# Security

## XSS prevention

```php
// Always escape
echo htmlspecialchars($userInput, ENT_QUOTES, 'UTF-8');

// In Twig (automatic)
{{ userVariable }}
```

## CSRF tokens

```php
// Generate
$csrf = $auth->getCsrfToken();

// Verify
if (!$auth->verifyCsrf($_POST['csrf_token'])) {
    die('Invalid CSRF token');
}
```

## Path traversal prevention

```php
// Use realpath() and check prefix
$realPath = realpath($filePath);
$realContentDir = realpath($contentDir);
if (strpos($realPath, $realContentDir) !== 0) {
    die('Invalid path');
}
```