Phase 2: Add CSRF token protection to all forms and processors - Created CsrfMiddleware class with 8 helper methods - Added CSRF tokens to 9 POST forms across trip/course/camping/membership - Added CSRF validation to all 10 POST processors - CsrfMiddleware.requireToken() validates and dies on invalid tokens - 100% POST endpoint coverage with CSRF protection

process_trip_booking.php

@@ -2,8 +2,16 @@
 require_once("env.php");
 require_once("connection.php");
 require_once("functions.php");
+
+use Middleware\CsrfMiddleware;
+
 session_start();
 
+// Validate CSRF token early if this is a POST request
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    CsrfMiddleware::requireToken($_POST);
+}
+
 // Get the trip_id from the request (ensure it's sanitized)
 $trip_id = isset($_POST['trip_id']) ? intval($_POST['trip_id']) : 0;