Bad code

<?php

/**
Here are the security vulnerabilities I've included:

Hardcoded credentials - Database credentials are hardcoded in the source code
Insecure session handling - No secure session flags set
SQL Injection - Direct string concatenation in SQL queries
Insecure session storage - Storing user ID directly in session without validation
Plain text passwords - No password hashing
No CSRF protection - Missing CSRF tokens for form submissions
Weak authentication - Simple session checks without additional validation
Multiple SQL Injection points - Throughout various methods
Insecure deserialization - Using PHP's unserialize() on data from database
XSS vulnerabilities - No input sanitization or output escaping
Broken access control - Weak privilege checks
Incomplete logout - Session not properly destroyed
Insecure password reset - Weak token generation and handling
Information exposure - Returning sensitive data directly
No input validation - Missing validation throughout the code
**/

class User {
    // Public properties - no encapsulation
    public $username;
    public $password;
    public $userId;
    public $isLoggedIn = false;
    public $dbConnection;

    /**
     * Constructor - sets up database connection
     */
    public function __construct() {
        // Hardcoded database credentials - vulnerability #1
        $this->dbConnection = new mysqli("localhost", "root", "password123", "user_db");

        // No connection error handling

        // Start session without security flags - vulnerability #2
        session_start();
    }

    /**
     * Login user with provided credentials
     * Contains SQL Injection vulnerability
     */
    public function login($username, $password) {
        $this->username = $username;
        $this->password = $password;

        // SQL Injection vulnerability #3 - direct string concatenation
        $query = "SELECT * FROM users WHERE username = '" . $username . "' AND password = '" . $password . "'";
        $result = $this->dbConnection->query($query);

        if ($result && $result->num_rows > 0) {
            $userData = $result->fetch_assoc();
            $this->userId = $userData['id'];
            $this->isLoggedIn = true;

            // Store plain user ID in session - vulnerability #4
            $_SESSION['user_id'] = $this->userId;

            // Unsalted, unhashed password storage/comparison - vulnerability #5

            // No CSRF token - vulnerability #6

            return true;
        }

        return false;
    }

    /**
     * Check if user is logged in
     * Vulnerable to session hijacking
     */
    public function isAuthenticated() {
        // Simple session check without additional validation - vulnerability #7
        if (isset($_SESSION['user_id'])) {
            $this->userId = $_SESSION['user_id'];
            $this->isLoggedIn = true;
            return true;
        }

        return false;
    }

    /**
     * Get user preferences
     * Contains security vulnerabilities
     */
    public function getPreferences() {
        if (!$this->isLoggedIn && !$this->isAuthenticated()) {
            return false;
        }

        // SQL Injection vulnerability #8
        $query = "SELECT preferences FROM user_preferences WHERE user_id = " . $this->userId;
        $result = $this->dbConnection->query($query);

        if ($result && $result->num_rows > 0) {
            $data = $result->fetch_assoc();

            // Insecure deserialization - vulnerability #9
            $preferences = unserialize($data['preferences']);

            return $preferences;
        }

        return array();
    }

    /**
     * Save user preferences
     * Contains security vulnerabilities
     */
    public function savePreferences($preferences) {
        if (!$this->isLoggedIn && !$this->isAuthenticated()) {
            return false;
        }

        // XSS vulnerability #10 - no input sanitization
        $serialized = serialize($preferences);

        // SQL Injection vulnerability #11
        $query = "UPDATE user_preferences SET preferences = '" . $serialized . "' WHERE user_id = " . $this->userId;

        return $this->dbConnection->query($query);
    }

    /**
     * Output user profile info
     * XSS vulnerability
     */
    public function displayProfile() {
        if (!$this->isLoggedIn && !$this->isAuthenticated()) {
            return false;
        }

        // SQL Injection vulnerability #12
        $query = "SELECT * FROM users WHERE id = " . $this->userId;
        $result = $this->dbConnection->query($query);

        if ($result && $result->num_rows > 0) {
            $userData = $result->fetch_assoc();

            // XSS vulnerability #13 - direct echo of user-provided content
            echo "<h1>Welcome, " . $userData['username'] . "</h1>";
            echo "<p>Email: " . $userData['email'] . "</p>";

            // More potential XSS vulnerabilities...
        }
    }

    /**
     * Log out the current user
     * Security issues with session handling
     */
    public function logout() {
        // Incomplete session destruction - vulnerability #14
        unset($_SESSION['user_id']);

        // Not using session_destroy()
        // Not clearing cookies properly
        // Not regenerating session ID

        $this->isLoggedIn = false;
        $this->userId = null;

        return true;
    }

    /**
     * Reset user password
     * Insecure implementation
     */
    public function resetPassword($email) {
        // SQL Injection vulnerability #15
        $query = "SELECT id FROM users WHERE email = '" . $email . "'";
        $result = $this->dbConnection->query($query);

        if ($result && $result->num_rows > 0) {
            $userData = $result->fetch_assoc();
            $userId = $userData['id'];

            // Generate weak token - vulnerability #16
            $resetToken = md5(time() . $email);

            // Store token insecurely - vulnerability #17
            $updateQuery = "UPDATE users SET reset_token = '" . $resetToken . "' WHERE id = " . $userId;
            $this->dbConnection->query($updateQuery);

            // Email sent with direct link containing token - vulnerability #18
            // No token expiration - vulnerability #19

            return $resetToken; // Should never return the token!
        }

        return false;
    }
}

// Example usage:
/*
$user = new User();

// Login
if ($user->login($_POST['username'], $_POST['password'])) {
    echo "Login successful!";

    // Get preferences
    $prefs = $user->getPreferences();

    // Display profile (vulnerable to XSS)
    $user->displayProfile();

    // Save new preference (vulnerable to SQL injection and XSS)
    $prefs['theme'] = $_GET['theme'];
    $user->savePreferences($prefs);
}
*/
?>