// XSS Protection - Sanitize user input
const sanitizeInput = (input) => {
  if (!input) return input;

  if (typeof input === 'string') {
    // Remove script tags and HTML entities
    return input
      .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
      .replace(/<[^>]*>/g, '')
      .replace(/javascript:/gi, '')
      .replace(/on\w+\s*=/gi, '')
      .trim();
  }

  if (typeof input === 'object' && input !== null) {
    const sanitized = {};
    for (const key in input) {
      sanitized[key] = sanitizeInput(input[key]);
    }
    return sanitized;
  }

  return input;
};

// Sanitize email
const sanitizeEmail = (email) => {
  if (!email) return email;
  return email.toLowerCase().trim().replace(/[<>]/g, '');
};

// Sanitize phone
const sanitizePhone = (phone) => {
  if (!phone) return phone;
  return phone.replace(/[^\d\s\+\-\(\)]/g, '').trim();
};

module.exports = {
  sanitizeInput,
  sanitizeEmail,
  sanitizePhone
};
