Tags
#php
#kotlin
#bash
#go
#sql
#rust
#typescript
#html
#java
#python
#files
#utils
#strings
#http
#concurrency
#async
#json
#arrays
#security
#types
#crypto
#database
#dates
#format
PHP
Email Address Obfuscator
Render an email address as HTML that is human-readable but resistant to naive scraping bots. Uses entity encoding and an optional Caesar-style ROT for the mailto link.
@admin
PHP
CSRF Token Generate + Verify
Per-session CSRF token helpers using hash_equals for constant-time comparison. Token is regenerated on logout but persists across requests within a session.
PHP
Secure Session Bootstrap
Start a session with all the security flags you should always set: HttpOnly, SameSite=Strict, Secure on HTTPS, custom name, and an idle-timeout regeneration.
PHP
Strip HTML Safely (whitelist tags)
Strip nearly all HTML from a string but keep a small whitelist (e.g. links, line breaks, inline formatting). Wraps strip_tags with sensible defaults and a callback to also drop event-handler attributes.
PHP
Validate Password Strength
Score a password 0–4 (NIST-inspired, not the full zxcvbn algorithm). Encourages length over complexity; flags well-known weak patterns. Use as a UI hint, not a hard barrier.
PHP
HMAC Webhook Signature Verify
Verify an inbound webhook (Stripe / GitHub / etc.) is genuine using HMAC-SHA256 and a shared secret. Includes timestamp tolerance to block replay attacks.
PHP
Validate IP Address (v4 + v6)
Distinguish IPv4 from IPv6, optionally reject private/reserved/loopback ranges. Useful for hardening server-side fetchers against SSRF.
PHP
Generate Crypto-Strong Password
Generate a strong random password with configurable length and character sets. Uses rejection sampling to keep the distribution uniform across the chosen alphabet (no biased % alphabetLen).
PHP
Rate Limiter (token bucket, file-backed)
A dirt-simple rate limiter that throttles per-key using a token bucket persisted to a JSON file. Good for single-server protection of expensive endpoints; reach for Redis when you scale out.
PHP
Detect MIME Type via Magic Bytes
Use PHP's built-in finfo (libmagic) to detect a file's true MIME type from its bytes — not from the extension, which can be lied about. Critical for validating user uploads.
PHP
Validate Uploaded File
A defense-in-depth check for $_FILES uploads: confirms the upload completed, the size is within bounds, the MIME type matches an allow-list (by libmagic, not by extension), and the file landed where PHP expected.
PHP
Constant-Time String Compare
Compare two strings in constant time to avoid timing-attack leaks when checking secrets like API keys, session tokens, or HMAC signatures. Always use hash_equals — never ===.
PHP
Hash Large File Without Loading It
Compute the SHA-256 of a multi-gigabyte file by streaming it through hash_init / hash_update_stream — no memory blow-up. Useful for backup verification or torrent-style integrity checks.
PHP
TOTP Code Generate + Verify
Generate and verify a 6-digit time-based one-time password (RFC 6238) compatible with Google Authenticator / Authy. Uses a base32-encoded secret and 30-second time steps.
PHP
Set Cookie with Modern Options
PHP 7.3+ accepts an options array on setcookie() — use it. Sets HttpOnly, Secure on HTTPS, SameSite=Lax by default, and a sensible expiry.
PHP
Encrypt / Decrypt with libsodium
Symmetric AEAD encryption using the libsodium "secretbox" (XSalsa20-Poly1305). Built into PHP since 7.2 — no extension needed. Returns base64 ciphertext with the nonce prepended.
PHP
Safe Path Join
Concatenate path segments and produce a normalized canonical path that resists "../" escape attempts. Throws if the result would land outside the given base directory.