Security Best Practices

<?php
// Security utility class
class Security {
    // CSRF token generation and validation
    public static function generateCSRFToken() {
        if (empty($_SESSION['csrf_token'])) {
            $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
        }
        return $_SESSION['csrf_token'];
    }
    
    public static function validateCSRFToken($token) {
        return isset($_SESSION['csrf_token']) && 
               hash_equals($_SESSION['csrf_token'], $token);
    }
    
    // Input sanitization
    public static function sanitizeInput($input, $type = 'string') {
        switch ($type) {
            case 'email':
                return filter_var(trim($input), FILTER_SANITIZE_EMAIL);
            case 'int':
                return filter_var($input, FILTER_SANITIZE_NUMBER_INT);
            case 'url':
                return filter_var(trim($input), FILTER_SANITIZE_URL);
            case 'string':
            default:
                return htmlspecialchars(trim($input), ENT_QUOTES, 'UTF-8');
        }
    }
    
    // Output escaping
    public static function escapeOutput($data) {
        if (is_array($data)) {
            return array_map([self::class, 'escapeOutput'], $data);
        }
        return htmlspecialchars($data, ENT_QUOTES, 'UTF-8');
    }
    
    // Password hashing
    public static function hashPassword($password) {
        return password_hash($password, PASSWORD_ARGON2ID);
    }
    
    public static function verifyPassword($password, $hash) {
        return password_verify($password, $hash);
    }
    
    // File upload security
    public static function validateFileUpload($file, $allowedTypes = [], $maxSize = 5242880) {
        $errors = [];
        
        if ($file['error'] !== UPLOAD_ERR_OK) {
            $errors[] = 'File upload failed';
            return $errors;
        }
        
        if ($file['size'] > $maxSize) {
            $errors[] = 'File too large';
        }
        
        $finfo = finfo_open(FILEINFO_MIME_TYPE);
        $mimeType = finfo_file($finfo, $file['tmp_name']);
        finfo_close($finfo);
        
        if (!empty($allowedTypes) && !in_array($mimeType, $allowedTypes)) {
            $errors[] = 'File type not allowed';
        }
        
        return $errors;
    }
}

// Secure form processing
class SecureForm {
    private $errors = [];
    
    public function processRegistration($data) {
        // Validate CSRF token
        if (!Security::validateCSRFToken($data['csrf_token'] ?? '')) {
            $this->errors[] = 'Invalid CSRF token';
            return false;
        }
        
        // Sanitize inputs
        $name = Security::sanitizeInput($data['name'] ?? '');
        $email = Security::sanitizeInput($data['email'] ?? '', 'email');
        $password = $data['password'] ?? '';
        
        // Validate inputs
        if (empty($name) || strlen($name) < 2) {
            $this->errors[] = 'Name must be at least 2 characters';
        }
        
        if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
            $this->errors[] = 'Invalid email format';
        }
        
        if (strlen($password) < 8) {
            $this->errors[] = 'Password must be at least 8 characters';
        }
        
        if (empty($this->errors)) {
            // Hash password
            $hashedPassword = Security::hashPassword($password);
            
            // Save to database (with prepared statements)
            return $this->saveUser($name, $email, $hashedPassword);
        }
        
        return false;
    }
    
    private function saveUser($name, $email, $hashedPassword) {
        try {
            $pdo = new PDO("mysql:host=localhost;dbname=secure_app", "user", "pass");
            $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
            
            $stmt = $pdo->prepare("INSERT INTO users (name, email, password) VALUES (?, ?, ?)");
            return $stmt->execute([$name, $email, $hashedPassword]);
        } catch (PDOException $e) {
            $this->errors[] = 'Database error occurred';
            return false;
        }
    }
    
    public function getErrors() {
        return $this->errors;
    }
}

// Secure authentication
class SecureAuth {
    public function login($email, $password) {
        try {
            $pdo = new PDO("mysql:host=localhost;dbname=secure_app", "user", "pass");
            $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
            
            $stmt = $pdo->prepare("SELECT id, name, email, password FROM users WHERE email = ?");
            $stmt->execute([$email]);
            $user = $stmt->fetch(PDO::FETCH_ASSOC);
            
            if ($user && Security::verifyPassword($password, $user['password'])) {
                // Regenerate session ID to prevent session fixation
                session_regenerate_id(true);
                
                $_SESSION['user_id'] = $user['id'];
                $_SESSION['user_name'] = $user['name'];
                $_SESSION['user_email'] = $user['email'];
                
                return true;
            }
            
            return false;
        } catch (PDOException $e) {
            error_log("Login error: " . $e->getMessage());
            return false;
        }
    }
    
    public function isLoggedIn() {
        return isset($_SESSION['user_id']);
    }
    
    public function logout() {
        session_destroy();
        return true;
    }
}

// Usage example
session_start();

$form = new SecureForm();
$auth = new SecureAuth();

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if ($form->processRegistration($_POST)) {
        echo "Registration successful!";
    } else {
        echo "Registration failed: " . implode(', ', $form->getErrors());
    }
}