<?
php
// config.php - Database configuration and global settings
define('DB_SERVER', 'localhost');
define('DB_USERNAME', 'vault_user');
define('DB_PASSWORD', 'your_secure_password');
define('DB_NAME', 'password_vault');
define('ENCRYPTION_KEY_ITERATIONS', 10000); // PBKDF2 iterations
define('SESSION_TIMEOUT', 900); // 15 minutes in seconds
define('MAX_LOGIN_ATTEMPTS', 5);
define('LOCKOUT_TIME', 1800); // 30 minutes in seconds
// Establish database connection
function connectDB() {
$conn = new mysqli(DB_SERVER, DB_USERNAME, DB_PASSWORD, DB_NAME);
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
return $conn;
}
// Secure session configuration
ini_set('session.cookie_httponly', 1);
ini_set('session.use_only_cookies', 1);
ini_set('session.cookie_secure', 1); // Only works on HTTPS
ini_set('session.cookie_samesite', 'Strict');
session_start();
// Function to check if user is logged in
function isLoggedIn() {
if (isset($_SESSION['user_id']) && !empty($_SESSION['user_id'])) {
// Check if session has expired
if (isset($_SESSION['last_activity']) && (time() -
$_SESSION['last_activity'] > SESSION_TIMEOUT)) {
session_unset();
session_destroy();
return false;
}
// Update last activity time
$_SESSION['last_activity'] = time();
return true;
}
return false;
}
// Generate CSRF token
function generateCSRFToken() {
if (!isset($_SESSION['csrf_token'])) {
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
return $_SESSION['csrf_token'];
}
// Verify CSRF token
function verifyCSRFToken($token) {
if (!isset($_SESSION['csrf_token']) || $token !== $_SESSION['csrf_token']) {
return false;
}
return true;
}
// Security utility functions
function secureHash($password) {
return password_hash($password, PASSWORD_ARGON2ID, ['memory_cost' => 2048,
'time_cost' => 4, 'threads' => 3]);
}
function verifyPassword($password, $hash) {
return password_verify($password, $hash);
}
// Derive encryption key from master password and user salt
function deriveEncryptionKey($masterPassword, $userSalt) {
return hash_pbkdf2('sha256', $masterPassword, $userSalt,
ENCRYPTION_KEY_ITERATIONS, 32, true);
}
// Encrypt data
function encryptData($data, $encryptionKey) {
$iv = random_bytes(16); // AES block size
$encrypted = openssl_encrypt($data, 'AES-256-CBC', $encryptionKey,
OPENSSL_RAW_DATA, $iv);
if ($encrypted === false) {
throw new Exception('Encryption failed');
}
// Combine IV and encrypted data for storage
return base64_encode($iv . $encrypted);
}
// Decrypt data
function decryptData($encryptedData, $encryptionKey) {
$data = base64_decode($encryptedData);
// Extract IV (first 16 bytes)
$iv = substr($data, 0, 16);
$encrypted = substr($data, 16);
$decrypted = openssl_decrypt($encrypted, 'AES-256-CBC', $encryptionKey,
OPENSSL_RAW_DATA, $iv);
if ($decrypted === false) {
throw new Exception('Decryption failed');
}
return $decrypted;
}
// Generate secure random password
function generateSecurePassword($length = 16, $useSpecial = true, $useNumbers =
true, $useUppercase = true) {
$lowercase = 'abcdefghijklmnopqrstuvwxyz';
$uppercase = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
$numbers = '0123456789';
$special = '!@#$%^&*()-_=+[]{}|;:,.<>?';
$chars = $lowercase;
if ($useUppercase) $chars .= $uppercase;
if ($useNumbers) $chars .= $numbers;
if ($useSpecial) $chars .= $special;
$password = '';
$charsLength = strlen($chars);
for ($i = 0; $i < $length; $i++) {
$password .= $chars[random_int(0, $charsLength - 1)];
}
return $password;
}
// Check password strength
function checkPasswordStrength($password) {
$score = 0;
// Length check
if (strlen($password) >= 12) {
$score += 2;
} elseif (strlen($password) >= 8) {
$score += 1;
}
// Complexity checks
if (preg_match('/[0-9]/', $password)) $score += 1; // Has number
if (preg_match('/[a-z]/', $password)) $score += 1; // Has lowercase
if (preg_match('/[A-Z]/', $password)) $score += 1; // Has uppercase
if (preg_match('/[^a-zA-Z0-9]/', $password)) $score += 1; // Has special char
// Define strength levels
if ($score < 2) return 'Very Weak';
if ($score < 3) return 'Weak';
if ($score < 4) return 'Medium';
if ($score < 5) return 'Strong';
return 'Very Strong';
}
// Function to sanitize input
function sanitizeInput($data) {
$data = trim($data);
$data = stripslashes($data);
$data = htmlspecialchars($data, ENT_QUOTES, 'UTF-8');
return $data;
}
?>
