> (If you can tell me about csrf and have set up csrf protection in a project you're in the minority of php developers) Incidentally, I wrote this: https://git

> (If you can tell me about csrf and have set up csrf protection in a project you're in the minority of php developers) Incidentally, I wrote this: https://github.com/resonantcore/lib/blob/master/src/Security/CSRF.php https://github.com/resonantcore/lib/blob/master/src/Security... #3 is surprising to me. I've seen some strange behavior (throwing [0] after a post field can lead to unexpected errors and sometimes lead to an information leak) but never RCE.