<?php
/**
 * Securely fetch user ID from a database using prepared statements.
 * Prevents SQL Injection (A03:2021-Injection).
 *
 * @param PDO $pdo The PDO database connection object.
 * @param int $userId The user ID to search for.
 * @return array|false The user data if found, otherwise false.
 */
function getUserById(PDO $pdo, int $userId): array|false {
    // We prepare the statement to separate query structure from user input.
    // This is the fundamental defense against SQL Injection.
    $stmt = $pdo->prepare('SELECT id, username, email FROM users WHERE id = :id');
    $stmt->bindParam(':id', $userId, PDO::PARAM_INT);
    $stmt->execute();
    return $stmt->fetch(PDO::FETCH_ASSOC);
}

/**
 * Echo user-provided content safely to prevent Cross-Site Scripting (XSS).
 * Prevents Cross-Site Scripting (A07:2021-XSS).
 *
 * @param string $input The user-provided string to escape.
 * @return string The HTML-safe string.
 */
function escapeHtml(string $input): string {
    // We encode special characters to HTML entities.
    // This ensures browsers interpret user input as data, not executable code.
    return htmlspecialchars($input, ENT_QUOTES | ENT_HTML5, 'UTF-8');
}

// Example Usage:
$host = 'localhost';
$db   = 'mydb';
$user = 'root';
$pass = '';
$charset = 'utf8mb4';

$dsn = "mysql:host=$host;dbname=$db;charset=$charset";
$options = [
    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
    PDO::ATTR_EMULATE_PREPARES   => false, // Crucial for real prepared statements
];

try {
    $pdo = new PDO($dsn, $user, $pass, $options);

    // Simulate getting user input
    $userInputId = $_GET['id'] ?? 1;
    $userData = getUserById($pdo, (int)$userInputId);

    if ($userData) {
        echo "<p>Welcome, <strong>" . escapeHtml($userData['username']) . "</strong>!</p>";
    } else {
        echo "<p>User not found.</p>";
    }

    $userComment = '<script>alert("XSS!")</script> This is a comment.';
    echo "<p>User Comment: " . escapeHtml($userComment) . "</p>";

} catch (PDOException $e) {
    // We activate robust error logging without exposing internal details to the user.
    error_log('Database Error: ' . $e->getMessage());
    echo "<p>An internal error occurred. Please try again later.</p>";
}
?>

<?php
// We configure secure session parameters at the application's entry point (e.g., public/index.php)
ini_set('session.cookie_httponly', 1); // Prevents JavaScript access to session cookie
ini_set('session.cookie_secure', 1);   // Sends cookie only over HTTPS
ini_set('session.use_strict_mode', 1); // Prevents session fixation by using only valid session IDs
ini_set('session.use_only_cookies', 1); // Prevents session ID from appearing in URLs

session_start(); // We initiate the session securely

/**
 * Generates a unique, secure session ID after successful authentication.
 * Prevents session fixation attacks.
 */
function regenerateSessionId(): void {
    // We generate a new session ID, invalidating the old one.
    session_regenerate_id(true);
}

/**
 * Authenticates a user and manages session security.
 * Addresses A07:2021-Identification and Authentication Failures.
 *
 * @param string $username User-provided username.
 * @param string $password User-provided password.
 * @param PDO $pdo Database connection.
 * @return bool True if authentication is successful, false otherwise.
 */
function authenticateUser(string $username, string $password, PDO $pdo): bool {
    // We fetch the user record including hashed password and salt.
    $stmt = $pdo->prepare('SELECT id, username, password_hash FROM users WHERE username = :username');
    $stmt->bindParam(':username', $username, PDO::PARAM_STR);
    $stmt->execute();
    $user = $stmt->fetch(PDO::FETCH_ASSOC);

    if ($user && password_verify($password, $user['password_hash'])) {
        regenerateSessionId(); // We forge a new session ID upon successful login
        $_SESSION['user_id'] = $user['id'];
        $_SESSION['username'] = $user['username'];
        $_SESSION['LAST_ACTIVITY'] = time(); // We establish an activity timestamp for session timeout
        return true;
    }
    return false;
}

