and select your version.
{% endhint %}
## Support Explained
### App Support
If the Saturn application will run on this version.
Whilst Saturn supports these versions, we may not provide technical support if something goes wrong, check the tables below. We recommend you [Update your Server](/1.0.0/guide/update-your-server) to the latest version.
### Tech Support
If we'll provide you with technical support for issues and bugs if you're running this version. Typically, we'll provide support until the specified language or software removes their Security Support.
Whilst we do support these versions, we recommend you [Update your Server](/1.0.0/guide/update-your-server) to the latest version.
## PHP
{% hint style="danger" %}
**Do not use PHP 7 or any releases earlier.**
{% endhint %}
| PHP Version | App Support | Tech Support |
|---|
| 8.2 (Recommended) | ✅ | ✅ |
| 8.1 | ✅ | ✅ |
| 8.0 | ✅ | ✅ |
| 7.x | ❌ | ❌ |
| 5.x | ❌ | ❌ |
| 4.x | ❌ | ❌ |
| 3.x | ❌ | ❌ |
### PHP Extensions
Saturn requires the following PHP extensions to be installed:
* None at this time.
## MySQL
{% hint style="danger" %}
**Do not use MySQL 5.7 or any releases earlier.**
{% endhint %}
| MySQL Version | App Support | Tech Support |
|---|
| 8.1 (Recommended) | ✅ | ✅ |
| 8.0 | ✅ | ✅ |
| 5.7 | ❓ | ❌ |
| 5.6 | ❓ | ❌ |
| 5.5 | ❓ | ❌ |
## MariaDB
{% hint style="danger" %}
**Do not use MariaDB 10.3 or any releases earlier.**
{% endhint %}
| MariaDB Version | App Support | Tech Support |
|---|
| 11.1 (Recommended) | ✅ | ✅ |
| 11.0 | ✅ | ✅ |
| 10.11 (LTS) | ✅ | ✅ |
| 10.10 | ✅ | ❌ |
| 10.9 | ✅ | ❌ |
| 10.8 | ✅ | ❌ |
| 10.7 | ✅ | ❌ |
| 10.6 (LTS) | ✅ | ✅ |
| 10.5 | ✅ | ✅ |
| 10.4 | ✅ | ✅ |
| 10.3 or earlier | ❓ | ❌ |
# Update your Server
{% hint style="info" %}
You'll need access to your server's system to be able to update it.
{% endhint %}
## PHP
\
Updating your PHP version makes Saturn faster, more secure, and more reliable.
Check [System Requirements and Support](/1.0.0/guide/system-requirements-and-support) for information on which PHP versions Saturn currently supports.
### Why update PHP?
#### Security
PHP is constantly releasing security updates due to its popularity making it a target for hackers. You should ensure that you have an updated version of PHP because it will include security updates that older versions do not.
#### Performance and Reliability
PHP is releasing updates to its interpreter and JIT compiler to make it faster with each release, PHP 8.x is much faster than 7.x, and so on. This won't only benefit you, but your visitors as well.
Bug fixes come out with every PHP version as well, so having these bugs fixed can be a massive benefit. This will make your website more reliable and less likely to bug out in ways we can't resolve ourselves.
Where possible, we'll avoid using functions that include bugs in previous versions of PHP, but if we don't support that PHP version we quite likely will use a buggy function if it's been fixed in versions that we do support.
#### SEO and visitor retention
Visitors are more likely to stay on websites that load quickly and without issues, and search engines like this too! Faster loading websites are ranked higher in search engines like Google.
### How to check your PHP version.
You'll be alerted on your dashboard if your version of PHP is not supported, and you'll no longer be able to update to verisons of Saturn that don't support your version of PHP.
You can check compatability in the Control Panel.
### As always, backup!
You should **always** backup your website before you update your server, this goes for Saturn updates as well! It's extremely important just incase something goes wrong.
You should also update Saturn first if it's possible to do so. We'll always support more than one PHP version, so don't worry about getting stuck.
