Xavfsizlik

// Har bir misol qat'iy turlar rejimida ishlaydi.
function e(?string $matn): string
{
    return htmlspecialchars($matn ?? "", ENT_QUOTES, "UTF-8");
}

$xavfli = '<script>alert("xss")</script>';
// Atribut APOSTROF bilan yozilgan hujum
$atributHujumi = "' onmouseover='alert(1)";

echo "1. Ekranlanmagan (XAVFLI):\n";
echo "   <p>{$xavfli}</p>\n";

echo "\n2. htmlspecialchars bilan:\n";
echo "   <p>" . e($xavfli) . "</p>\n";

echo "\n3. Atribut apostrofda - ENT_COMPAT YETARLI EMAS:\n";
echo "   ENT_COMPAT:  <input value='"
   . htmlspecialchars($atributHujumi, ENT_COMPAT, "UTF-8") . "'>\n";
echo "   ENT_QUOTES:  <input value='" . e($atributHujumi) . "'>\n";

echo "\n";
echo "Birinchi qatorda apostrof EKRANLANMAGAN - hujumchi\n";
echo "atributdan chiqib, onmouseover qo'sha oldi.\n";
echo "Ikkinchi qatorda esa u &#039; ga aylandi.\n";

// CSRF tokeni: sessiyada saqlanadi, formaga qo'yiladi, qaytganda solishtiriladi
final class CsrfHimoya
{
    private array $sessiya = [];

    public function token(): string
    {
        if (!isset($this->sessiya["csrf"])) {
            // Haqiqiy kodda: bin2hex(random_bytes(32))
            $this->sessiya["csrf"] = str_repeat("a1b2", 8);
        }
        return $this->sessiya["csrf"];
    }

    public function maydon(): string
    {
        return '<input type="hidden" name="_token" value="' . $this->token() . '">';
    }

    public function tekshir(?string $kelgan): bool
    {
        $saqlangan = $this->sessiya["csrf"] ?? null;
        if ($saqlangan === null || $kelgan === null) {
            return false;
        }
        // hash_equals - VAQT hujumidan himoya
        return hash_equals($saqlangan, $kelgan);
    }
}

$csrf = new CsrfHimoya();

echo "Formaga qo'yiladigan maydon:\n";
echo "  " . $csrf->maydon() . "\n";

echo "\nTekshiruv natijalari:\n";
$sinovlar = [
    "to'g'ri token"     => $csrf->token(),
    "noto'g'ri token"   => "boshqa-token-qiymati",
    "bo'sh"             => null,
    "qisqartirilgan"    => substr($csrf->token(), 0, 10),
];

foreach ($sinovlar as $nom => $qiymat) {
    printf("  %-18s %s\n", $nom, $csrf->tekshir($qiymat) ? "QABUL" : "rad etildi");
}

$parol = "MeningKuchliParolim2024";

// 1. Xeshlash - har safar BOSHQA natija beradi
$xesh1 = password_hash($parol, PASSWORD_DEFAULT);
$xesh2 = password_hash($parol, PASSWORD_DEFAULT);

echo "Xesh uzunligi:      " . strlen($xesh1) . " belgi\n";
echo "Ikki xesh bir xilmi: " . ($xesh1 === $xesh2 ? "ha" : "yo'q") . "\n";
echo "(Har xeshda tasodifiy TUZ bor - shuning uchun har xil)\n";

echo "\n";
// 2. Tekshirish
printf("To'g'ri parol:    %s\n", password_verify($parol, $xesh1) ? "QABUL" : "rad");
printf("Noto'g'ri parol:  %s\n", password_verify("boshqaParol", $xesh1) ? "QABUL" : "rad");
printf("Ikkinchi xesh:    %s\n", password_verify($parol, $xesh2) ? "QABUL" : "rad");

echo "\n";
// 3. Xesh ichida nima bor
$qismlar = explode("$", $xesh1);
echo "Xesh tuzilishi:\n";
printf("  algoritm:  %s\n", $qismlar[1]);
printf("  narx:      %s\n", $qismlar[2]);
printf("  tuz+xesh:  %d belgi\n", strlen($qismlar[3]));

echo "\n";
// 4. Algoritm eskirganini tekshirish
$eskiXesh = password_hash($parol, PASSWORD_BCRYPT, ["cost" => 4]);
$yangilash = password_needs_rehash($eskiXesh, PASSWORD_DEFAULT);
echo "Eski xesh yangilanishi kerakmi: " . ($yangilash ? "ha" : "yo'q") . "\n";

