✏ EDIT: Security.php

<?php
require_once __DIR__ . '/Session.php';
class Security
{
    public static function e(mixed $value): string
    {
        return htmlspecialchars((string)$value, ENT_QUOTES, 'UTF-8');
    }

public static function sanitize(mixed $value): string
    {
        $value = trim((string)$value);
        $value = strip_tags($value);
        return preg_replace('/\s+/', ' ', $value) ?? '';
    }

public static function csrfToken(): string
    {
        Session::start();
        if (empty($_SESSION['_csrf'])) {
            $_SESSION['_csrf'] = bin2hex(random_bytes(32));
        }
        return $_SESSION['_csrf'];
    }

public static function validateCsrf(?string $token): bool
    {
        Session::start();
        return is_string($token) && isset($_SESSION['_csrf']) && hash_equals($_SESSION['_csrf'], $token);
    }

public static function json(array $payload, int $code = 200): never
    {
        http_response_code($code);
        header('Content-Type: application/json; charset=utf-8');
        echo json_encode($payload, JSON_UNESCAPED_UNICODE);
        exit;
    }

public static function redirect(string $url): never
    {
        header('Location: ' . $url);
        exit;
    }
}

[✗] CANCEL