<?php
function csrf_token(){
    if(empty($_SESSION['csrf'])) $_SESSION['csrf']=bin2hex(random_bytes(32));
    return $_SESSION['csrf'];
}
function csrf_field(){return '<input type="hidden" name="_csrf" value="'.csrf_token().'">';}
function csrf_check(){
    if($_SERVER['REQUEST_METHOD']!=='POST') return true;
    if(!isset($_POST['_csrf']) || !hash_equals($_SESSION['csrf']??'', $_POST['_csrf'])){
        http_response_code(419); die('CSRF token mismatch. পেজ রিফ্রেশ করুন।');
    }
    return true;
}