/**
 * Verifies if the user is logged in and maintains session integrity.
 *
 * @return bool True if logged in and session is active, false otherwise.
 */
function checkLogin(): bool {
    if (!isset($_SESSION['user_id'])) {
        return false;
    }

    // We implement a session timeout mechanism.
    if (isset($_SESSION['LAST_ACTIVITY']) && (time() - $_SESSION['LAST_ACTIVITY'] > 1800)) { // 30 minutes
        session_unset();     // We free all session variables
        session_destroy();   // We destroy the session
        return false;
    }
    $_SESSION['LAST_ACTIVITY'] = time(); // We update last activity timestamp
    return true;
}

/**
 * Checks if the logged-in user has the required role for a resource.
 * Addresses A01:2021-Broken Access Control.
 *
 * @param string $requiredRole The role needed to access the resource.
 * @param PDO $pdo Database connection.
 * @return bool True if the user has the role, false otherwise.
 */
function authorizeUser(string $requiredRole, PDO $pdo): bool {
    if (!checkLogin()) {
        return false;
    }

    // We retrieve user roles from the database based on their ID.
    $stmt = $pdo->prepare('SELECT r.name FROM user_roles ur JOIN roles r ON ur.role_id = r.id WHERE ur.user_id = :user_id');
    $stmt->bindParam(':user_id', $_SESSION['user_id'], PDO::PARAM_INT);
    $stmt->execute();
    $userRoles = $stmt->fetchAll(PDO::FETCH_COLUMN);

    // We verify if the required role is present in the user's roles.
    return in_array($requiredRole, $userRoles);
}

// Example: Protecting an admin page
// if (!authorizeUser('admin', $pdo)) {
//     header('Location: /login.php');
//     exit();
// }
?>

<?php
// We enforce robust PHP configuration settings at the application level (e.g., public/index.php or .user.ini)
// Addresses A05:2021-Security Misconfiguration.
ini_set('display_errors', 'Off'); // Crucial: Never display errors to users in production
ini_set('log_errors', 'On');       // Always log errors for developer review
ini_set('error_log', '/path/to/php-error.log'); // We specify a secure, non-web-accessible error log path

// We restrict file uploads to prevent malicious script execution (if file uploads are permitted)
// ini_set('upload_tmp_dir', '/path/to/secure/upload_tmp'); // Specify a dedicated temporary directory

// We ensure only specific HTTP methods are allowed for certain endpoints (example in a routing context)
// if ($_SERVER['REQUEST_METHOD'] !== 'POST' && $_SERVER['REQUEST_URI'] === '/submit-form') {
//     header('HTTP/1.1 405 Method Not Allowed');
//     exit('Method Not Allowed');
// }

// We scan for vulnerable PHP dependencies using Composer (run from command line)
// composer require symfony/security-checker --dev
// vendor/bin/security-checker security:check composer.lock

// We keep our PHP version updated (example: check current version)
// if (version_compare(PHP_VERSION, '8.2.0', '<')) {
//     // We alert for outdated PHP versions requiring upgrade for security patches.
//     error_log('Outdated PHP version detected: ' . PHP_VERSION);
// }

// We ensure server headers do not leak sensitive information (example in a framework/web server config)
// In Nginx/Apache config, remove/hide X-Powered-By, Server headers.
// header_remove('X-Powered-By'); // Can be done in PHP but better handled at web server level.
?>

<?php
/**
 * Example of a secure design choice: Use a dedicated, sandboxed environment for external API calls (e.g., SSRF prevention).
 * Addresses A04:2021-Insecure Design and A10:2021-Server-Side Request Forgery.
 *
 * Insecure design often leads to vulnerabilities like SSRF. We mitigate by controlling outbound requests.
 * Ideally, this would be a separate microservice or a tightly controlled cURL/Guzzle setup.
 *
 * @param string $url The URL to request.
 * @param array $options Guzzle/cURL options.
 * @return string Response body.
 * @throws Exception If the request fails or URL is invalid.
 */
function fetchExternalDataSecurely(string $url, array $options = []): string {
    // We parse the URL to ensure it adheres to a whitelist of allowed domains/protocols.
    $host = parse_url($url, PHP_URL_HOST);
    $allowedHosts = ['api.example.com', 'trusted.cdn.com']; // We define a strict whitelist

    if (!in_array($host, $allowedHosts, true)) {
        throw new Exception('Attempted to access unauthorized external host.');
    }

