Input Validation & Sanitization

<?php
// SIKKER KODE - Best practices for input validation

// 1. TYPE-SAFE VALIDATION med filter_input()
$user_id = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT);

if ($user_id === false || $user_id === null) {
    http_response_code(400);
    die("Invalid user ID");
}

// Brug prepared statement selv efter validation
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
$stmt->execute([$user_id]);

// 2. EMAIL VALIDATION
$email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);

if ($email === false || $email === null) {
    http_response_code(400);
    die("Invalid email address");
}

// Ekstra validation: Check email længde
if (strlen($email) > 255) {
    die("Email too long");
}

// Verificer domain eksisterer (optional)
list($user, $domain) = explode('@', $email);
if (!checkdnsrr($domain, 'MX')) {
    die("Email domain does not exist");
}

$stmt = $pdo->prepare("INSERT INTO subscribers (email) VALUES (?)");
$stmt->execute([$email]);

// 3. WHITELIST VALIDATION for enumerated values
$allowed_sort_columns = ['name', 'price', 'created_at'];
$sort_column = $_GET['sort'] ?? 'name';

if (!in_array($sort_column, $allowed_sort_columns, true)) {
    $sort_column = 'name'; // Fallback til default
}

// Nu er det sikkert at bruge i SQL (column names kan ikke parameteriseres)
$allowed_directions = ['ASC', 'DESC'];
$direction = strtoupper($_GET['dir'] ?? 'ASC');

if (!in_array($direction, $allowed_directions, true)) {
    $direction = 'ASC';
}

$query = "SELECT * FROM products ORDER BY {$sort_column} {$direction}";
$stmt = $pdo->query($query);

// 4. COMPREHENSIVE INPUT VALIDATION CLASS
class InputValidator {
    public static function validateUsername($username) {
        // Whitelist: kun alfanumeriske tegn og underscore
        if (!preg_match('/^[a-zA-Z0-9_]{3,20}$/', $username)) {
            return false;
        }
        return $username;
    }
    
    public static function validatePassword($password) {
        $errors = [];
        
        if (strlen($password) < 12) {
            $errors[] = "Minimum 12 characters";
        }
        
        if (strlen($password) > 128) {
            $errors[] = "Maximum 128 characters";
        }
        
        if (!preg_match('/[A-Z]/', $password)) {
            $errors[] = "Must contain uppercase letter";
        }
        
        if (!preg_match('/[a-z]/', $password)) {
            $errors[] = "Must contain lowercase letter";
        }
        
        if (!preg_match('/[0-9]/', $password)) {
            $errors[] = "Must contain number";
        }
        
        if (!preg_match('/[^A-Za-z0-9]/', $password)) {
            $errors[] = "Must contain special character";
        }
        
        return empty($errors) ? true : $errors;
    }
    
    public static function validateURL($url) {
        $url = filter_var($url, FILTER_VALIDATE_URL);
        
        if ($url === false) {
            return false;
        }
        
        // Whitelist allowed protocols
        $parsed = parse_url($url);
        if (!isset($parsed['scheme']) || !in_array($parsed['scheme'], ['http', 'https'], true)) {
            return false;
        }
        
        return $url;
    }
    
    public static function validateInt($value, $min = null, $max = null) {
        $int = filter_var($value, FILTER_VALIDATE_INT);
        
        if ($int === false) {
            return false;
        }
        
        if ($min !== null && $int < $min) {
            return false;
        }
        
        if ($max !== null && $int > $max) {
            return false;
        }
        
        return $int;
    }
}

// Brug validation class
$username = $_POST['username'] ?? '';
if (!InputValidator::validateUsername($username)) {
    die("Invalid username format");
}

// 5. SIKKER FILE UPLOAD VALIDATION
if (isset($_FILES['upload'])) {
    $file = $_FILES['upload'];
    
    // Check for upload errors
    if ($file['error'] !== UPLOAD_ERR_OK) {
        die("Upload error: " . $file['error']);
    }
    
    // Validate file size (max 5MB)
    $max_size = 5 * 1024 * 1024;
    if ($file['size'] > $max_size) {
        die("File too large");
    }
    
    // Validate MIME type
    $allowed_types = ['image/jpeg', 'image/png', 'image/gif'];
    $finfo = new finfo(FILEINFO_MIME_TYPE);
    $mime_type = $finfo->file($file['tmp_name']);
    
    if (!in_array($mime_type, $allowed_types, true)) {
        die("Invalid file type");
    }
    
    // Validate file extension
    $allowed_extensions = ['jpg', 'jpeg', 'png', 'gif'];
    $extension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
    
    if (!in_array($extension, $allowed_extensions, true)) {
        die("Invalid file extension");
    }
    
    // Generate secure filename
    $new_filename = bin2hex(random_bytes(16)) . '.' . $extension;
    $destination = __DIR__ . '/uploads/' . $new_filename;
    
    // Ensure uploads directory is not web-accessible or disable PHP execution
    if (!move_uploaded_file($file['tmp_name'], $destination)) {
        die("Failed to save file");
    }
    
    echo "File uploaded successfully";
}

// 6. SANITIZATION baseret på kontekst
$user_input = $_POST['comment'] ?? '';

// For HTML output
$html_safe = htmlspecialchars($user_input, ENT_QUOTES | ENT_HTML5, 'UTF-8');
echo "<p>" . $html_safe . "</p>";

// For JavaScript output
$js_safe = json_encode($user_input, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT);
echo "<script>var comment = " . $js_safe . ";</script>";

// For URL parameter
$url_safe = urlencode($user_input);
echo "<a href='search.php?q=" . $url_safe . "'>Search</a>";

// 7. STRICT TYPES for ekstra sikkerhed
declare(strict_types=1);

function processUserId(int $user_id): void {
    // Garanterer at $user_id er integer
    global $pdo;
    $stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
    $stmt->execute([$user_id]);
}

// Dette vil kaste en TypeError hvis ikke integer
try {
    $id = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT);
    if ($id !== false && $id !== null) {
        processUserId($id);
    }
} catch (TypeError $e) {
    error_log("Type error: " . $e->getMessage());
    http_response_code(400);
    die("Invalid input type");
}

// 8. RATE LIMITING på input
class RateLimiter {
    private $redis;
    
    public function checkLimit($identifier, $max_attempts = 10, $window = 60) {
        $key = "rate_limit:" . $identifier;
        $current = $this->redis->incr($key);
        
        if ($current === 1) {
            $this->redis->expire($key, $window);
        }
        
        return $current <= $max_attempts;
    }
}
?>