<?php
declare(strict_types=1);

session_start();

/*
|--------------------------------------------------------------------------
| OWASP Secure Demo
|--------------------------------------------------------------------------
| This single file demonstrates:
| - Prepared statements to avoid SQL Injection
| - htmlspecialchars() to reduce XSS risk in output
| - CSRF token protection for form submission
| - Basic authorization check for sensitive actions
| - password_hash() / password_verify() for password storage
|
| In a real project, split this into multiple files.
*/

// -----------------------------
// 1) Database setup
// -----------------------------
$dbFile = __DIR__ . '/owasp_demo.sqlite';

$pdo = new PDO('sqlite:' . $dbFile);
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

// Create a simple users table if it does not exist
$pdo->exec("
    CREATE TABLE IF NOT EXISTS users (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        name TEXT NOT NULL,
        email TEXT NOT NULL UNIQUE,
        password TEXT NOT NULL,
        role TEXT NOT NULL DEFAULT 'user',
        bio TEXT DEFAULT ''
    )
");

// Seed one demo user if database is empty
$count = (int) $pdo->query("SELECT COUNT(*) FROM users")->fetchColumn();

if ($count === 0) {
    $stmt = $pdo->prepare("INSERT INTO users (name, email, password, role, bio) VALUES (?, ?, ?, ?, ?)");
    $stmt->execute([
        'Admin User',
        'admin@example.com',
        password_hash('Admin@123', PASSWORD_DEFAULT),
        'admin',
        'This is <b>admin</b> bio.'
    ]);
}

// -----------------------------
// 2) CSRF token setup
// -----------------------------
if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}

// -----------------------------
// 3) Simulated login
// -----------------------------
// For demo purpose, we auto-login the first user.
// In real life, this should come from a login form and password verification.
if (empty($_SESSION['user_id'])) {
    $user = $pdo->query("SELECT id, name, email, role, bio FROM users ORDER BY id ASC LIMIT 1")->fetch(PDO::FETCH_ASSOC);
    $_SESSION['user_id'] = (int) $user['id'];
    $_SESSION['user_role'] = $user['role'];
    $_SESSION['user_name'] = $user['name'];
}

// -----------------------------
// 4) Handle form submission
// -----------------------------
$message = '';
$error = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // CSRF validation
    $token = $_POST['csrf_token'] ?? '';
    if (!hash_equals($_SESSION['csrf_token'], $token)) {
        $error = 'Invalid CSRF token.';
    } else {
        // Basic authorization check
        if (empty($_SESSION['user_id'])) {
            $error = 'You must be logged in to update profile.';
        } else {
            $name = trim($_POST['name'] ?? '');
            $bio = trim($_POST['bio'] ?? '');
            $newPassword = trim($_POST['password'] ?? '');

            if ($name === '') {
                $error = 'Name is required.';
            } else {
                // Prepared statement prevents SQL injection
                $stmt = $pdo->prepare("UPDATE users SET name = ?, bio = ? WHERE id = ?");
                $stmt->execute([
                    $name,
                    $bio,
                    $_SESSION['user_id']
                ]);

                // Optional password update
                if ($newPassword !== '') {
                    if (strlen($newPassword) < 8) {
                        $error = 'Password must be at least 8 characters.';
                    } else {
                        $hashedPassword = password_hash($newPassword, PASSWORD_DEFAULT);

                        $stmt = $pdo->prepare("UPDATE users SET password = ? WHERE id = ?");
                        $stmt->execute([
                            $hashedPassword,
                            $_SESSION['user_id']
                        ]);
                    }
                }

                if ($error === '') {
                    $message = 'Profile updated successfully.';
                }
            }
        }
    }
}

// Load current user data safely
$stmt = $pdo->prepare("SELECT id, name, email, role, bio FROM users WHERE id = ?");
$stmt->execute([$_SESSION['user_id']]);
$currentUser = $stmt->fetch(PDO::FETCH_ASSOC);
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>OWASP Secure Demo</title>
</head>
<body>
    <h1>OWASP Secure PHP Demo</h1>

    <p><strong>Logged in as:</strong> <?php echo htmlspecialchars($currentUser['name']); ?> (<?php echo htmlspecialchars($currentUser['role']); ?>)</p>

    <?php if ($message): ?>
        <p style="color: green;"><?php echo htmlspecialchars($message); ?></p>
    <?php endif; ?>

    <?php if ($error): ?>
        <p style="color: red;"><?php echo htmlspecialchars($error); ?></p>
    <?php endif; ?>

    <h2>Update Profile</h2>

    <form method="POST">
        <input type="hidden" name="csrf_token" value="<?php echo htmlspecialchars($_SESSION['csrf_token']); ?>">

        <label>Name:</label><br>
        <input type="text" name="name" value="<?php echo htmlspecialchars($currentUser['name']); ?>"><br><br>

        <label>Bio:</label><br>
        <textarea name="bio" rows="4" cols="40"><?php echo htmlspecialchars($currentUser['bio']); ?></textarea><br><br>

        <label>New Password (optional):</label><br>
        <input type="password" name="password"><br><br>

        <button type="submit">Save</button>
    </form>

    <h2>Why this is secure</h2>
    <ul>
        <li>Prepared statements reduce SQL injection risk.</li>
        <li>htmlspecialchars() helps protect HTML output from XSS.</li>
        <li>CSRF token blocks forged form submissions.</li>
        <li>Session check is a basic authorization control.</li>
        <li>password_hash() stores passwords safely.</li>
    </ul>
</body>
</html>