First Commit

app/Services/BaseController.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Services;
+
+class BaseController
+{
+    public function __construct()
+    {
+        // Adding security headers
+        header("Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted.cdn.com; style-src 'self' https://trusted.cdn.com; img-src 'self' data:;");
+        header("X-Frame-Options: DENY");
+        header("X-Content-Type-Options: nosniff");
+        header("Referrer-Policy: no-referrer");
+        header("Strict-Transport-Security: max-age=31536000; includeSubDomains; preload");
+    }
+}
+
+?>

app/Services/Sanitizer.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Services;
+
+class Sanitizer
+{
+    public static function sanitizeInput(array $data): array
+    {
+        $sanitizedData = [];
+        foreach ($data as $key => $value) {
+            $sanitizedData[$key] = static::sanitizeValue($value);
+        }
+        return $sanitizedData;
+    }
+
+    public static function sanitizeOutput($data)
+    {
+        if (is_array($data)) {
+            return array_map([static::class, 'sanitizeOutput'], $data);
+        }
+
+        return $data !== null ? htmlspecialchars($data, ENT_QUOTES, 'UTF-8') : '';
+    }
+
+    private static function sanitizeValue($value)
+    {
+        if (is_array($value)) {
+            return static::sanitizeInput($value);
+        } elseif (is_null($value)) {
+            return ''; // Ensures null does not pass through
+        } elseif (filter_var($value, FILTER_VALIDATE_EMAIL)) {
+            return filter_var($value, FILTER_SANITIZE_EMAIL);
+        } elseif (filter_var($value, FILTER_VALIDATE_URL)) {
+            return filter_var($value, FILTER_SANITIZE_URL);
+        } else {
+            return filter_var($value, FILTER_SANITIZE_FULL_SPECIAL_CHARS);
+        }
+    }
+}