From 3be02e67688e194073c687c6420dd877cd204311 Mon Sep 17 00:00:00 2001 From: Josh Ashton Date: Fri, 7 Mar 2025 03:57:09 -0700 Subject: [PATCH] cleanup and sync --- includes/fields/create_account_fields.php | 65 ++++++++++ includes/fields/login_fields.php | 8 +- includes/input_validation.php | 147 ++++++++++++++++------ includes/sql.php | 9 +- process.php | 8 +- scripts/initdb.sh | 2 + 6 files changed, 190 insertions(+), 49 deletions(-) create mode 100644 includes/fields/create_account_fields.php diff --git a/includes/fields/create_account_fields.php b/includes/fields/create_account_fields.php new file mode 100644 index 0000000..1f73de2 --- /dev/null +++ b/includes/fields/create_account_fields.php @@ -0,0 +1,65 @@ + 'post', + 'action' => 'process.php?action=create_account', + 'create_account_username' => [ + 'label' => 'username', + 'type' => 'text', + 'placeholder' => 'e.g., jsmith', + 'validators' => [ + 'no_spaces', + 'check_sql', + ], + ], + 'create_account_first_name' => [ + 'label' => 'first name', + 'type' => 'text', + 'placeholder' => 'e.g., John', + 'validators' => [ + 'no_spaces', + 'only_letters', + 'check_sql', + ], + ], + 'create_account_last_name' => [ + 'label' => 'last name', + 'type' => 'text', + 'placeholder' => 'e.g., Smith', + 'validators' => [ + 'no_spaces', + 'only_letters', + 'check_sql', + ], + ], + 'create_account_email' => [ + 'label' => 'email address', + 'type' => 'text', + 'placeholder' => 'e.g., jsmith@email.com', + 'validators' => [ + 'valid_email', + 'check_sql', + ], + ], + 'create_account_password' => [ + 'label' => 'password', + 'type' => 'password', + 'placeholder' => '', + 'validators' => [ + 'no_spaces', + 'pw_strength', + 'no_backslash', + 'check_sql', + ], + ], + 'verify_create_account_password' => [ + 'label' => 'password', + 'type' => 'password', + 'placeholder' => '', + 'validators' => [ + 'no_spaces', + 'pw_strength', + 'no_backslash', + 'check_sql', + ], + ], +]; diff --git a/includes/fields/login_fields.php b/includes/fields/login_fields.php index 5f796b1..985f95c 100644 --- a/includes/fields/login_fields.php +++ b/includes/fields/login_fields.php @@ -8,7 +8,7 @@ $login_fields = [ 'placeholder' => 'e.g., jsmith', 'validators' => [ 'no_spaces', - // 'check_sql', + 'check_sql', ], ], 'login_password' => [ @@ -17,9 +17,9 @@ $login_fields = [ 'placeholder' => '', 'validators' => [ 'no_spaces', - // 'pw_strength', - // 'no_backslash', - // 'check_sql', + 'pw_strength', + 'no_backslash', + 'check_sql', ], ], ]; diff --git a/includes/input_validation.php b/includes/input_validation.php index 7331ca7..d632307 100755 --- a/includes/input_validation.php +++ b/includes/input_validation.php @@ -1,53 +1,122 @@ + * Date: 06 March 2025 + * Version: v0.1.0 * - * Each function accepts at least an input string, and will return either true - * or false. It is up to the client to interpret that and create error messages - * and ensure data format consistency accordingly. * - * EXAMPLE CLIENT DATA IMPLEMENTATION + * A data format standard for easily creating forms with input validation. * - * $standard_fields = [ - * 'ca-username' => [ - * // Placeholder text - * 'e.g., jsmith', * - * // Validation requirements - * [ - * 'no_spaces', - * 'checkSQL', - * ], - * ], - * ]; + * This file provides functions for validating form input data. For any given + * field in an associative array, provide an array of validation requirements. + * This is to enable modular data fields while ensuring data integrity and + * safety from SQL injection. * - * EXAMPLE CLIENT IMPLEMENTATION * - * function validate($standard_fields, $admin_fields) { - * include('includes/input_validation.php'); - * $error = ''; - * foreach($standard_fields as $field => $arr) { - * // Get the requirements from the associative array. - * $validationRequirements = $arr[1]; + * Each function accepts at least an input string, and will return either true + * or false. It is up to the client to interpret that and create error messages + * and ensure data format consistency accordingly. * - * foreach($validationRequirements as $validReq) { - * switch($validReq) { - * case 'no_spaces': - * if(no_spaces($_POST[$field])) { - * $error .= '

' . $field . ' does not allow spaces.

'; - * } - * break; - * default: - * $error .= '

Something went wrong...

