dans les formulaires // Vérification: verifyCsrf($_POST['_csrf']) // ───────────────────────────────────────────────────────────── function csrfToken(): string { if (empty($_SESSION['csrf_token'])) { $_SESSION['csrf_token'] = bin2hex(random_bytes(32)); } return $_SESSION['csrf_token']; } function csrfField(): string { return ''; } function verifyCsrf(?string $token): bool { return isset($_SESSION['csrf_token']) && $token !== null && hash_equals($_SESSION['csrf_token'], $token); }