'; } /** * Validate the CSRF token on a POST request. Halts with 400 on failure. */ function csrf_verify(): void { $sent = $_POST['csrf'] ?? ''; if (empty($_SESSION['csrf']) || !hash_equals($_SESSION['csrf'], (string) $sent)) { http_response_code(400); exit('Invalid CSRF token.'); } }