$type, 'msg' => $msg]; } function flash_get(): array { $f = $_SESSION['_flash'] ?? []; unset($_SESSION['_flash']); return $f; } function require_post(): void { if ($_SERVER['REQUEST_METHOD'] !== 'POST') { http_response_code(405); echo "Method Not Allowed"; exit; } } function csrf_token(): string { if (empty($_SESSION['_csrf'])) $_SESSION['_csrf'] = bin2hex(random_bytes(16)); return $_SESSION['_csrf']; } function csrf_check(): void { $t = $_POST['_csrf'] ?? ''; if (!$t || !hash_equals($_SESSION['_csrf'] ?? '', $t)) { http_response_code(419); echo "CSRF token mismatch"; exit; } } function csrf_field(): string { $token = csrf_token(); return ''; }