php · level 3 check

a secure user registry.

Time to ship a real tool: the user registry for a small club's website. People register with an email, a password and a role, then log in. It stores everything in SQLite, refuses bad input with clear messages, and stands up to every attack you met in the security unit.

Your toolkit: a family of exceptions, a backed `Role` enum, a class that receives its `PDO` through the constructor, prepared statements, `password_hash` and `password_verify`, and an `e()` helper that escapes everything shown. `attempt` runs each action as a closure and reports what happened.

Fill in every `____`, run it, and read each line. Then try your own edge cases: an empty password, spaces round an email, a sneaky `<script>` tag.

Your program

<?php
class RegistryException extends Exception {}
class InvalidInput extends ____ {}
class AlreadyRegistered extends RegistryException {}

enum Role: string {
    case Member = "member";
    case Admin = "____";
}

class UserRegistry {
    public function __construct(____ PDO $db) {
        $this->db->exec("CREATE TABLE users (email TEXT PRIMARY KEY, hash TEXT NOT NULL, role TEXT NOT NULL)");
    }

public function register(string $email, string $password, Role $role): void {
        $email = strtolower(trim($email));
        if (filter_var($email, ____) === false) {
            throw new InvalidInput("That email address does not look right.");
        }
        if (strlen($password) < 10) {
            throw new InvalidInput("Passwords need at least 10 characters.");
        }
        $find = $this->db->prepare("SELECT COUNT(*) FROM users WHERE email = ____");
        $find->execute([$email]);
        if ($find->fetchColumn() > 0) {
            throw new AlreadyRegistered("$email is already registered.");
        }
        $add = $this->db->prepare("INSERT INTO users (email, hash, role) VALUES (?, ?, ?)");
        $add->execute([$email, password_hash($password, ____), $role->value]);
    }

public function login(string $email, string $password): ?Role {
        $find = $this->db->prepare("SELECT hash, role FROM users WHERE email = ?");
        $find->execute([strtolower(trim($email))]);
        $user = $find->fetch(PDO::FETCH_ASSOC);
        if ($user === false || !____($password, $user["hash"])) {
            return null;
        }
        return Role::____($user["role"]);
    }
}

function e(string $text): string {
    return htmlspecialchars($text, ____);
}

function showLogin(UserRegistry $registry, string $email, string $password): void {
    $role = $registry->login($email, $password);
    $result = $role === null ? "refused" : "welcome, $role->value";
    echo "Login " . e($email) . ": $result\n";
}

$registry = new UserRegistry(new PDO("sqlite::memory:"));
attempt("Register Mia", fn() => $registry->register(" Mia@Example.com ", "correct horse battery", Role::Admin));
attempt("Register Siobhan", fn() => $registry->register("siobhan.o'neil@example.com", "tea and toast please", Role::Member));
attempt("Register Sam", fn() => $registry->register("sam-at-example", "a long password", Role::Member));
attempt("Register Leo", fn() => $registry->register("leo@example.com", "abc123", Role::Member));
attempt("Register Siobhan again", fn() => $registry->register("SIOBHAN.O'NEIL@example.com", "different password", Role::Member));
showLogin($registry, "MIA@Example.com", "correct horse battery");
showLogin($registry, "siobhan.o'neil@example.com", "tea and toast please");
showLogin($registry, "siobhan.o'neil@example.com", "wrong password");
showLogin($registry, "mia@example.com", "' OR '1'='1");

Fill in every ____ then run the checks.

1 Good sign-ups go throughuses: classes and databases
2 Bad input gets a clear messageuses: guard clauses
3 One account per email, whatever the capitalsuses: custom exceptions and escaping
4 The right password logs in with the right roleuses: password hashing and enums
5 A wrong password is refuseduses: password_verify
6 An injection payload gets nowhereuses: prepared statements

Take as long as you like and try as many times as you want.

a secure user registry.

level up.

playground