move_detect/cloud/src/View/login.php

<?php
require __DIR__ . '/layout.php';

// CSRF token: persisted in the PHP session (already started by PhpSessionStore
// before rendering) so a future controller-side check can validate it.
if (empty($_SESSION['csrf'])) {
    $_SESSION['csrf'] = bin2hex(random_bytes(32));
}
$csrf = $_SESSION['csrf'];

render_header('로그인');
?>
<form method="post" action="<?= view_url('/login') ?>" class="login-form">
  <h1>로그인</h1>
  <input type="hidden" name="csrf" value="<?= view_e($csrf) ?>">
  <label for="username">아이디</label>
  <input type="text" id="username" name="username" autocomplete="username" required>
  <label for="password">비밀번호</label>
  <input type="password" id="password" name="password" autocomplete="current-password" required>
  <button type="submit">로그인</button>
  <p id="login-error" class="form-error" role="alert" hidden></p>
</form>
<script src="<?= view_url('/assets/login.js') ?>" defer></script>
<?php
render_footer();