SecurePay_E-Wallet-V1

SecurePay E-Wallet and Cybersecurity Demo Lab

SecurePay is a local-first PHP/MySQL application that combines a working wallet system with a built-in security lab so developers can learn secure coding and attack simulation side by side.

What This Project Is

SecurePay was built as both a practical wallet app and a learning platform for web security. You can register users, authenticate sessions, transfer funds, withdraw money, and manage accounts through an admin panel. In parallel, the cyber lab section demonstrates vulnerable vs secure behavior for common attack vectors such as XSS and session theft patterns. The codebase is intentionally framework-free so students can see raw PHP security patterns clearly.

This project is useful for:

• Students learning secure backend/web fundamentals
• Instructors preparing security demos
• Developers practicing defense-in-depth in small PHP systems

Features

• User registration, login, lockout, and logout flows
• Session hardening with inactivity timeout and session ID regeneration
• CSRF protection on sensitive POST flows
• Role-aware access control (require_login, require_admin, require_non_admin)
• Atomic wallet operations for transfer and withdraw using SQL transactions and row locks
• Transaction history with type/date filtering
• Admin user operations: reset password, block/unblock, delete
• Cyber lab mode toggle (vulnerable vs secure demonstrations)
• CI pipeline with lint -> test -> build checks

Demo and Screenshots

Screenshots coming soon.

If you want to add your own captures, recommended pages are:

• Landing page
• User dashboard
• Send money flow
• Admin dashboard
• Cyber lab vulnerable/secure comparison

Quick Start

Prerequisites

• PHP 8.2+ (XAMPP PHP works)
• MySQL 8.0+ (or MariaDB compatible with schema)
• Apache (XAMPP Apache is fine)
• Optional: Node.js 16+ for the lab receiver demo

Installation (XAMPP on Windows)

1. Place the project in your web root:

Copy-Item -Recurse . "C:\xampp\htdocs\SecurePay_E-Wallet-V1"
Set-Location "C:\xampp\htdocs\SecurePay_E-Wallet-V1"

2. Create environment config:

Copy-Item .env.example .env

3. Initialize the database:

Get-Content .\setup.sql | & "C:\xampp\mysql\bin\mysql.exe" -u root
Get-Content .\add_withdraw_transaction_type.sql | & "C:\xampp\mysql\bin\mysql.exe" -u root securepay_db

4. Start Apache and MySQL from XAMPP Control Panel.

5. Open the app:

http://localhost/SecurePay_E-Wallet-V1/

Expected result: you should see the SecurePay landing page with links for User Login, Admin Login, and Cybersecurity Attack Demo Lab.

Optional Docker Run

docker compose up --build

Then visit:

http://localhost:8080/

Usage Examples

Example 1: Create a password hash for a new user

& "C:\xampp\php\php.exe" -r "echo password_hash('DemoPass123!', PASSWORD_DEFAULT), PHP_EOL;"

What this does: generates a bcrypt-compatible hash you can insert into users.password.

Example 2: Promote an existing user to admin

& "C:\xampp\mysql\bin\mysql.exe" -u root securepay_db -e "UPDATE users SET is_admin = 1 WHERE email = '[email protected]';"

What this does: allows that user to access admin/login.php and admin-only routes.

Example 3: Inspect latest transactions quickly

& "C:\xampp\mysql\bin\mysql.exe" -u root securepay_db -e "SELECT id, sender_id, receiver_id, amount, transaction_type, created_at FROM transactions ORDER BY id DESC LIMIT 10;"

What this does: verifies whether transfer/add_fund/withdraw flows are writing expected records.

Project Structure

SecurePay_E-Wallet-V1/
|- index.php                         # Landing page and role-aware redirect
|- add_funds.php                     # Admin-only wallet top-up
|- send_money.php                    # Transfer endpoint with transaction safety
|- withdraw.php                      # Non-admin withdrawal endpoint
|- history.php                       # Transaction history and filters
|- setup.sql                         # Full schema bootstrap
|- add_withdraw_transaction_type.sql # Migration for withdraw enum support
|- .env.example                      # Environment variable template
|- Dockerfile                        # Container image definition
|- docker-compose.yml                # App + MySQL local orchestration
|- tools/
|  |- lint.php                       # PHP syntax lint over project files
|  |- build.php                      # Build-time sanity checks
|- test/
|  |- suite.php                      # Shared test definitions
|  |- run.php                        # Smoke/unit-style test runner
|  |- coverage.php                   # Optional Xdebug coverage report
|- includes/
|  |- db_connect.php                 # Env-based DB bootstrap
|  |- functions.php                  # Shared auth/security/format helpers
|- auth/                             # User auth routes
|- admin/                            # Admin auth + management routes
|- dashboard/                        # User dashboard route
|- cyberlab/                         # Security demonstration modules
|- .github/workflows/ci.yml          # CI automation (lint -> test -> build)

Running Tests

Run the full quality gate locally:

& "C:\xampp\php\php.exe" tools/lint.php
& "C:\xampp\php\php.exe" test/run.php
& "C:\xampp\php\php.exe" tools/build.php

Coverage command (requires Xdebug):

& "C:\xampp\php\php.exe" -d xdebug.mode=coverage test/coverage.php

If Xdebug is not installed, coverage command exits with a clear message.

Contributing

Contributions are welcome.

Please read CONTRIBUTING.md before opening a pull request. At minimum, run lint/test/build checks and avoid committing secrets.

Roadmap

• Add integration tests against a disposable MySQL test database
• Replace ad-hoc testing with PHPUnit and formal coverage thresholds
• Add audit logging for critical admin actions
• Expand cyber lab modules with SQLi and CSRF simulation tracks
• Add localization and accessibility-focused UI improvements

License

This project is licensed under the MIT License. See LICENSE.

Acknowledgments

• OWASP Top 10 guidance for secure web design principles
• XAMPP and MySQL communities for local development tooling
• Open source maintainers whose security writeups informed this educational lab