    // Using a robust HTTP client like Guzzle for network requests.
    // We ensure proper timeouts and error handling.
    try {
        $client = new GuzzleHttp\Client(['timeout' => 5]);
        $response = $client->request('GET', $url, $options);
        if ($response->getStatusCode() === 200) {
            return (string) $response->getBody();
        }
        throw new Exception('External API request failed with status: ' . $response->getStatusCode());
    } catch (GuzzleHttp\Exception\GuzzleException $e) {
        // We log the full error but do not expose it to the client.
        error_log('Guzzle request failed: ' . $e->getMessage());
        throw new Exception('Failed to fetch external data due to network error.');
    }
}

/**
 * Securely encrypts data using a strong, industry-standard cryptographic method.
 * Addresses A02:2021-Cryptographic Failures.
 * We strongly discourage custom encryption implementations.
 *
 * @param string $data The plaintext data to encrypt.
 * @param string $key The secret key for encryption.
 * @return string The base64-encoded encrypted data with IV.
 * @throws Exception If encryption fails.
 */
function encryptData(string $data, string $key): string {
    $cipher = 'aes-256-cbc';
    if (!in_array($cipher, openssl_get_cipher_methods(true))) {
        throw new Exception('Unsupported cipher method.');
    }

    // We generate a strong, random Initialization Vector (IV).
    $iv_length = openssl_cipher_iv_length($cipher);
    $iv = openssl_random_pseudo_bytes($iv_length);
    if ($iv === false) {
        throw new Exception('Failed to generate IV.');
    }

    // We encrypt the data using OpenSSL.
    $encrypted = openssl_encrypt($data, $cipher, $key, OPENSSL_RAW_DATA, $iv);
    if ($encrypted === false) {
        throw new Exception('Encryption failed.');
    }

    // We concatenate IV and encrypted data for storage and base64-encode for transport.
    return base64_encode($iv . $encrypted);
}

/**
 * Securely decrypts data.
 *
 * @param string $encryptedData The base64-encoded encrypted data with IV.
 * @param string $key The secret key for decryption.
 * @return string The decrypted plaintext data.
 * @throws Exception If decryption fails or data is malformed.
 */
function decryptData(string $encryptedData, string $key): string {
    $cipher = 'aes-256-cbc';
    $iv_length = openssl_cipher_iv_length($cipher);

    $decoded = base64_decode($encryptedData, true);
    if ($decoded === false || strlen($decoded) < $iv_length) {
        throw new Exception('Malformed encrypted data.');
    }

    // We extract the IV and the encrypted data.
    $iv = substr($decoded, 0, $iv_length);
    $encrypted = substr($decoded, $iv_length);

    // We decrypt the data.
    $decrypted = openssl_decrypt($encrypted, $cipher, $key, OPENSSL_RAW_DATA, $iv);
    if ($decrypted === false) {
        throw new Exception('Decryption failed.');
    }

    return $decrypted;
}

// Example Usage:
$secretKey = 'a_very_secret_key_of_32_bytes_long!'; // We ensure this key is truly secret and robust

try {
    $originalData = 'This is sensitive information.';
    $encrypted = encryptData($originalData, $secretKey);
    echo "<p>Encrypted: " . $encrypted . "</p>";

    $decrypted = decryptData($encrypted, $secretKey);
    echo "<p>Decrypted: " . $decrypted . "</p>";

    // Example of calling external data (requires Guzzle to be installed via composer)
    // $externalContent = fetchExternalDataSecurely('https://api.example.com/data');
    // echo "<p>External Data: " . htmlspecialchars($externalContent) . "</p>";

} catch (Exception $e) {
    error_log('Cryptographic/Design Error: ' . $e->getMessage());
    echo "<p>An error occurred: " . htmlspecialchars($e->getMessage()) . "</p>";
}
?>