If you run PHP, update it now

If you genuinely cannot update immediately

This is bigger than WordPress

Would Rust have prevented php2shell?

Why Rust for server-rendered applications?

Where Fission fits

A login page in PHP and Fission

PHP

<?php

declare(strict_types=1);

session_start([
  'cookie_httponly' => true,
  'cookie_secure' => true,
  'cookie_samesite' => 'Lax',
]);

$pdo = new PDO(
  $_ENV['DATABASE_URL'],
  $_ENV['DATABASE_USER'],
  $_ENV['DATABASE_PASSWORD'],
  [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION],
);

$_SESSION['csrf'] ??= bin2hex(random_bytes(32));

$username = '';
$error = null;

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
  $username = trim((string) ($_POST['username'] ?? ''));
  $password = (string) ($_POST['password'] ?? '');
  $csrf = (string) ($_POST['csrf'] ?? '');

  if (!hash_equals($_SESSION['csrf'], $csrf)) {
      http_response_code(400);
      $error = 'Your session expired. Try again.';
  } else {
      $query = $pdo->prepare(
          'SELECT id, password_hash
             FROM users
            WHERE username = :username'
      );

      $query->execute(['username' => $username]);
      $user = $query->fetch(PDO::FETCH_ASSOC);

      if ($user && password_verify(
          $password,
          $user['password_hash'],
      )) {
          session_regenerate_id(true);
          $_SESSION['user_id'] = $user['id'];

          header('Location: /account', true, 303);
          exit;
      }

      $error = 'The username or password was incorrect.';
  }
}
?>

<h1>Sign in</h1>

<?php if ($error !== null): ?>
  <div role="alert">
      <?= htmlspecialchars($error, ENT_QUOTES, 'UTF-8') ?>
  </div>
<?php endif ?>

<form method="post">
  <input
      type="hidden"
      name="csrf"
      value="<?= htmlspecialchars(
          $_SESSION['csrf'],
          ENT_QUOTES,
          'UTF-8',
      ) ?>"
  >

  <label>
      Username
      <input
          name="username"
          value="<?= htmlspecialchars(
              $username,
              ENT_QUOTES,
              'UTF-8',
          ) ?>"
          autocomplete="username"
          required
      >
  </label>

  <label>
      Password
      <input
          type="password"
          name="password"
          autocomplete="current-password"
          required
      >
  </label>

  <button type="submit">Sign in</button>
  <a href="https://example.com/forgot-password">Forgot password?</a>
</form>

Fission Compose

use fission::prelude::*;
use serde::{Deserialize, Serialize};

#[derive(Default)]
struct AppState {
  session: Option<UserSession>,
}

impl GlobalState for AppState {}

#[derive(Serialize)]
struct LoginRequest {
  username: String,
  password: String,
}

#[derive(Deserialize, Serialize)]
struct LoginResponse {
  session: UserSession,
}

#[derive(Clone, Deserialize, Serialize)]
struct UserSession {
  user_id: String,
}

#[fission_effect]
async fn sign_in(
  request: LoginRequest,
) -> Result<LoginResponse, String> {
  api::post("/api/login", &request)
      .await
      .map_err(|error| error.public_message())
}

fission_component! {
  pub LoginPage<AppState> {
      state {
          username: String = String::new(),
          password: String = String::new(),
          signing_in: bool = false,
          error: Option<String> = None,
      }
  }
  view(login, state, cx) =>
  Center(
      child: Card(
          child: Column(
              gap: cx.spacing().m,
              children: [
                  Text(cx.tr("auth.sign_in.title")),

                  TextInput(
                      label: Some(
                          cx.tr("auth.username").into()
                      ),
                      bind: login.username,
                      autocomplete: Some(
                          "username".into()
                      ),
                      required: true,
                  ),

                  TextInput(
                      label: Some(
                          cx.tr("auth.password").into()
                      ),
                      bind: login.password,
                      obscure_text: true,
                      autocomplete: Some(
                          "current-password".into()
                      ),
                      required: true,
                  ),

                  if let Some(error) = &login.error {
                      Alert(
                          error.clone(),
                          kind: AlertKind::Error,
                      )
                  },

                  Button(
                      child: Text(
                          if login.signing_in {
                              cx.tr("auth.signing_in")
                          } else {
                              cx.tr("auth.sign_in")
                          }
                      ),
                      disabled: login.signing_in,

                      on_press: effect sign_in(
                          LoginRequest {
                              username: login.username.clone(),
                              password: login.password.clone(),
                          },
                      ) {
                          on_start {
                              login.signing_in = true;
                              login.error = None;
                          }

                          on_ok(response) {
                              login.password.clear();
                              login.signing_in = false;
                              state.session = Some(response.session);
                              cx.effects.navigate("/account");
                          }

                          on_err(error) {
                              login.password.clear();
                              login.signing_in = false;
                              login.error = Some(error);
                          }
                      },
                  ),

                  Link(
                      href: "https://example.com/forgot-password",
                      child: Text(
                          cx.tr("auth.forgot_password")
                      ),
                  ),
              ],
          ),
      ),
  )
}