carrying the CSRF token, for use inside a

. */ function csrf_field(): string { return ''; } /** * Verify the CSRF token on the current request (checks $_POST['csrf_token'], * falling back to the X-CSRF-Token header for JSON-body API calls). Aborts * the request with a 403 on failure. */ function csrf_verify(): void { _auth_start(); $sent = $_POST['csrf_token'] ?? $_SERVER['HTTP_X_CSRF_TOKEN'] ?? ''; $expected = $_SESSION['csrf_token'] ?? ''; if ($sent === '' || $expected === '' || !hash_equals($expected, $sent)) { http_response_code(403); $accept = $_SERVER['HTTP_ACCEPT'] ?? ''; $ctype = $_SERVER['CONTENT_TYPE'] ?? ''; if (str_contains($accept, 'application/json') || str_contains($ctype, 'application/json')) { header('Content-Type: application/json'); echo json_encode(['error' => 'Invalid or missing security token. Please refresh the page and try again.']); } else { echo '' . '

Security Check Failed

' . '

Invalid or missing security token. Please go back, refresh the page, and try again.

' . ''; } exit; } }