diff --git a/src/functions.php b/src/functions.php
new file mode 100644
index 0000000..0a0f180
--- /dev/null
+++ b/src/functions.php
@@ -0,0 +1,40 @@
+<?php
+require_once __DIR__ . '/session.php';
+function esc(string $str): string {
+    return htmlspecialchars($str, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
+}
+function isLogged(): bool {
+    start_secure_session();
+    return !empty($_SESSION['user_id']);
+}
+function requireLogin(): void {
+    start_secure_session();
+    if (empty($_SESSION['user_id'])) {
+        header('Location: /public/login.php');
+        exit;
+    }
+}
+function csrf_token(): string {
+    start_secure_session();
+    if (empty($_SESSION['csrf_token'])) {
+        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
+    }
+    return $_SESSION['csrf_token'];
+}
+function verify_csrf($token): bool {
+    start_secure_session();
+    return isset($_SESSION['csrf_token']) && hash_equals($_SESSION['csrf_token'], (string)$token);
+}
+function flash_set(string $key, string $msg): void {
+    start_secure_session();
+    $_SESSION['flash'][$key] = $msg;
+}
+function flash_get(string $key): ?string {
+    start_secure_session();
+    if (!empty($_SESSION['flash'][$key])) {
+        $m = $_SESSION['flash'][$key];
+        unset($_SESSION['flash'][$key]);
+        return $m;
+    }
+    return null;
+}