Standard base64 uses + and / which break in URLs. Swap them for - and _, drop the = padding, and you get a string you can put in path segments and query parameters safely.
Parse the standard HTTP Link header (RFC 5988) into a relation → URL map. Lets you follow rel="next" pagination in APIs like GitHub without manually building URLs.
Use PHP's built-in FILTER_VALIDATE_EMAIL with the FILTER_FLAG_EMAIL_UNICODE flag for IDN domains, plus a length sanity check. Trust this over hand-rolled regex.
Two-way conversion between #RRGGBB hex strings and [R, G, B] arrays. Handy when working with theme colors that come from both sources (CSS strings vs. RGB sliders).
A defense-in-depth check for $_FILES uploads: confirms the upload completed, the size is within bounds, the MIME type matches an allow-list (by libmagic, not by extension), and the file landed where PHP expected.
Remove a directory and everything under it. Defensive against symlinks (unlinks the symlink rather than recursing into it). Returns the count of items removed.
Convert between camelCase and snake_case identifiers. Handy when mapping JS API responses (camelCase) into PHP database column names (snake_case) and vice versa.
Generate a JWT manually using only base64-url and hash_hmac — no library required. Demonstrates header/payload/signature concatenation and the exp claim.
Cursor (keyset) pagination is faster than OFFSET on large tables — and immune to dupes/skips when rows shift. Pass the last seen ID and direction; get the next page.
A thin wrapper around PHP's mail() with proper headers (From, Reply-To, Content-Type with UTF-8). For anything serious reach for PHPMailer or Symfony Mailer — this is fine for transactional one-offs.
Write a file in a way that other processes never see a half-written state. Write to a temp file in the same directory, then rename — rename is atomic on POSIX filesystems.
Time a closure with microsecond precision and return both its result and the elapsed milliseconds. Great for quick perf experiments without pulling in a profiler.
Pair to jwtSign: verify the signature, check the exp claim, and return the decoded payload — or null on any failure. Uses hash_equals for constant-time signature comparison.
A MySQL upsert helper: insert a row, or if a unique key collides, update the same row with the new values. Returns whether the row was inserted (true) or updated (false).
Generate and verify a 6-digit time-based one-time password (RFC 6238) compatible with Google Authenticator / Authy. Uses a base32-encoded secret and 30-second time steps.