cleanup and sync

includes/fields/create_account_fields.php

@@ -0,0 +1,65 @@
+<?php
+$create_account_fields = [
+    'method' => 'post',
+    'action' => 'process.php?action=create_account',
+    'create_account_username' => [
+        'label' => 'username',
+        'type' => 'text',
+        'placeholder' => 'e.g., jsmith',
+        'validators' => [
+            'no_spaces',
+            'check_sql',
+        ],
+    ],
+    'create_account_first_name' => [
+        'label' => 'first name',
+        'type' => 'text',
+        'placeholder' => 'e.g., John',
+        'validators' => [
+            'no_spaces',
+            'only_letters',
+            'check_sql',
+        ],
+    ],
+    'create_account_last_name' => [
+        'label' => 'last name',
+        'type' => 'text',
+        'placeholder' => 'e.g., Smith',
+        'validators' => [
+            'no_spaces',
+            'only_letters',
+            'check_sql',
+        ],
+    ],
+    'create_account_email' => [
+        'label' => 'email address',
+        'type' => 'text',
+        'placeholder' => 'e.g., jsmith@email.com',
+        'validators' => [
+            'valid_email',
+            'check_sql',
+        ],
+    ],
+    'create_account_password' => [
+        'label' => 'password',
+        'type' => 'password',
+        'placeholder' => '',
+        'validators' => [
+            'no_spaces',
+            'pw_strength',
+            'no_backslash',
+            'check_sql',
+        ],
+    ],
+    'verify_create_account_password' => [
+        'label' => 'password',
+        'type' => 'password',
+        'placeholder' => '',
+        'validators' => [
+            'no_spaces',
+            'pw_strength',
+            'no_backslash',
+            'check_sql',
+        ],
+    ],
+];

includes/fields/login_fields.php

@@ -8,7 +8,7 @@ $login_fields = [
         'placeholder' => 'e.g., jsmith',
         'validators' => [
             'no_spaces',
-            // 'check_sql',
+            'check_sql',
         ],
     ],
     'login_password' => [
@@ -17,9 +17,9 @@ $login_fields = [
         'placeholder' => '',
         'validators' => [
             'no_spaces',
-            // 'pw_strength',
+            'pw_strength',
-            // 'no_backslash',
+            'no_backslash',
-            // 'check_sql',
+            'check_sql',
         ],
     ],
 ];

includes/input_validation.php

@@ -1,53 +1,122 @@
 <?php
 
 /*
- * This file provides functions for validating form input data. For any given
+ * Author:              Joshua Ashton <me@joshashton.dev>
- * field in an associative array, provide an array of validation requirements.
+ *  Date:               06 March 2025
- * This is to enable modular data fields while ensuring data integrity and
+ *  Version:            v0.1.0
- * safety from SQL injection.
  *
- * Each function accepts at least an input string, and will return either true
- * or false. It is up to the client to interpret that and create error messages
- * and ensure data format consistency accordingly.
  *
- * EXAMPLE CLIENT DATA IMPLEMENTATION
+ *  A data format standard for easily creating forms with input validation.
  *
- * $standard_fields = [
- *  'ca-username' => [
- *    // Placeholder text
- *    'e.g., jsmith',
  *
- *    // Validation requirements
+ *  This file provides functions for validating form input data. For any given
- *    [
+ *  field in an associative array, provide an array of validation requirements.
- *      'no_spaces',
+ *  This is to enable modular data fields while ensuring data integrity and
- *      'checkSQL',
+ *  safety from SQL injection.
- *    ],
- *  ],
- * ];
  *
- * EXAMPLE CLIENT IMPLEMENTATION
  *
- * function validate($standard_fields, $admin_fields) {
+ *  Each function accepts at least an input string, and will return either true
- *    include('includes/input_validation.php');
+ *  or false. It is up to the client to interpret that and create error messages
- *    $error = '';
+ *  and ensure data format consistency accordingly.
- *    foreach($standard_fields as $field => $arr) {
- *      // Get the requirements from the associative array.
- *      $validationRequirements = $arr[1];
  *
- *      foreach($validationRequirements as $validReq) {
+ *
- *        switch($validReq) {
+ * *****************************************************************************
- *          case 'no_spaces':
+ *
- *            if(no_spaces($_POST[$field])) {
+ *
- *              $error .= '<p>' . $field . ' does not allow spaces.</p>';
+ *  EXAMPLE LOGIN DATA IMPLEMENTATION
- *            }
+ *
- *            break;
+ *
- *          default:
+ *  $login_fields = [
- *            $error .= '<p>Something went wrong...</p>';
+ *      'method' => 'post',
- *            break;
+ *      'action' => 'process.php?action=login',
- *        }
+ *      'login_username' => [
+ *          'label' => 'username',
+ *          'type' => 'text',
+ *          'placeholder' => 'e.g., jsmith',
+ *          'validators' => [
+ *              'no_spaces',
+ *              'check_sql',
+ *          ],
+ *      ],
+ *
+ *      'login_password' => [
+ *          'label' => 'password',
+ *          'type' => 'password',
+ *          'placeholder' => '',
+ *          'validators' => [
+ *              'no_spaces',
+ *              'pw_strength',
+ *              'no_backslash',
+ *              'check_sql',
+ *          ],
+ *      ],
+ *  ];
+ *
+ *
+ * *****************************************************************************
+ *
+ *
+ *  CLIENT VALIDATION IMPLEMENTATION
+ *
+ *
+ *  function validate($input, $validators)
+ *  {
+ *      include_once ('includes/input_validation.php');
+ *
+ *      foreach ($validators as $v) {
+ *          switch ($v) {
+ *              case 'no_spaces':
+ *                  if (!no_spaces($input))
+ *                      return false;
+ *                  break;
+ *              case 'no_digits':
+ *                  if (!no_digits($input))
+ *                      return false;
+ *                  break;
+ *              case 'no_backslash':
+ *                  if (!no_backslash($input))
+ *                      return false;
+ *                  break;
+ *              case 'no_special':
+ *                  if (!no_special($input))
+ *                      return false;
+ *                  break;
+ *              case 'only_digits':
+ *                  if (!only_digits($input))
+ *                      return false;
+ *                  break;
+ *              case 'only_digits_x':
+ *                  if (!only_digits_x($input, 5))
+ *                      return false;
+ *                  break;
+ *              case 'only_letters':
+ *                  if (!only_letters($input))
+ *                      return false;
+ *                  break;
+ *              case 'only_letters_x':
+ *                  if (!only_letters_x($input, 5))
+ *                      return false;
+ *                  break;
+ *              case 'valid_email':
+ *                  if (!valid_email($input))
+ *                      return false;
+ *                  break;
+ *              case 'valid_phone':
+ *                  if (!valid_phone($input))
+ *                      return false;
+ *                  break;
+ *              case 'pw_strength':
+ *                  if (!pw_strength($input))
+ *                      return false;
+ *                  break;
+ *              case 'check_sql':
+ *                  if (check_sql($input))
+ *                      return false;
+ *                  break;
+ *              }
  *      }
- *    }
+ *      return true;
- * }
+ *  }
  */
 
