csrf.php

<?php

class CSRF {

	public function __construct() {
	    if (!isset($_SESSION['csrfToken'])) {
	      	$_SESSION['csrfToken'] = [];
	    }
  	}

	public static function generate() {
		$token = base64_encode(openssl_random_pseudo_bytes(32));
		return $_SESSION["csrfToken"][$token] = $token;
	}

	public static function check($token) {
		if (!empty($_SESSION["csrfToken"][$token]) && $token === $_SESSION["csrfToken"][$token]) {
			if ($_SESSION["csrfToken"][$token]) {
				unset($_SESSION["csrfToken"][$token]);
				return true;
			}
		}
		return false;
	}

}

?>