PHP backend recipes: HTTP, security, formatting

How it works: curl_init opens a handle to the URL, CURLOPT_RETURNTRANSFER makes curl_exec return the response body as a string instead of printing it, and curl_getinfo after execution reads the HTTP status code.

<?php

function httpGet(string $url, array $headers = []): array
{
    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_TIMEOUT, 10);
    curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);

    $response = curl_exec($ch);
    $statusCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    return ['status' => $statusCode, 'body' => json_decode($response, true)];
}

// Example usage
$result = httpGet('https://api.example.com/users/1', ['Accept: application/json']);
if ($result['status'] === 200) {
    echo $result['body']['name'];
}

How it works: log($bytes, 1024) finds which power of 1024 the byte count falls into (0 = bytes, 1 = KB, 2 = MB...), then divides by that power to get the display value.

<?php

function formatBytes(int $bytes, int $precision = 2): string
{
    if ($bytes <= 0) {
        return '0 B';
    }

    $units = ['B', 'KB', 'MB', 'GB', 'TB', 'PB'];
    $power = min((int) floor(log($bytes, 1024)), count($units) - 1);

    return round($bytes / (1024 ** $power), $precision) . ' ' . $units[$power];
}

// Example usage
formatBytes(1536);       // "1.5 KB"
formatBytes(1073741824); // "1 GB"

How it works: proxy/CDN headers are checked in order of trust (Cloudflare's own header first, since it can't be spoofed once Cloudflare sits in front of the app), and every candidate is validated as a real public IP before being trusted — private ranges (10.x, 192.168.x, etc.) are rejected so a client can't fake X-Forwarded-For: 10.0.0.1 to hide behind an internal-looking address.

<?php

function getClientIp(): ?string
{
    $headers = ['HTTP_CF_CONNECTING_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_REAL_IP', 'HTTP_CLIENT_IP'];

    foreach ($headers as $header) {
        $value = $_SERVER[$header] ?? null;
        if (!$value) {
            continue;
        }

        // X-Forwarded-For can contain a comma-separated chain; the first entry is the original client
        foreach (explode(',', $value) as $candidate) {
            $ip = trim($candidate);
            if (isPublicIp($ip)) {
                return $ip;
            }
        }
    }

    return $_SERVER['REMOTE_ADDR'] ?? null;
}

function isPublicIp(string $ip): bool
{
    return (bool) filter_var(
        $ip,
        FILTER_VALIDATE_IP,
        FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE
    );
}

// Example usage
$ip = getClientIp(); // "203.0.113.42" — never a spoofed private/loopback address

How it works: password_hash with PASSWORD_BCRYPT and cost: 12 is a good security/performance balance (~250ms). password_needs_rehash lets you gradually upgrade old hashes at login without forcing a password reset.

<?php

const HASH_COST = 12;

function hashPassword(string $password): string
{
    return password_hash($password, PASSWORD_BCRYPT, ['cost' => HASH_COST]);
}

function verifyPassword(string $password, string $hash): bool
{
    return password_verify($password, $hash);
}

function needsRehash(string $hash): bool
{
    return password_needs_rehash($hash, PASSWORD_BCRYPT, ['cost' => HASH_COST]);
}

// Example usage — registration
$hash = hashPassword($_POST['password']);
// Store $hash in the database

// Login
$user = $db->findByEmail($email);

if (!verifyPassword($plainPassword, $user['password_hash'])) {
    throw new \Exception('Invalid credentials');
}

// Upgrade the hash if parameters changed (e.g. increased cost)
if (needsRehash($user['password_hash'])) {
    $db->updatePasswordHash($user['id'], hashPassword($plainPassword));
}

How it works: the name is hashed into a hue (0-359°) so the same person always gets the same color, and the initials are just the first letter of the first and last name.

<?php

function buildInitials(?string $firstName, ?string $lastName): string
{
    $first = trim((string) $firstName);
    $last = trim((string) $lastName);

    if ($first === '' && $last === '') {
        return 'U';
    }

    return mb_strtoupper(mb_substr($first, 0, 1) . mb_substr($last, 0, 1));
}

function avatarColor(string $name): string
{
    $hash = 0;
    for ($i = 0; $i < mb_strlen($name); $i++) {
        $hash = mb_ord(mb_substr($name, $i, 1)) + (($hash << 5) - $hash);
    }
    $hue = abs($hash) % 360;

    return "hsl({$hue}, 80%, 60%)";
}

function renderAvatar(?string $firstName, ?string $lastName, int $size = 36): string
{
    $initials = buildInitials($firstName, $lastName);
    $color = avatarColor(trim($firstName . $lastName) ?: 'user');

    return sprintf(
        '<div style="width:%1$dpx;height:%1$dpx;border-radius:9999px;background:%2$s;color:#fff;display:flex;align-items:center;justify-content:center;font-weight:600;">%3$s</div>',
        $size,
        $color,
        htmlspecialchars($initials)
    );
}

// Example usage
echo renderAvatar('Alex', 'Rel'); // circular "AR" badge, color derived from the name

How it works: a GET request to ipapi.co/{ip}/json/ returns the geolocation data as JSON. Leaving $ip empty makes the API auto-detect the caller's own IP — handy for looking up the current visitor on your server.

<?php

function getIpInfo(string $ip = ''): array
{
    $url = 'https://ipapi.co/' . $ip . '/json/';
    $response = file_get_contents($url);

    return json_decode($response, true) ?? [];
}

// Example usage
$info = getIpInfo(); // empty $ip -> detects the server's own IP
echo $info['city'] . ', ' . $info['country_name'];

$info = getIpInfo('8.8.8.8'); // or look up a specific IP
echo $info['timezone'];

How it works: it keeps the first and last 4 characters and replaces everything in between with asterisks; very short secrets (8 characters or fewer) are masked entirely so nothing meaningful leaks.