### I can't update my PHP version, what do I do?
Get in touch with your hosting provider, they should be able to help you do this.
# Errors
# Database Errors
## DBMS-1
The database system you've selected in your settings is not an accepted format that Saturn's Database Management System can understand. You'll need to change it to one of the accepted types:
| Type | Description | Minimum Version |
| ------------------- | ----------------------- | --------------- |
| `MySQLi` or `MySQL` | MySQLi Database System | Saturn 1.0.0 |
| `PDO` | PHP Data Objects System | Saturn 1.0.0 |
You can't use Saturn when this error message appears, and your website will refuse to load. You must edit the settings file using a file manager. To edit it navigate to your settings file (It's the Settings.php file in the Settings folder) and change `DB_TYPE` to one of the accepted values.
{% hint style="warning" %}
You'll need to [reset your settings file checksum](/1.0.0/troubleshooting/errors/checksum-issues#reset-your-settings-file-checksum) to stop the checksum error message from showing.
{% endhint %}
## DBMS-2
The requested action does not exist. Please check that the action is one of the accepted actions, [to see a full list please click here](/1.0.0/dev/libraries-and-functions/databasemanager#actions).
## DBMS-3
No result was gathered.
## DBMS-4
An unexpected error occured whilst executing the database query.
# Saturn Errors
## SAT-1
**Unknown Website Environment**
This is an issue with your settings file, please go into your settings file and change the `WEBSITE_ENV` value to `1`.
{% hint style="warning" %}
You'll need to [reset your settings file checksum](/1.0.0/troubleshooting/errors/checksum-issues#reset-your-settings-file-checksum) to stop the checksum error message from showing.
{% endhint %}
## SAT-2
**Unable to load plugin**
Saturn was unable to load the plugin because the manifest file is missing.
## SAT-3
**Language file missing.**
Your language file is missing, you'll need to re-download it from our GitHub and put it in your /Assets/Languages folder.
## SAT-4
**Function not found.**
Saturn attempted to use a function but couldn't find it, this may be because you haven't enabled a PHP extension that it needs, or that it's not included in the plugin.
The error description will include a list of functions that it attempted to use, but couldn't find. You should ensure these functions are enabled if they're in PHP extensions.
## SAT-5
**Operation not supported.**
An operation that was requested is not supported by the function trying to run it.
The error description will include a list of accepted operations, please change the requested operation to one of these.
## SAT-6
**Error Resetting Checksums**
There was a problem whilst resetting the checksums. Please try again, or manually reset them.
## SAT-7
**File is not writeable**
Saturn does not have the required permissions to write to this file (see chmod command if you're on Linux).
# Checksum Issues
## Reset your settings file checksum
To reset your settings files checksum, log into the Saturn panel at yourwebsite.com/account, navigate to settings, and click the 'reset checksum' button that appears in the red banner.
You should only reset the checksum if you've modified the settings manually yourself, if you have not edited it then the file could have been edited by someone else, always check if you're unsure.
# Plugins in Saturn
## Official Plugins
These are developed, maintained, and supported by the developers of Saturn. These plugins are bundled with your Saturn installation, you don't need to download them unless you've previously removed them.
{% content-ref url="/pages/o4PZaGcDomncp0k2yIKm" %}
[Official Plugins](/1.0.0/plugins/official-plugins)
{% endcontent-ref %}
## Marketplace Plugins
Marketplace plugins are developed by the Saturn community. You can download them from the [Saturn Marketplace](https://marketplace.saturncms.net).
{% content-ref url="/pages/XbUfK2v9E1kRGYuPvUne" %}
[Marketplace Plugins](/1.0.0/plugins/marketplace-plugins)
{% endcontent-ref %}
# Official Plugins
# Control Panel
The Control Panel plugin was developed by the Saturn Team to allow you to manage your website in a graphical user interface.
