PHP Security
XSS · CSRF · SQL Injection · Secure Headers

<?php
// 1. Output Escaping — हमेशा, हर HTML output पर
function e(string $str): string {
  return htmlspecialchars($str, ENT_QUOTES | ENT_HTML5, "UTF-8");
}

// Use करना — templates में
?>
<h1><?= e($user["naam"]) ?></h1>
<input value="<?= e($old["naam"] ?? "") ?>">
<p><?= e($comment) ?></p>

<?php
// 2. Rich text — strip_tags से allowed tags only
$safeHtml = strip_tags($userHtml, "<b><i><u><p><br><ul><li>");

// 3. JSON में data pass करना
$jsData = json_encode($data, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_AMP);
?>
<script>const data = <?= $jsData ?>;</script>

<?php
// 4. Content Security Policy header
header("Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'");
?>

<?php
// ✅ Always use Prepared Statements
$pdo = new PDO($dsn, $user, $pass, [
  PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
  PDO::ATTR_EMULATE_PREPARES => false, // Real prepared statements
]);

// Named placeholders — readable
$stmt = $pdo->prepare("SELECT * FROM users WHERE email = :email AND active = :active");
$stmt->execute([":email" => $email, ":active" => 1]);

// Dynamic column names — whitelist approach
$allowedCols = ["naam", "email", "created_at"];
$sortCol = in_array($_GET["sort"] ?? "", $allowedCols) ? $_GET["sort"] : "naam";
$stmt = $pdo->query("SELECT * FROM users ORDER BY $sortCol"); // Safe now!

// ❌ Never this:
// $pdo->query("SELECT * FROM users WHERE id = " . $_GET['id']); // DANGEROUS!
?>

<?php
session_start();

function csrfToken(): string {
  if (empty($_SESSION["csrf"])) {
    $_SESSION["csrf"] = bin2hex(random_bytes(32));
  }
  return $_SESSION["csrf"];
}

function verifyCsrf(): void {
  $token = $_POST["_csrf"] ?? $_SERVER["HTTP_X_CSRF_TOKEN"] ?? "";
  if (!hash_equals($_SESSION["csrf"] ?? "", $token)) {
    http_response_code(403);
    die("❌ CSRF Token Invalid");
  }
}

// Form में
?>
<form method="POST">
  <input type="hidden" name="_csrf" value="<?= csrfToken() ?>">
</form>

<?php
// Session cookie — SameSite=Strict (CSRF भी रोकता है)
session_start([
  "cookie_samesite" => "Strict",
  "cookie_secure" => true,
  "cookie_httponly" => true,
]);
?>

<?php
// ❌ NEVER DO THIS
// $hash = md5($password); // Breakable in seconds!
// $hash = sha1($password); // Still insecure!

// ✅ ALWAYS DO THIS
$hash = password_hash($password, PASSWORD_BCRYPT);
// $2y$10$... — unique hash हर बार (automatic salt)

// Cost factor increase करो (default 10, max ~12 for web)
$hash = password_hash($password, PASSWORD_BCRYPT, ["cost" => 12]);

// Verify — plain text vs hash
if (password_verify($inputPassword, $storedHash)) {
  echo "✅ Password correct";
  // Rehash check — algorithm upgrade पर
  if (password_needs_rehash($storedHash, PASSWORD_BCRYPT, ["cost" => 12])) {
    $newHash = password_hash($inputPassword, PASSWORD_BCRYPT, ["cost" => 12]);
    // DB में update करो
  }
} else {
  echo "❌ Wrong password";
}

// Password policy validation
function isStrongPassword(string $pass): bool {
  return strlen($pass) >= 8
    && preg_match("/[A-Z]/", $pass) // uppercase
    && preg_match("/[a-z]/", $pass) // lowercase
    && preg_match("/[0-9]/", $pass) // digit
    && preg_match("/[^a-zA-Z0-9]/", $pass); // special
}
?>

<?php
// Login attempts track करो
function checkLoginAttempts(string $email): void {
  session_start();
  $key = "login_attempts_" . md5($email);
  $attempts = $_SESSION[$key]["count"] ?? 0;
  $lastTime = $_SESSION[$key]["time"] ?? 0;

  // 15 min lockout after 5 failed attempts
  if ($attempts >= 5 && (time() - $lastTime) < 900) {
    $wait = ceil((900 - (time() - $lastTime)) / 60);
    http_response_code(429);
    die("❌ Account locked. Wait $wait minutes.");
  }
}

function recordFailedAttempt(string $email): void {
  $key = "login_attempts_" . md5($email);
  $_SESSION[$key]["count"] = ($_SESSION[$key]["count"] ?? 0) + 1;
  $_SESSION[$key]["time"] = time();
}
?>