'; - * break; - * } + * + * ***************************************************************************** + * + * + * EXAMPLE LOGIN DATA IMPLEMENTATION + * + * + * $login_fields = [ + * 'method' => 'post', + * 'action' => 'process.php?action=login', + * 'login_username' => [ + * 'label' => 'username', + * 'type' => 'text', + * 'placeholder' => 'e.g., jsmith', + * 'validators' => [ + * 'no_spaces', + * 'check_sql', + * ], + * ], + * + * 'login_password' => [ + * 'label' => 'password', + * 'type' => 'password', + * 'placeholder' => '', + * 'validators' => [ + * 'no_spaces', + * 'pw_strength', + * 'no_backslash', + * 'check_sql', + * ], + * ], + * ]; + * + * + * ***************************************************************************** + * + * + * CLIENT VALIDATION IMPLEMENTATION + * + * + * function validate($input, $validators) + * { + * include_once ('includes/input_validation.php'); + * + * foreach ($validators as $v) { + * switch ($v) { + * case 'no_spaces': + * if (!no_spaces($input)) + * return false; + * break; + * case 'no_digits': + * if (!no_digits($input)) + * return false; + * break; + * case 'no_backslash': + * if (!no_backslash($input)) + * return false; + * break; + * case 'no_special': + * if (!no_special($input)) + * return false; + * break; + * case 'only_digits': + * if (!only_digits($input)) + * return false; + * break; + * case 'only_digits_x': + * if (!only_digits_x($input, 5)) + * return false; + * break; + * case 'only_letters': + * if (!only_letters($input)) + * return false; + * break; + * case 'only_letters_x': + * if (!only_letters_x($input, 5)) + * return false; + * break; + * case 'valid_email': + * if (!valid_email($input)) + * return false; + * break; + * case 'valid_phone': + * if (!valid_phone($input)) + * return false; + * break; + * case 'pw_strength': + * if (!pw_strength($input)) + * return false; + * break; + * case 'check_sql': + * if (check_sql($input)) + * return false; + * break; + * } * } - * } - * } + * return true; + * } */ function no_spaces($input) diff --git a/includes/sql.php b/includes/sql.php index fbe262e..b6756d7 100755 --- a/includes/sql.php +++ b/includes/sql.php @@ -13,10 +13,13 @@ define('USER', $db_user); define('PASS', $db_pass); define('DB', 'vintagecodingdotnet'); +// **************** ACCOUNT QUERIES *************** // + /* - * For use by an administrator. + * IMPORTANT: This should only be called once a user has been authorized as an + * administrator. * - * TODO: Use JOIN to get role, profile picture, etc. + * TODO: Use JOIN to get other columns like roles and profile pictures. */ function get_all_accounts() { @@ -50,6 +53,8 @@ function get_account_role($username) return $results; } +// **************** ARTICLE QUERIES *************** // + function get_all_article_cards() { $conn = mysqli_connect(HOST, USER, PASS, DB); diff --git a/process.php b/process.php index 7c59050..d472ba1 100644 --- a/process.php +++ b/process.php @@ -3,7 +3,7 @@ if (!isset($_GET['action'])) header('Location: .'); -include_once('includes/functions.php'); +include_once ('includes/functions.php'); $action = $_GET['action']; @@ -16,7 +16,7 @@ switch ($action) { if (empty($_POST['login_username']) || empty($_POST['login_password'])) header('Location: ' . $error_location . 'empty'); - include_once('fields/login_fields.php'); + include_once ('fields/login_fields.php'); // If field inputs are invalid, redirect to login with error state. foreach ($_POST as $field => $value) { if (!validate($value, $login_fields[$field]['validators'])) @@ -34,7 +34,7 @@ switch ($action) { unset($_POST['login_password']); // auth() handles setting $_SESSION variables, user is now OK to proceed to home.php. - // header('Location: ' . $success_location); + header('Location: ' . $success_location); default: // code... break; @@ -42,7 +42,7 @@ switch ($action) { function validate($input, $validators) { - include_once('includes/input_validation.php'); + include_once ('includes/input_validation.php'); foreach ($validators as $v) { switch ($v) { diff --git a/scripts/initdb.sh b/scripts/initdb.sh index 342c3f4..9cf0183 100755 --- a/scripts/initdb.sh +++ b/scripts/initdb.sh @@ -35,6 +35,8 @@ create_db() { CREATE TABLE accounts ( account_id INT PRIMARY KEY, username VARCHAR(32) UNIQUE NOT NULL, + first_name VARCHAR(64) NOT NULL, + last_name VARCHAR(64) NOT NULL, email VARCHAR(64) UNIQUE NOT NULL, password_hash VARCHAR(64) NOT NULL, role INT NOT NULL,