security.php

<?php
class Security {
    public static function sanitizeInput($input) {
        if (is_array($input)) {
            return array_map([self::class, 'sanitizeInput'], $input);
        }
        return htmlspecialchars(trim($input), ENT_QUOTES, 'UTF-8');
    }

    public static function generateCSRFToken() {
        if (empty($_SESSION['csrf_token'])) {
            $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
        }
        return $_SESSION['csrf_token'];
    }

    public static function validateCSRFToken($token) {
        return isset($_SESSION['csrf_token']) && hash_equals($_SESSION['csrf_token'], $token);
    }

    public static function rateLimit($key, $maxAttempts = 60, $decayMinutes = 1) {
        $attempts = isset($_SESSION[$key]) ? $_SESSION[$key] : ['count' => 0, 'time' => time()];
        
        if (time() - $attempts['time'] > $decayMinutes * 60) {
            $attempts = ['count' => 0, 'time' => time()];
        }
        
        $attempts['count']++;
        $_SESSION[$key] = $attempts;
        
        return $attempts['count'] <= $maxAttempts;
    }
}
?>