bustelo/mampara

PHP form security layer. Filters what reaches your code before your code knows it existed.

dev-main 2026-03-18 20:34 UTC

Requires

• php: >=8.0

Suggests

• ext-apcu: Required for atomic rate limiting
• ext-intl: Required for NFKD Unicode normalization

MIT

• Santiago Bustelo

• php
• security
• Forms
• spam
• captcha
• csrf
• antispam
• waf

README

A security layer for PHP forms. Filters what reaches your code before your code knows it existed.

Not a "SuperCerberus". Mampara stops the automated noise — the 99% of bots trying random doors. A determined attacker who downloaded this code and has time to spare will eventually get through. That's honest.

Status

v3.0 — under active development. Not production-ready yet.

What it does

• CSRF protection
• Rate limiting (IP + field value)
• Honeypot traps
• Unicode normalization (fancy fonts, fullwidth, combining diacritics)
• Progressive challenge (math obfuscated, Altcha PoW)
• Structured logging
• Clean $_POST passthrough for legacy code

What it doesn't do

• SQL injection escaping (do that at the driver level)
• XSS in output (do that in your template engine)
• Post-authentication security
• Server-level hardening (HTTPS, HTTP headers)

Installation

composer require bustelo/mampara

Full docs coming with v3.0 stable.