo "<h1>Welcome, $safeName</h1>";

// Create a reusable escape helper function
function e(string $value): string {
    return htmlspecialchars($value, ENT_QUOTES, 'UTF-8');
}

// Usage in HTML context
echo '<p>User: ' . e($user['name']) . '</p>';
echo '<input type="text" value="' . e($user['bio']) . '">';

// For JavaScript context, use json_encode
echo '<script>var userData = ' . json_encode($user, JSON_HEX_TAG) . ';</script>';
?>

<?php
// Registration - Hash the password before storing
function registerUser(PDO $pdo, string $email, string $password): bool {
    // Validate password strength
    if (strlen($password) < 8) {
        throw new InvalidArgumentException('Password must be at least 8 characters.');
    }

    // Hash with bcrypt (default algorithm, auto-generates salt)
    $hashedPassword = password_hash($password, PASSWORD_DEFAULT);

    $stmt = $pdo->prepare("INSERT INTO users (email, password) VALUES (:email, :password)");
    return $stmt->execute([
        ':email'    => $email,
        ':password' => $hashedPassword
    ]);
}

// Login - Verify the password against the stored hash
function loginUser(PDO $pdo, string $email, string $password): ?array {
    $stmt = $pdo->prepare("SELECT * FROM users WHERE email = :email");
    $stmt->execute([':email' => $email]);
    $user = $stmt->fetch(PDO::FETCH_ASSOC);

    if (!$user || !password_verify($password, $user['password'])) {
        return null;  // Invalid credentials (don't reveal which one is wrong)
    }

    // Rehash if algorithm/cost has changed
    if (password_needs_rehash($user['password'], PASSWORD_DEFAULT)) {
        $newHash = password_hash($password, PASSWORD_DEFAULT);
        $stmt = $pdo->prepare("UPDATE users SET password = :password WHERE id = :id");
        $stmt->execute([':password' => $newHash, ':id' => $user['id']]);
    }

    return $user;
}
?>

<?php
session_start();

// Generate a CSRF token
function generateCsrfToken(): string {
    if (empty($_SESSION['csrf_token'])) {
        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
    }
    return $_SESSION['csrf_token'];
}

// Validate the CSRF token
function validateCsrfToken(string $token): bool {
    return isset($_SESSION['csrf_token']) && hash_equals($_SESSION['csrf_token'], $token);
}

// In your HTML form
$token = generateCsrfToken();
echo '<form method="POST" action="/update-profile">';
echo '<input type="hidden" name="csrf_token" value="' . e($token) . '">';
echo '<input type="text" name="name">';
echo '<button type="submit">Update</button>';
echo '</form>';

// In your form handler
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (!validateCsrfToken($_POST['csrf_token'] ?? '')) {
        http_response_code(403);
        die('Invalid CSRF token. Request rejected.');
    }
    // Process the form safely...
    unset($_SESSION['csrf_token']);  // Regenerate for next request
}
?>

<?php
// Validate email
$email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
if ($email === false) {
    die('Invalid email address.');
}

// Validate integer with range
$age = filter_input(INPUT_POST, 'age', FILTER_VALIDATE_INT, [
    'options' => ['min_range' => 1, 'max_range' => 120]
]);
if ($age === false) {
    die('Invalid age value.');
}

// Sanitize a string (remove tags, encode special chars)
$comment = filter_input(INPUT_POST, 'comment', FILTER_SANITIZE_SPECIAL_CHARS);

// Validate URL
$website = filter_var($_POST['website'] ?? '', FILTER_VALIDATE_URL);
if ($website === false) {
    die('Invalid URL.');
}

// Validate IP address
$ip = filter_var($_SERVER['REMOTE_ADDR'], FILTER_VALIDATE_IP);

// Combined validation function
function validateUserInput(array $data): array {
    $errors = [];
    if (!filter_var($data['email'], FILTER_VALIDATE_EMAIL)) {
        $errors[] = 'Invalid email address.';
    }
    if (empty($data['name']) || strlen($data['name']) > 100) {
        $errors[] = 'Name is required and must be under 100 characters.';
    }
    if (!filter_var($data['age'], FILTER_VALIDATE_INT, ['options' => ['min_range' => 18]])) {
        $errors[] = 'You must be at least 18 years old.';
    }
    return $errors;
}
?>