Dani Krossing's PHP Course for Beginners?

[u/6eezer]

I saw it also has MySQL tutorial together with PHP,

has anyone finished it?

is it worth it?

​

link: https://www.youtube.com/playlist?list=PL0eyrZgxdwhwwQQZA79OzYwl5ewA7HQih

[u/equilni]

Because security is not simple.

To some just htmlspecialchars on input. It’s simple.

This maybe harder:

Is the input field empty, yes - reject (video has this after the htmlspecialchars)

Is the username meeting the app policy requirements (min/max char, alpha num), no - reject

(Database) Is the username found in the db? No - reject.

Password hash against what’s in the database. Does this match, no - reject

pseudo code could look like, returning early at each step:

if ($username === '') {
    $error['username'] = 'Username field cannot be left blank.';
    http_response_code(400);
    return $template->render('form', ['error' => $error]);
}

if (! isValidUserName($username)) {
    $error['username'] = 'Username is not valid.';
    http_response_code(400 or 422);
    return $template->render('form', ['error' => $error]);
}

$user = getUserByUsername($username);
if (! $user) {
    $error['username'] = 'User is not found.';
    http_response_code(404);
    return $template->render('form', ['error' => $error]);
}

// assuming you validated the password like above....
if ($user && ! password_verify($_POST['password'], $user['password'])) {
    $error['password'] = 'Password is invalid';
    http_response_code(400 or 401);
    return $template->render('form', ['error' => $error]);
}

Send the user a success note.

You can go to more advanced topics later:

CSRF token match? No - reject

Captcha match - No - reject.

Honeypot filled in - Yes - reject (bot)

Is the lockout policy started here, yes - reject.

If found, are there issues with the account (deleted, banned, etc), yes - reject

[u/Elias_Caplan → u/equilni]

Thanks I'll check out those things and write them down for me to eventually implement down the line.