 function no_spaces($input)

includes/sql.php

@@ -13,10 +13,13 @@ define('USER', $db_user);
 define('PASS', $db_pass);
 define('DB', 'vintagecodingdotnet');
 
+// **************** ACCOUNT QUERIES *************** //
+
 /*
- * For use by an administrator.
+ * IMPORTANT: This should only be called once a user has been authorized as an
+ *  administrator.
  *
- * TODO: Use JOIN to get role, profile picture, etc.
+ *  TODO: Use JOIN to get other columns like roles and profile pictures.
  */
 function get_all_accounts()
 {
@@ -50,6 +53,8 @@ function get_account_role($username)
     return $results;
 }
 
+// **************** ARTICLE QUERIES *************** //
+
 function get_all_article_cards()
 {
     $conn = mysqli_connect(HOST, USER, PASS, DB);

process.php

@@ -3,7 +3,7 @@
 if (!isset($_GET['action']))
     header('Location: .');
 
-include_once('includes/functions.php');
+include_once ('includes/functions.php');
 
 $action = $_GET['action'];
 
@@ -16,7 +16,7 @@ switch ($action) {
         if (empty($_POST['login_username']) || empty($_POST['login_password']))
             header('Location: ' . $error_location . 'empty');
 
-        include_once('fields/login_fields.php');
+        include_once ('fields/login_fields.php');
         // If field inputs are invalid, redirect to login with error state.
         foreach ($_POST as $field => $value) {
             if (!validate($value, $login_fields[$field]['validators']))
@@ -34,7 +34,7 @@ switch ($action) {
         unset($_POST['login_password']);
 
         // auth() handles setting $_SESSION variables, user is now OK to proceed to home.php.
-        // header('Location: ' . $success_location);
+        header('Location: ' . $success_location);
     default:
         // code...
         break;
@@ -42,7 +42,7 @@ switch ($action) {
 
 function validate($input, $validators)
 {
-    include_once('includes/input_validation.php');
+    include_once ('includes/input_validation.php');
 
     foreach ($validators as $v) {
         switch ($v) {

scripts/initdb.sh

@@ -35,6 +35,8 @@ create_db() {
     CREATE TABLE accounts (
         account_id INT PRIMARY KEY,
         username VARCHAR(32) UNIQUE NOT NULL,
+        first_name VARCHAR(64) NOT NULL,
+        last_name VARCHAR(64) NOT NULL,
         email VARCHAR(64) UNIQUE NOT NULL,
         password_hash VARCHAR(64) NOT NULL,
         role INT NOT NULL,