soatok / cupcake

PHP library for simply secure HTML forms (generation and processing). Secure-by-default.

Sweet and fast form processing for PHP projects.

Requires PHP 8 or newer.

Installation

Use Composer to install this library:

composer require soatok/cupcake

To learn how to use Cupcake, please see the Documentation online.

Questions and Answers

Why "Cupcake"?

Wordplay! The German word for a cupcake mold is förmchen.

What Does Cupcake Do That Other Form Libraries Don't?

Three things: Security, simplicity, and ease-of-use.

First, I designed Cupcake with security as its first principle.

This doesn't just mean the bare basics like preventing cross-site scripting vulnerabilities and cross-site request forgery. Secure form processing means ensuring that input validation isn't only performed client-side. To that end, Cupcake uses Ionizer for input filtering.

Second, Cupcake's interface is deliberately simple and intuitive. Piece o' cake!

Finally, Cupcake is easy to integrate with other platforms and frameworks, by design. Cupcake has minimal dependencies and is unlikely to conflict with your existing framework dependencies or explode the code size to an unreasonable level.

(In the future, I will also provide shims for popular frameworks and ORMs.)

How Do I Use Cupcake?

See the Documentation directory.

If the documentation isn't helpful, please file an issue on Github.

What's With the Cupcake Mascot?

Their name is Neophyte! (They/them pronouns.)

Neophyte is a character owned by Soatok (the creator of Cupcake) to represent people who read his blog or use his open source software.

Is Cupcake a Furry Project?

The author, Soatok, is a furry. The mascot is a protogen (a fictitious species created within the furry fandom, for the furry fandom to enjoy).

You can learn more about the Furry Fandom here.

Is Cupcake API-Stable?

No, not until version 1.0.0 has been tagged.

cupcake's Issues

Built-in CSRF Prevention

This is obvious. We should do it by default.

Static constructors

https://old.reddit.com/r/PHP/comments/vski22/introducing_cupcake_secure_form_handling_library/if3j5ge/

getChildById() does not work for SelectTag etc.

As getChildById() checks only for instanceof Element, elements of type Container cannot be found. In my use case, I create the form with empty selects to populate them later from DB. I will have to implement my own finder for this.

Integrate with Ionizer

What's the point of generating classes dynamically if we don't do anything to ensure the input is correct?

IDs with underline

Having field IDs with an underline gives me strange results:

group_order => group_order

Is this by design?

Add more methods to each form element type

We should support the entire HTML5 specification.

https://developer.mozilla.org/en-US/docs/Web/HTML/Element/form#see_also

Write the Documentation

I need to finish this before I tag the first release.

Presentation

I just stumbled across your new library and like the humor. :) Good work so far!
Are you going to implement some kind of "presentation layer"? What I mean is: A user can choose a "flavor" like "Bootstrap" or similar and the lib just adds the appropriate class names to the elements. I know that this is not much fun, but I think it would help to create good looking forms with nearly no effort.

Edit: I think the "flavor" would / should / could make use of already existing methods like $x->setBeforeEach('<div class="form-row">')

You could also name it "topping" so it makes more sense if the user calls it at the end of the form creation. :D