#Security

14 snippets

• PHP Tested

  Validate emails and URLs in PHP

  Use filter_var to validate email addresses and http(s) URLs, with an allow-list for schemes.

• Python Tested

  Sign API requests with HMAC-SHA256

  Create and verify a timestamped signature over the method, path and body so requests cannot be forged or replayed.

• JavaScript Tested

  Generate secure random IDs and integers

  Create UUIDs, random integers in a range and URL-safe tokens with the Web Crypto API instead of Math.random.

• PHP Tested

  Generate a secure random token in PHP

  Create unpredictable tokens for password resets, API keys and CSRF protection with random_bytes.

• PHP Tested

  Escape output to prevent XSS in PHP

  A short helper around htmlspecialchars with the right flags for HTML text and attribute values.

• JavaScript Tested

  Deep merge plain objects

  Recursively merge configuration objects without mutating the inputs and without prototype pollution.

• JavaScript Tested

  Encode and decode opaque pagination cursors

  Turn a sort position into a URL-safe cursor string and validate it when it comes back from the client.

• PHP Tested

  CSRF token generation and verification

  Protect state-changing forms with a per-session token compared in constant time.

• JavaScript Tested

  Verify a webhook signature in Node.js

  Validate an HMAC-SHA256 webhook against the raw request body with a constant-time comparison and replay window.

• Python Tested

  Verify a webhook HMAC signature in Python

  Validate a signed webhook body with hmac.compare_digest and a timestamp tolerance.

• PHP Tested

  Verify an HMAC signature in PHP (constant time)

  Check a webhook or signed-request HMAC with hash_hmac and hash_equals to avoid timing attacks.

• PHP

  Query a database with PDO prepared statements

  Connect with PDO in exception mode and bind parameters to prevent SQL injection.