<?php
function secureUpload(array $file, string $uploadDir): string {
  // 1. Upload error check
  if ($file["error"] !== UPLOAD_ERR_OK) {
    throw new RuntimeException("Upload error code: " . $file["error"]);
  }
  // 2. Size limit — 5MB
  if ($file["size"] > 5 * 1024 * 1024) {
    throw new RuntimeException("File 5MB से बड़ी");
  }
  // 3. Extension whitelist (blacklist नहीं!)
  $ext = strtolower(pathinfo($file["name"], PATHINFO_EXTENSION));
  $allowed = ["jpg", "jpeg", "png", "gif", "webp", "pdf"];
  if (!in_array($ext, $allowed, true)) {
    throw new RuntimeException("Invalid file type: $ext");
  }
  // 4. MIME type verify — server-side (user-provided type trust नहीं)
  $finfo = new finfo(FILEINFO_MIME_TYPE);
  $mimeType = $finfo->file($file["tmp_name"]);
  $allowedMime = ["image/jpeg", "image/png", "image/gif", "image/webp", "application/pdf"];
  if (!in_array($mimeType, $allowedMime, true)) {
    throw new RuntimeException("Invalid MIME: $mimeType");
  }
  // 5. Unique filename — original name use मत करो (path traversal)
  $newName = bin2hex(random_bytes(16)) . "." . $ext;
  // 6. Directory ensure
  if (!is_dir($uploadDir)) mkdir($uploadDir, 0755, true);
  // 7. move_uploaded_file — ONLY safe way
  if (!move_uploaded_file($file["tmp_name"], $uploadDir . $newName)) {
    throw new RuntimeException("Move failed");
  }
  return $newName;
}

// Upload folder में .htaccess — PHP execution block
// deny from all (webroot के बाहर रखना best)
?>

<?php
function setSecurityHeaders(): void {
  // XSS Protection (older browsers)
  header("X-XSS-Protection: 1; mode=block");

  // Clickjacking prevent — iframe में load न हो
  header("X-Frame-Options: DENY");

  // MIME sniffing prevent
  header("X-Content-Type-Options: nosniff");

  // HTTPS enforce — 1 year
  header("Strict-Transport-Security: max-age=31536000; includeSubDomains; preload");

  // Referrer policy
  header("Referrer-Policy: strict-origin-when-cross-origin");

  // Permissions policy
  header("Permissions-Policy: geolocation=(), microphone=(), camera=()");

  // Content Security Policy — XSS का strongest defense
  header("Content-Security-Policy: " . implode("; ", [
    "default-src 'self'",
    "script-src 'self' 'nonce-{nonce}'", // Nonce-based scripts
    "style-src 'self' https://fonts.googleapis.com",
    "img-src 'self' data: https:",
    "font-src 'self' https://fonts.gstatic.com",
    "connect-src 'self'",
    "frame-ancestors 'none'",
    "base-uri 'self'",
    "form-action 'self'",
  ]));
}

// हर response पर call करो
setSecurityHeaders();
?>

<?php
function secureSessionStart(): void {
  session_start([
    "cookie_httponly" => true, // JS access block
    "cookie_secure" => true, // HTTPS only
    "cookie_samesite" => "Strict", // CSRF protection
    "gc_maxlifetime" => 1800, // 30 min
    "use_strict_mode" => true, // Strict mode
  ]);
  // Session ID को readable path में मत रखो
  ini_set("session.save_path", "/var/lib/php/sessions");
}

// Login के बाद हमेशा regenerate
session_regenerate_id(true); // Session Fixation रोको

// IP + User-Agent fingerprint check
function validateSession(): bool {
  $fingerprint = hash("sha256", $_SERVER["REMOTE_ADDR"] . $_SERVER["HTTP_USER_AGENT"]);
  if (isset($_SESSION["fingerprint"]) && $_SESSION["fingerprint"] !== $fingerprint) {
    session_destroy();
    return false; // Possible hijack!
  }
  $_SESSION["fingerprint"] = $fingerprint;
  return true;
}
?>

<?php
// Path Traversal — ../../etc/passwd
function safeFilePath(string $filename, string $baseDir): string {
  // Basename only — directory separators हटाओ
  $safe = basename($filename);
  $fullPath = realpath($baseDir . $safe);
  // realpath से verify — base dir के अंदर है?
  if ($fullPath === false || !str_starts_with($fullPath, realpath($baseDir))) {
    throw new RuntimeException("Invalid file path");
  }
  return $fullPath;
}

// Open Redirect — URL validate करो
function safeRedirect(string $url): void {
  // External redirect allow मत करो
  $parsed = parse_url($url);
  if (isset($parsed["host"]) && $parsed["host"] !== $_SERVER["HTTP_HOST"]) {
    $url = "/"; // External → homepage
  }
  header("Location: $url");
  exit;
}

// Mass Assignment — Only allowed fields
function filterInput(array $data, array $allowed): array {
  return array_intersect_key($data, array_flip($allowed));
}
// User input से सिर्फ allowed fields
$safe = filterInput($_POST, ["naam", "email", "phone"]);
// $_POST["role"] = "admin" — automatically ignored!
?>