The Standard Framework

Every site on the open internet needs the same parts before it can do anything useful: validated input, a safe database layer, encryption, rate limiting, CAPTCHA and logging. They are dull to write, costly to get wrong, and the first place an attacker looks. The usual choices are to write them yourself and maintain them indefinitely, or to pull in packages and rely on upstream maintainers who may or may not patch a flaw when it matters to you.

This is the third choice. We run every one of our own sites on the framework, and every client site we manage, so keeping it maintained is not optional for us: a flaw in it is a flaw in our own business. Each fix we make for ourselves reaches every licensee with current maintenance in the same update, so you get the benefit without carrying the cost.

There is no third-party code in it: no Composer packages, no upstream maintainers, and so no dependency for a supply-chain attack to arrive through. We wrote all of it, we own all of it, and we maintain all of it.

When a flaw is published in a widely used open-source package, attackers can fingerprint every site running the vulnerable version and attack them at scale, often before a fix is released or applied. You will not find this code on GitHub or in any public registry, and licensees are bound to keep it confidential, so there is no public copy to search for flaws and no published exploit to automate. That makes an attack far less likely, but we do not rely on it: we constantly monitor and adjust for evolving threats, to keep our own sites safe and those of our clients.

The core library: nearly 90 functions in a single file, with nothing else to install and no framework to learn. It is plain procedural PHP, so it goes into a new system or an existing one equally well.

Input

filterGET() and filterPOST() check every request value against one of nearly 30 declared types, from INT and UUID to EMAIL, URL and STRONGPASSWORD, and cap its length, before the application sees it.

Database

getSQLRow(), getSQLRows(), execSQLID(), execSQLUpdate() and the rest: one layer for every query, so the database underneath can change without touching the application. execSQLUpdate() checks each value against its column before writing it, and on a live site a failed query returns false rather than taking the page down.

Security

encrypt(), decrypt(), package() and depackage(), using AES-256 with HMAC-SHA256 integrity checks. rateLimit() by address and action. Sessions that refuse any identifier the server did not issue.

CAPTCHA

captchaimage() and createDiceCaptcha(), drawn on your own server, with no third-party service watching your visitors.

Validation

validateEmail(), which also checks the domain accepts mail, checkUKTelephone(), validateIP(), isValidHostname(), validateAndSanitiseURL(), validateDateTime().

Time

utc2local() and local2utc(): stored in UTC, shown in local time, BST and GMT handled.

Output

MDtoStyledHTML() turns Markdown into a complete styled HTML email. HTMLtoTEXT(), ANSI2HTML(), str_putcsv(), converttoYAML().

Diagnostics

logit(), dumpAllVars(), HexDump().

Single sign-on and multi-factor authentication, packaged as one file you drop into a site. Users sign in once against a central authentication service and are recognised on every site that uses it, and none of those sites ever stores a password.

Sign-in

In two stages: the username first, to learn whether the account needs a code, then the password and, where it is enabled, a six-digit TOTP code. A token is issued only when both pass.

Sessions

A rolling idle window, 60 minutes by default and up to 8 hours, inside an absolute limit fixed at sign-in, 8 hours by default and up to a week for screens that must stay signed in, such as a monitor.

Tokens

Replaced on renewal when asked, and always for long-lived sessions, so a copied token lasts one window at most. Signing out ends the session centrally, at once.

Pages

genSsoRequireLogin() at the top of a page protects it: it renews the session as the user works and sends them to sign in once it has expired.

Identity

genSsoWho() returns the user's organisation and contact details from the central record, so every site works from the same directory.

Setup

An add-on to standard.php, which it needs in order to work. We set it up with your authentication backend.

The library file is the same in every installation. Everything particular to your site, its settings and any functions of your own, goes in standard-site.php, which the library loads for that purpose. An update is therefore a straight replacement of one file, with nothing to merge and nothing of yours to lose.

Updates

Each update is announced to your technical contacts by email, and marked where it is a security update. On sites we manage, we apply them ourselves.

Code

Procedural PHP with short, consistent names. No classes to extend and no container to configure, so a new developer has nothing to learn beyond the functions themselves, and a developer who knows one of our systems can find their way around any of them.

Tools

The function reference and documentation comments may be read by your editor and AI coding tools, so autocompletion and parameter hints work as you would expect.

Both libraries are licensed to your own developers under the Standard Library License. You pay once for a permanent licence and yearly for updates, or, on sites we manage for you, a yearly rental that includes updates. Prices are per organisation, however many sites you run, and exclude VAT.

Standard

standard.php, the core library: £2,500 for a perpetual licence, then £500 a year for updates, with the first year included. On sites we manage, £480 a year.

Standard SSO

standard-sso.php, single sign-on and MFA. An add-on to Standard, which it needs in order to work: £1,500 for a perpetual licence, then £250 a year for updates, with the first year included. On sites we manage, £250 a year. Either way, we set it up with your authentication backend.

If you want to build on the framework yourself, or have us build on it for you, tell us about it.