{% content-ref url="/pages/5sWejHyZsUy3DhaJdeCn" %}
[User Guide](/1.0.0/plugins/official-plugins/control-panel/user-guide)
{% endcontent-ref %}
{% content-ref url="/pages/G5QN9YIsHmcGaV8wZe2u" %}
[Developer Guide](/1.0.0/plugins/official-plugins/control-panel/developer-guide)
{% endcontent-ref %}
# User Guide
# Developer Guide
# Control Panel Hooks
{% hint style="warning" %}
**Before using these hooks, check the Control Panel plugin is installed.**
The hooks will never run if it's not installed. Learn more here: [Checking for Dependencies](/1.0.0/dev/plugins/checking-for-dependencies)
{% endhint %}
| Action | Execution Time |
| ---------------------------------- | ----------------------------------------------------------------------- |
| ControlPanel.Start | Before the Control Panel's script execution. |
| ControlPanel.End | At the end of the Control Panel's script execution. |
| ControlPanel.DashboardContentStart | Before the dashboard's main content (just below the 'Dashboard' title). |
| ControlPanel.DashboardContentEnd | After the dashboard's main content. |
| ControlPanel.NewPageStart | Before the new page screen's main content. |
| ControlPanel.NewPageEnd | After the new page screen's main content. |
| ControlPanel.PluginListStart | Before the plugin list (/panel/plugins). |
| ControlPanel.PluginListEnd | After the plugin list (/panel/plugins). |
| ControlPanel.PluginsPageStart | Before the plugin page's main content (/panel/plugins/PLUGIN) |
| ControlPanel.PluginsPageEnd | After the plugin page's main content (/panel/plugins/PLUGIN) |
| ControlPanel.UsersListStart | Before the user list (/panel/users). |
| ControlPanel.UsersListEnd | After the user list (/panel/users). |
| ControlPanel.UsersPageStart | Before the user page's main content (/panel/users/USER) |
| ControlPanel.UsersPageEnd | After the user page's main content (/panel/users/USER) |
# Marketplace Plugins
Marketplace plugins are developed by the Saturn community. You can download them from the [Saturn Marketplace](https://marketplace.saturncms.net).
# Getting Started
## Libraries and Functions
Saturn provides a number of libraries and functions that are there to help you create better plugins easier and more quickly. They allow you to remove the programming of common tasks from your workflow, you can find an overview of them by clicking the link below.
{% content-ref url="/pages/4sua9kpfhmsQB0oFEaUh" %}
[Libraries and Functions](/1.0.0/dev/libraries-and-functions)
{% endcontent-ref %}
## Understanding the Autoloader
Saturn will automatically load all the required libraries, functions, and plugins to run correctly.
Most files in Saturn's Processes directory is automatically loaded, so no need to require them in PHP. The only files that are not autoloaded are the login, logout, and join scripts.
## Getting started with plugins
{% content-ref url="/pages/vQmiDJDc4Clj3Mh3t7xQ" %}
[Plugins](/1.0.0/dev/plugins)
{% endcontent-ref %}
## Technical Documentation
Saturn has PHPDocs available online. This documentation lists every function, class, and variable that Saturn uses and may be useful for more technical users. Whilst this website is useful for showing how to implement these functions, the PHPDocs may be useful if you wish to use functions in your project.
Access the PHPDocs here:
# Libraries and Functions
# AccountManager
# Permissions
Saturn has a built-in permissions system, it's designed to work with the Control Panel plugin, but will work for any other control-panel-esque as well.
### Check if the user has a certain permission.
```php
use Saturn\AccountManager\Permissions;
$Permissions = new Permissions($_SESSION['uuid']);
if ($Permissions->HasPermission(['administrator','panel_access'],'OR')) {
// User is an administrator, or has the panel_access permission.
} else {
// User is not an administrator.
// They also don't have the panel_access permission.
}
```
### Fetch a list of the user's permissions.
```php
use Saturn\AccountManager\Permissions;
$Permissions = new Permissions($_SESSION['uuid']);
// All the user's permissions in JSON object format.