<?php

function getTokenPreview(?string $token): ?string
{
    if (empty($token)) {
        return null;
    }

    $length = strlen($token);

    if ($length <= 8) {
        return str_repeat('*', $length);
    }

    return substr($token, 0, 4) . str_repeat('*', 4) . substr($token, -4);
}

// Example usage
getTokenPreview('sk_live_51Hh2eZC9x8f3JvQwErTyUi'); // "sk_l****EiUi"
getTokenPreview('short'); // "*****"

How it works: underscores are normalized to hyphens, the tag is split into parts, the first part is the language code, and any 2-letter or 3-digit part after it is treated as the region.

<?php

function parseLanguageTag(?string $tag): array
{
    if (empty($tag)) {
        return ['language' => null, 'region' => null, 'canonical' => null];
    }

    $parts = array_values(array_filter(explode('-', str_replace('_', '-', trim($tag)))));
    if (empty($parts)) {
        return ['language' => null, 'region' => null, 'canonical' => null];
    }

    $language = strtolower($parts[0]);

    $region = null;
    foreach (array_slice($parts, 1) as $part) {
        if (preg_match('/^[A-Za-z]{2}$/', $part)) {
            $region = strtoupper($part);
            break;
        }
        if (preg_match('/^\d{3}$/', $part)) {
            $region = $part;
            break;
        }
    }

    return [
        'language' => $language,
        'region' => $region,
        'canonical' => $region ? "{$language}-{$region}" : $language,
    ];
}

// Example usage
parseLanguageTag('en-GB'); // ['language' => 'en', 'region' => 'GB', 'canonical' => 'en-GB']
parseLanguageTag('pt_BR'); // ['language' => 'pt', 'region' => 'BR', 'canonical' => 'pt-BR']

How it works: on each request, a counter in Redis is atomically incremented using a key that includes the user identifier and time window. On the first hit, a TTL is set. If the counter exceeds the limit, the function returns true (blocked).

<?php

function isRateLimited(Redis $redis, string $key, int $maxRequests, int $windowSeconds): bool
{
    $current = $redis->incr($key);

    if ($current === 1) {
        $redis->expire($key, $windowSeconds);
    }

    return $current > $maxRequests;
}

// Example usage — 10 requests per minute per user
function checkUserRateLimit(Redis $redis, int $userId): bool
{
    $window = (int) floor(time() / 60); // resets every minute
    $key    = "rate:user:{$userId}:{$window}";
    return isRateLimited($redis, $key, 10, 60);
}

// In a controller / webhook handler
$redis = new Redis();
$redis->connect('127.0.0.1', 6379);

if (checkUserRateLimit($redis, $userId)) {
    http_response_code(429);
    header('Retry-After: 60');
    exit(json_encode(['error' => 'Too many requests']));
}

How it works: each retry doubles the delay (200ms, 400ms, 800ms...) capped at $maxDelayMs, plus a random 0-20% jitter on top. Jitter matters because if 1,000 clients all fail at once and retry after exactly the same fixed delay, they all hammer the server again at the same instant.

<?php

function retryWithBackoff(callable $operation, int $maxAttempts = 3, int $baseDelayMs = 200, int $maxDelayMs = 2000): mixed
{
    for ($attempt = 1; $attempt <= $maxAttempts; $attempt++) {
        try {
            return $operation();
        } catch (\Throwable $e) {
            if ($attempt >= $maxAttempts) {
                throw $e;
            }

            $delay = min($maxDelayMs, $baseDelayMs * 2 ** ($attempt - 1));
            $jitter = random_int(0, (int) ($delay * 0.2));
            usleep(($delay + $jitter) * 1000);
        }
    }

    throw new \RuntimeException('Unreachable');
}

// Example usage
$response = retryWithBackoff(fn () => Http::get('https://api.example.com/data')->throw());

How it works: converting a string from UTF-8 to UTF-8 with mb_convert_encoding forces PHP to replace any invalid byte sequences instead of leaving them in place — which is exactly what would otherwise make json_encode() silently fail.

<?php

function sanitizeUtf8(mixed $value): ?string
{
    if ($value === null || !is_string($value)) {
        return null;
    }

    if ($value === '') {
        return '';
    }

    $sanitized = mb_convert_encoding($value, 'UTF-8', 'UTF-8');

    return $sanitized !== false ? $sanitized : null;
}

// Example usage — prevents json_encode() from silently failing on bad input
$clean = sanitizeUtf8($userSuppliedString);
echo json_encode(['name' => $clean]);

How it works: random_bytes() pulls bytes from the OS's cryptographically secure generator, and bin2hex() turns them into a printable hex string twice as long as the byte count — so $length / 2 bytes produce a password of exactly $length characters.

<?php

function generatePassword(int $length = 12): string
{
    return bin2hex(random_bytes((int) ceil($length / 2)));
}

$password = generatePassword(); // e.g. "a4c9b72f3d88"

How it works: FILTER_VALIDATE_EMAIL follows RFC 822/2822 syntax rules and handles edge cases (quoted local parts, IP-literal domains, etc.) far more reliably than a regex most developers would write by hand.

<?php

function isValidEmail(string $email): bool
{
    return filter_var($email, FILTER_VALIDATE_EMAIL) !== false;
}

// Example usage
isValidEmail('[email protected]'); // true
isValidEmail('not-an-email');     // false