ایمنی در برنامه نویسی وب و موبایل

// کد خطرناک - PHP
$username = $_POST['username'];
$password = $_POST['password'];
$sql = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($connection, $sql);

// کد امن - PHP
$username = $_POST['username'];
$password = $_POST['password'];
$stmt = $connection->prepare("SELECT * FROM users WHERE username=? AND password=?");
$stmt->bind_param("ss", $username, $password);
$stmt->execute();
$result = $stmt->get_result();

// Laravel - Escape کردن خروجی


// JavaScript - Sanitize کردن
function sanitizeInput(input) {
    return input
        .replace(/&/g, '&')
        .replace(//g, '>')
        .replace(/"/g, '"')
        .replace(/'/g, ''');
}

// Laravel - CSRF Token
<form method="POST" action="/submit">
        <input type="text" name="data">
    <button type="submit">ارسال</button>
</form>

// JavaScript - اضافه کردن CSRF Token
const token = document.querySelector('meta[name="csrf-token"]').getAttribute('content');
fetch('/api/data', {
    method: 'POST',
    headers: {
        'X-CSRF-TOKEN': token,
        'Content-Type': 'application/json'
    },
    body: JSON.stringify(data)
});

// Android - استفاده از Keystore
public class SecureStorage {
    private static final String KEY_ALIAS = "MyKeyAlias";

    public void storeSecret(String secret) {
        try {
            KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");
            keyStore.load(null);

            KeyGenerator keyGenerator = KeyGenerator.getInstance(
                KeyProperties.KEY_ALGORITHM_AES, "AndroidKeyStore");
            KeyGenParameterSpec keyGenParameterSpec = new KeyGenParameterSpec.Builder(
                KEY_ALIAS,
                KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT)
                .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
                .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
                .build();

            keyGenerator.init(keyGenParameterSpec);
            keyGenerator.generateKey();
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

// Android - Certificate Pinning
public class CertificatePinning {
    public static void setupPinning() {
        String hostname = "api.example.com";
        CertificatePinner certificatePinner = new CertificatePinner.Builder()
            .add(hostname, "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
            .build();

        OkHttpClient client = new OkHttpClient.Builder()
            .certificatePinner(certificatePinner)
            .build();
    }
}

// Android - Biometric Authentication
public class BiometricAuth {
    private BiometricPrompt biometricPrompt;

    public void setupBiometric() {
        Executor executor = ContextCompat.getMainExecutor(context);
        biometricPrompt = new BiometricPrompt(activity, executor,
            new BiometricPrompt.AuthenticationCallback() {
                @Override
                public void onAuthenticationSucceeded(
                    @NonNull BiometricPrompt.AuthenticationResult result) {
                    // احراز هویت موفق
                }

                @Override
                public void onAuthenticationError(int errorCode,
                    @NonNull CharSequence errString) {
                    // خطا در احراز هویت
                }
            });
    }
}

// PHP - Password Hashing
$password = 'user_password';
$hashedPassword = password_hash($password, PASSWORD_ARGON2ID);

// بررسی پسورد
if (password_verify($password, $hashedPassword)) {
    // پسورد صحیح است
}

// Laravel - استفاده از Hash facade
$hashedPassword = Hash::make($password);
$isValid = Hash::check($password, $hashedPassword);

// Laravel - Encryption
use Illuminate\Support\Facades\Crypt;

// رمزنگاری
$encrypted = Crypt::encryptString('sensitive_data');

// رمزگشایی
$decrypted = Crypt::decryptString($encrypted);

// Android - AES Encryption
public class AESUtil {
    private static final String ALGORITHM = "AES";
    private static final String TRANSFORMATION = "AES/GCM/NoPadding";

    public static String encrypt(String data, String key) throws Exception {
        Cipher cipher = Cipher.getInstance(TRANSFORMATION);
        SecretKeySpec keySpec = new SecretKeySpec(key.getBytes(), ALGORITHM);
        cipher.init(Cipher.ENCRYPT_MODE, keySpec);

        byte[] encryptedData = cipher.doFinal(data.getBytes());
        return Base64.encodeToString(encryptedData, Base64.DEFAULT);
    }
}

// Nginx Configuration
server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate /path/to/certificate.crt;
    ssl_certificate_key /path/to/private.key;

    # SSL Security Headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
}

// Laravel - Security Headers
public function handle($request, Closure $next)
{
    $response = $next($request);

    $response->headers->set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
    $response->headers->set('X-Frame-Options', 'DENY');
    $response->headers->set('X-Content-Type-Options', 'nosniff');
    $response->headers->set('X-XSS-Protection', '1; mode=block');

    return $response;
}

// Laravel - JWT Implementation
use Firebase\JWT\JWT;
use Firebase\JWT\Key;

class AuthController extends Controller
{
    public function login(Request $request)
    {
        $credentials = $request->only('email', 'password');

        if (Auth::attempt($credentials)) {
            $user = Auth::user();
            $payload = [
                'user_id' => $user->id,
                'email' => $user->email,
                'exp' => time() + (60 * 60 * 24) // 24 ساعت
            ];

            $token = JWT::encode($payload, config('jwt.secret'), 'HS256');

            return response()->json(['token' => $token]);
        }

        return response()->json(['error' => 'Unauthorized'], 401);
    }
}

// Laravel Socialite
use Laravel\Socialite\Facades\Socialite;

class AuthController extends Controller
{
    public function redirectToGoogle()
    {
        return Socialite::driver('google')->redirect();
    }

    public function handleGoogleCallback()
    {
        $user = Socialite::driver('google')->user();

        // ایجاد یا به‌روزرسانی کاربر
        $localUser = User::updateOrCreate([
            'google_id' => $user->id,
        ], [
            'name' => $user->name,
            'email' => $user->email,
        ]);

        Auth::login($localUser);
        return redirect('/dashboard');
    }
}

// Laravel - Security Logging
use Illuminate\Support\Facades\Log;

class SecurityLogger
{
    public static function logFailedLogin($email, $ip)
    {
        Log::warning('Failed login attempt', [
            'email' => $email,
            'ip' => $ip,
            'timestamp' => now(),
            'user_agent' => request()->userAgent()
        ]);
    }

    public static function logSuspiciousActivity($activity, $details)
    {
        Log::critical('Suspicious activity detected', [
            'activity' => $activity,
            'details' => $details,
            'ip' => request()->ip(),
            'timestamp' => now()
        ]);
    }
}

// Laravel - Rate Limiting
Route::middleware(['throttle:5,1'])->group(function () {
    Route::post('/login', [AuthController::class, 'login']);
    Route::post('/register', [AuthController::class, 'register']);
});

// Custom Rate Limiting
RateLimiter::for('api', function (Request $request) {
    return Limit::perMinute(60)->by($request->ip());
});