$info = password_get_info($xesh1);
echo "Joriy xesh algoritmi: " . $info["algoName"] . "\n";

<?php
// config/sozlama.php - bu fayl git ga QO'SHILMAYDI
declare(strict_types=1);

return [
    "baza" => [
        "dsn"    => getenv("DB_DSN") ?: "mysql:host=localhost;dbname=dokon;charset=utf8mb4",
        "user"   => getenv("DB_USER") ?: "root",
        "parol"  => getenv("DB_PASSWORD") ?: "",
    ],
    "pochta" => [
        "kalit" => getenv("MAIL_KEY") ?: "",
    ],
];

// Har bir javobga qo'yiladigan sarlavhalar
$sarlavhalar = [
    "Content-Security-Policy" => [
        "default-src 'self'",
        "Begona manbadan skript yuklanmasin - XSS ta'sirini keskin kamaytiradi",
    ],
    "X-Content-Type-Options" => [
        "nosniff",
        "Brauzer fayl turini o'zi taxmin qilmasin",
    ],
    "X-Frame-Options" => [
        "DENY",
        "Sahifa begona iframe ichiga joylanmasin (clickjacking)",
    ],
    "Referrer-Policy" => [
        "strict-origin-when-cross-origin",
        "Begona saytga to'liq URL yuborilmasin",
    ],
    "Strict-Transport-Security" => [
        "max-age=31536000; includeSubDomains",
        "Brauzer faqat HTTPS orqali ulansin",
    ],
];

foreach ($sarlavhalar as $nom => [$qiymat, $izoh]) {
    echo "{$nom}:\n";
    echo "  qiymat: {$qiymat}\n";
    echo "  nima uchun: {$izoh}\n\n";
}

echo "PHP da qo'yish:\n";
echo "  header(\"X-Frame-Options: DENY\");\n";
echo "  (yoki veb-server sozlamasida - bu afzalroq)\n";

<?php
declare(strict_types=1);

function kirishgaUrinish(PDO $pdo, string $email, string $parol): ?array
{
    // 1. Foydalanuvchini topamiz
    $stmt = $pdo->prepare("SELECT id, email, parol_xesh, rol FROM foydalanuvchilar WHERE email = ?");
    $stmt->execute([$email]);
    $f = $stmt->fetch();

    // 2. MUHIM: foydalanuvchi topilmasa ham xeshni tekshiramiz
    //    Aks holda javob vaqti email mavjudligini oshkor qiladi
    $xesh = $f["parol_xesh"] ?? '$2y$12$aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';

    if (!password_verify($parol, $xesh) || $f === false) {
        return null;        // bir xil xabar: "email yoki parol noto'g'ri"
    }

    // 3. Xesh eskirgan bo'lsa - yangilaymiz
    if (password_needs_rehash($f["parol_xesh"], PASSWORD_DEFAULT)) {
        $yangi = password_hash($parol, PASSWORD_DEFAULT);
        $pdo->prepare("UPDATE foydalanuvchilar SET parol_xesh = ? WHERE id = ?")
            ->execute([$yangi, $f["id"]]);
    }

    // 4. Sessiya identifikatorini YANGILAYMIZ (10-bo'lim)
    session_regenerate_id(true);
    $_SESSION["user_id"] = (int) $f["id"];
    $_SESSION["kirgan_vaqt"] = time();

    unset($f["parol_xesh"]);
    return $f;
}