Tag

Placeholders rather than interpolation. This is the whole of SQL injection defence in PHP.

htmlspecialchars with the flags spelled out, because the defaults have changed between versions.

password_hash picks the algorithm and the salt. Never store anything a hash function can reverse.

A plain === leaks how much of the token matched through its timing. This does not.