Zero-Dependency Web Security: Securing Native PHP Without Framework Middleware

Relying on external libraries for essential web security introduces supply-chain risk and performance overhead. Built-in PHP standard libraries provide all necessary primitives to defend against Cross-Site Request Forgery (CSRF), Cross-Site Scripting (XSS), and SQL Injection.

Cryptographically Secure CSRF Verification

Implement stateless or session-backed CSRF tokens using random_bytes() and hash_equals() to prevent timing attacks during token comparison:

// CSRF Token Generation & Validation
function generateCsrfToken(): string {
    if (empty($_SESSION['csrf_token'])) {
        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
    }
    return $_SESSION['csrf_token'];
}

function validateCsrfToken(?string $token): bool {
    if (!$token || empty($_SESSION['csrf_token'])) {
        return false;
    }
    return hash_equals($_SESSION['csrf_token'], $token);
}

Strict PDO Prepared Statements

Prevent SQL injection vulnerabilities by enforcing parameterized binding and disabling emulated prepared statements within your PDO connection config:

$options = [
    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
    PDO::ATTR_EMULATE_PREPARES   => false, // Enforces native database query compilation
];
$pdo = new PDO($dsn, $user, $pass, $options);

Pairs perfectly with our lightweight, zero-dependency PHP router implementation to keep API backends secure and fast.