Project: A Guestbook

guestbook/
├── index.php            front controller: routes every request
├── src/
│   └── bootstrap.php    database, session and helper functions
├── templates/
│   ├── layout.php       the shared page frame
│   └── home.php         the guestbook page
└── storage/
    └── guestbook.sqlite created automatically

<?php
declare(strict_types=1);

final readonly class Entry
{
    public function __construct(
        public int $id,
        public string $name,
        public string $message,
        public string $createdAt,
    ) {}
}

function db(): PDO
{
    static $pdo = null;
    if ($pdo === null) {
        @mkdir(__DIR__ . '/../storage', 0775, true);
        $pdo = new PDO('sqlite:' . __DIR__ . '/../storage/guestbook.sqlite', options: [
            PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
            PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
        ]);
        $pdo->exec('CREATE TABLE IF NOT EXISTS entries (
            id INTEGER PRIMARY KEY AUTOINCREMENT,
            name TEXT NOT NULL,
            message TEXT NOT NULL,
            created_at TEXT NOT NULL
        )');
    }
    return $pdo;
}

/** @return list<Entry> */
function latestEntries(int $limit = 20): array
{
    $stmt = db()->prepare('SELECT * FROM entries ORDER BY id DESC LIMIT ?');
    $stmt->execute([$limit]);
    return array_map(
        fn(array $r) => new Entry((int) $r['id'], $r['name'], $r['message'], $r['created_at']),
        $stmt->fetchAll(),
    );
}

function addEntry(string $name, string $message): int
{
    db()->prepare('INSERT INTO entries (name, message, created_at) VALUES (?, ?, ?)')
        ->execute([$name, $message, gmdate('c')]);
    return (int) db()->lastInsertId();
}

/** @return array<string, string> field => error message */
function validateEntry(string $name, string $message): array
{
    $errors = [];
    if (mb_strlen($name) < 2 || mb_strlen($name) > 40) {
        $errors['name'] = 'Name must be 2–40 characters.';
    }
    if (mb_strlen($message) < 3 || mb_strlen($message) > 500) {
        $errors['message'] = 'Message must be 3–500 characters.';
    }
    return $errors;
}

function e(?string $value): string
{
    return htmlspecialchars($value ?? '', ENT_QUOTES, 'UTF-8');
}

function csrfToken(): string
{
    return $_SESSION['csrf'] ??= bin2hex(random_bytes(32));
}

function checkCsrf(): void
{
    if (!hash_equals(csrfToken(), (string) ($_POST['csrf'] ?? ''))) {
        http_response_code(403);
        exit('Invalid form submission. Please reload the page and try again.');
    }
}

function flash(?string $message = null): ?string
{
    if ($message !== null) {
        $_SESSION['flash'] = $message;
        return null;
    }
    $stored = $_SESSION['flash'] ?? null;
    unset($_SESSION['flash']);
    return $stored;
}

function render(string $template, array $data = []): string
{
    extract($data);
    ob_start();
    require __DIR__ . "/../templates/$template.php";
    return ob_get_clean();
}

function page(string $title, string $template, array $data = []): string
{
    return render('layout', ['title' => $title, 'content' => render($template, $data)]);
}

session_start(['cookie_httponly' => true, 'cookie_samesite' => 'Lax']);

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title><?= e($title) ?> · Guestbook</title>
</head>
<body>
<main>
<?= $content ?>
</main>
</body>
</html>

<h1>Guestbook</h1>
<?php if ($flash): ?>
<p class="flash"><?= e($flash) ?></p>
<?php endif; ?>
<form method="post" action="/sign">
  <input type="hidden" name="csrf" value="<?= e($csrf) ?>">
  <input name="name" value="<?= e($old['name'] ?? '') ?>"><?php if (isset($errors['name'])): ?> <span class="error"><?= e($errors['name']) ?></span><?php endif; ?>

  <textarea name="message"><?= e($old['message'] ?? '') ?></textarea><?php if (isset($errors['message'])): ?> <span class="error"><?= e($errors['message']) ?></span><?php endif; ?>

  <button>Sign</button>
</form>
<?php if ($entries === []): ?>
<p>No entries yet. Be the first!</p>
<?php else: ?>
<ol>
<?php foreach ($entries as $entry): ?>
  <li><strong><?= e($entry->name) ?></strong>: <?= nl2br(e($entry->message)) ?></li>
<?php endforeach; ?>
</ol>
<?php endif; ?>

<?php
declare(strict_types=1);

require __DIR__ . '/src/bootstrap.php';

$method = $_SERVER['REQUEST_METHOD'];
$path = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);

echo match ([$method, $path]) {
    ['GET', '/'] => showGuestbook(),
    ['POST', '/sign'] => signGuestbook(),
    ['GET', '/api/entries'] => entriesJson(),
    default => notFound(),
};

function showGuestbook(array $errors = [], array $old = []): string
{
    return page('Sign our guestbook', 'home', [
        'entries' => latestEntries(),
        'flash' => flash(),
        'csrf' => csrfToken(),
        'errors' => $errors,
        'old' => $old,
    ]);
}

function signGuestbook(): string
{
    checkCsrf();
    $name = trim((string) ($_POST['name'] ?? ''));
    $message = trim((string) ($_POST['message'] ?? ''));

    $errors = validateEntry($name, $message);
    if ($errors !== []) {
        http_response_code(400);
        return showGuestbook($errors, ['name' => $name, 'message' => $message]);
    }

    addEntry($name, $message);
    flash("Thanks for signing, $name!");
    header('Location: /', true, 303);
    return '';
}

function entriesJson(): string
{
    header('Content-Type: application/json');
    $entries = array_map(fn(Entry $e) => ['id' => $e->id, 'name' => $e->name, 'message' => $e->message], latestEntries());
    return json_encode(['count' => count($entries), 'entries' => $entries], JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_THROW_ON_ERROR);
}

function notFound(): string
{
    http_response_code(404);
    return page('Not found', 'home', ['entries' => [], 'flash' => 'That page does not exist.', 'csrf' => csrfToken(), 'errors' => [], 'old' => []]);
}

GET /
POST /sign name=Ana&message=Lovely+site%21+Greetings+from+Lisbon.&csrf={{csrf}}
GET /
POST /sign name=B&message=Hi&csrf={{csrf}}
POST /sign name=Mallory&message=<script>alert(1)</script>&csrf=stolen
GET /api/entries