<?php
// ============================================
// SECURITY CONFIGURATION
// ============================================

// Enforce HTTPS
if (empty($_SERVER['HTTPS']) || $_SERVER['HTTPS'] === 'off') {
    // Only redirect in production
    if ($_SERVER['SERVER_NAME'] !== 'localhost' && $_SERVER['SERVER_NAME'] !== '127.0.0.1') {
        header('Location: https://' . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI']);
        exit();
    }
}

// Security Headers
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: DENY');
header('X-XSS-Protection: 1; mode=block');
header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
header('Content-Security-Policy: default-src \'self\'; script-src \'self\' \'unsafe-inline\'; style-src \'self\' \'unsafe-inline\'; img-src \'self\' data: https:; font-src \'self\' data:; connect-src \'self\';');
header('Referrer-Policy: strict-origin-when-cross-origin');

// Set secure session parameters
ini_set('session.cookie_httponly', 1);
ini_set('session.cookie_secure', 1);
ini_set('session.cookie_samesite', 'Strict');
ini_set('session.use_strict_mode', 1);

// Disable error display in production
if ($_SERVER['SERVER_NAME'] !== 'localhost') {
    ini_set('display_errors', 0);
    error_reporting(E_ALL);
    ini_set('log_errors', 1);
    ini_set('error_log', '/var/log/php_errors.log');
}

// Database Configuration
define("WEB_TITLE", "Bank Mega"); // Change Bank Name
define("WEB_URL", "https://bnkmga.online"); // Change No "/" Ending slash - USE HTTPS ONLY
define("WEB_EMAIL", "support@bnkmga.online"); // Change Your Website Email

// Database credentials - USE ENVIRONMENT VARIABLES IN PRODUCTION
// Never hardcode credentials in source code
define("DB_HOST", getenv('DB_HOST') ?: 'localhost');
define("DB_USER", getenv('DB_USER') ?: 'faceswex_bnkmga');
define("DB_PASS", getenv('DB_PASS') ?: 'faceswex_bnkmga');
define("DB_NAME", getenv('DB_NAME') ?: 'faceswex_bnkmga');

$web_url = WEB_URL;

require_once(__DIR__ . '/SecurityUtils.php');

/**
 * Database Connection with PDO
 * Uses prepared statements to prevent SQL injection
 */
function dbConnect(){
    $servername = DB_HOST;
    $username = DB_USER;
    $password = DB_PASS;
    $database = DB_NAME;
    
    // Use error mode exceptions
    $dns = "mysql:host=$servername;dbname=$database;charset=utf8mb4";

    try {
        $conn = new PDO($dns, $username, $password);
        // set the PDO error mode to exception
        $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
        // Enable prepared statement emulation to false for better security
        $conn->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
        return $conn;
    } catch(PDOException $e) {
        // Log error but don't expose details to user
        error_log("Database Connection Error: " . $e->getMessage());
        die("Database connection failed. Please try again later.");
    }
}

/**
 * Input Validation - DEPRECATED
 * Use SecurityUtils::validateInput() instead
 */
function inputValidation($value): string
{
    if (is_null($value)) {
        return '';
    }
    return trim(htmlspecialchars(htmlentities($value), ENT_QUOTES, 'UTF-8'));
}

/**
 * Sanitize for safe output
 */
function sanitize($value) {
    return htmlspecialchars($value, ENT_QUOTES, 'UTF-8');
}