DataBase.php

<?php
require "DataBaseConfig.php";

class DataBase
{
    public $connect;
    public $data;
    private $sql;
    protected $servername;
    protected $username;
    protected $password;
    protected $databasename;

    // Whitelist of allowed table names to prevent table-name injection
    private $allowed_tables = ['users'];

    public function __construct()
    {
        $this->connect = null;
        $this->data = null;
        $this->sql = null;
        $dbc = new DataBaseConfig();
        $this->servername = $dbc->servername;
        $this->username = $dbc->username;
        $this->password = $dbc->password;
        $this->databasename = $dbc->databasename;
    }

    /**
     * Establish DB connection, return mysqli object or false
     */
    function dbConnect()
    {
        $this->connect = mysqli_connect($this->servername, $this->username, $this->password, $this->databasename);
        if (!$this->connect) {
            return false;
        }
        // set charset to avoid charset-related injection issues
        mysqli_set_charset($this->connect, 'utf8mb4');
        return $this->connect;
    }

    /**
     * Basic cleaning for display / storage. Prepared statements handle SQL safety.
     */
    function prepareData($data)
    {
        $data = trim($data);
        // remove control characters but DO NOT rely on this for SQL safety
        $data = filter_var($data, FILTER_UNSAFE_RAW, FILTER_FLAG_STRIP_LOW);
        return $data;
    }

    /**
     * Validate / whitelist table name.
     */
    private function validateTable($table)
    {
        return in_array($table, $this->allowed_tables, true);
    }

    /**
     * Login using prepared statements
     */
    function logIn($table, $username, $password)
    {
        // validate table name
        if (!$this->validateTable($table)) {
            return false;
        }

        // clean inputs (not for SQL safety — prepared statements handle that)
        $username = $this->prepareData($username);
        $password = $this->prepareData($password);

        // prepared statement: select hashed password for username
        $this->sql = "SELECT username, password FROM " . $table . " WHERE username = ? LIMIT 1";
        if (!$stmt = mysqli_prepare($this->connect, $this->sql)) {
            return false;
        }
        mysqli_stmt_bind_param($stmt, "s", $username);
        mysqli_stmt_execute($stmt);
        $result = mysqli_stmt_get_result($stmt);
        if (!$result) {
            mysqli_stmt_close($stmt);
            return false;
        }

        if ($row = mysqli_fetch_assoc($result)) {
            $dbusername = $row['username'];
            $dbpassword = $row['password']; // hashed password in DB
            mysqli_stmt_close($stmt);
            if (password_verify($password, $dbpassword)) {
                return true;
            } else {
                return false;
            }
        } else {
            mysqli_stmt_close($stmt);
            return false;
        }
    }

    /**
     * Sign up using prepared statements
     */
    function signUp($table, $fullname, $email, $username, $password)
    {
        // validate table name
        if (!$this->validateTable($table)) {
            return false;
        }

        // simple cleaning
        $fullname = $this->prepareData($fullname);
        $username = $this->prepareData($username);
        $email = $this->prepareData($email);
        $password = $this->prepareData($password);

        // validate email
        if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
            return false;
        }

        // hash password
        $passwordHash = password_hash($password, PASSWORD_DEFAULT);

        // prepared insert
        $this->sql = "INSERT INTO " . $table . " (fullname, username, password, email) VALUES (?, ?, ?, ?)";
        if (!$stmt = mysqli_prepare($this->connect, $this->sql)) {
            return false;
        }
        mysqli_stmt_bind_param($stmt, "ssss", $fullname, $username, $passwordHash, $email);
        $exec = mysqli_stmt_execute($stmt);
        mysqli_stmt_close($stmt);
        return $exec ? true : false;
    }

}
?>