Cursor rule

1---
2description: 
3globs: 
4alwaysApply: false
5---
6# Moodle Security Practices
7 
8## Purpose
9Ensure all PHP code follows Moodle security best practices to prevent vulnerabilities and maintain data integrity.
10 
11## Instructions
12When writing PHP code for Moodle, implement these security practices:
13 
141. **Input Validation**: Always validate and sanitize user input using Moodle's validation functions
152. **SQL Injection Prevention**: Use parameterized queries with `$DB->get_records_sql()` or `$DB->execute()`
163. **XSS Prevention**: Use `format_string()` and `format_text()` for output, never output raw user data
174. **CSRF Protection**: Include `require_sesskey()` in forms and actions that modify data
185. **Capability Checks**: Always check user capabilities before performing actions
196. **File Upload Security**: Validate file types, sizes, and use `moodle_exception` for errors
207. **Session Security**: Use Moodle's session management, never manipulate `$_SESSION` directly
218. **Password Handling**: Never store passwords in plain text, use Moodle's password hashing
22 
23## Examples
24 
25```php
26<?php
27// File: ./includes/security_example.php
28 
29/**
30 * Example of secure form processing
31 */
32function process_user_data() {
33    global $DB, $USER;
34    
35    // CSRF protection
36    require_sesskey();
37    
38    // Capability check
39    require_capability('moodle/user:editownprofile', context_user::instance($USER->id));
40    
41    // Input validation
42    $userid = required_param('userid', PARAM_INT);
43    $name = required_param('name', PARAM_TEXT);
44    $email = required_param('email', PARAM_EMAIL);
45    
46    // SQL injection prevention
47    $user = $DB->get_record('user', ['id' => $userid], '*', MUST_EXIST);
48    
49    // XSS prevention in output
50    echo format_string($user->firstname);
51    echo format_text($user->description, FORMAT_HTML);
52    
53    // Secure file upload
54    $file = file_get_submitted_draftfileid('userfile');
55    if ($file) {
56        $context = context_user::instance($USER->id);
57        file_save_draft_area_files($file, $context->id, 'user', 'profile', 0);
58    }
59}
60```
61 
62## Exceptions
63- Third-party integrations may require different security approaches
64- Legacy code should be updated to follow these practices when modified
65