$UserPermissions = $Permissions->Permissions;
```
# UUID
Unique User IDs (UUIDs) are strings used to identify users in Saturn's database. It's recommended to use UUIDs instead of row IDs as some tables don't use the row ID as the user ID, and it's good practice for security.
## Generate a UUID
Saturn has built-in functions for generating UUIDs.
```php
use Saturn\AccountManager\UUID;
$UUID = new UUID();
// The newly generated UUID is now in the $UniqID variable.
$UniqID = $UUID->Generate();
```
# DatabaseManager
{% hint style="info" %}
**It is recommended to use DBMS.**
DBMS automatically uses the driver the website administrator has selected as their preferred option.
{% endhint %}
## Database Management System (DBMS)
DBMS is the main library used to communicate with Saturn's database.
{% content-ref url="/pages/M4dm3NoAlP1qE22ZJ65t" %}
[DBMS](/1.0.0/dev/libraries-and-functions/databasemanager/dbms)
{% endcontent-ref %}
##
## Get error
You can check for an error with your query by using the `error()` function in DBMS.
If there is an error a string with the error code will be returned. If there is no error this will return `NULL`
# DBMS
# Sending Database Requests
## Database Actions
A database action defines what format the function should return the data it retrieves from the database in. For more information on Database Actions please see the actions page.
{% content-ref url="/pages/xW1Okpr97rdgHybL1iMJ" %}
[Database Actions](/1.0.0/dev/libraries-and-functions/databasemanager/database-actions)
{% endcontent-ref %}
## Select
The Select() function allows you to select information from the database.
```php
Select(string $what, string $from, string|null $where, string $action, string|null $order = null, string|null $limit = null)
```
### Parameters
| Parameter | Type | Description | Example |
| --------- | ------------------------- | -------------------------------------------------------------------------- | ----------------------- |
| $what | string | What it should select. | id |
| $from | string | The database table (don't include the prefix, it does this automatically). | pages |
| $where | string or null | Any conditions you require. | \`content\` IS NOT NULL |
| $action | string | What it should do with the data. | all:assoc |
| $order | string or null (optional) | Any specific order you'd like the data in. | \`url\` DESC |
| $limit | string or null (optional) | Limit the amount of data being returned. | 100 |
### Example: Selecting the logged in user.
```php
use Saturn\DatabaseManager\DBMS;
$DB = new DBMS();
// Returns the first value as a JSON object.
$DB->Select('*', 'user', 'uuid = '.$_SESSION['uuid'], 'first:object');
```
## Insert
The Select() function allows you to insert information into the database.
```php
Insert(string $into, string $columns, string $values);
```
### Parameters
| Parameter | Type | Description | Example |
| --------- | ------ | -------------------------------------------------------------------------- | ----------------------- |
| $into | string | The database table (don't include the prefix, it does this automatically). | id |
| $columns | string | The columns to insert data into. | pages |
| $values | string | The data to insert. | \`content\` IS NOT NULL |
### Example: Creating a new page.
```php
use Saturn\DatabaseManager\DBMS;
$DB = new DBMS();
$DB->Insert("pages", "`id`,`url`,`title`,`content`", "NULL, '/test', 'Test page', 'This is a test page.'");
```
# Query Information
## Row count
You can get the row count for your last query by using the `RowCount()` function in DBMS. This will return the row count for the previous query.
```php
use Saturn\DatabaseManager\DBMS;
$DB = new DBMS();
// Some query here
$DB->RowCount();
```
## Query errors
You can find errors for the previously sent query by using the `Error()` function.
```php
use Saturn\DatabaseManager\DBMS;
$DB = new DBMS();
// Some query here
$DB->Error(); // Returns any query errors
```
# Database Security
{% hint style="danger" %}
**Saturn does not automatically escape strings.**
You must ensure you perform this step before passing data into a query.
{% endhint %}
It's important to escape strings before you pass them into the database, as DBMS does not do this automatically.
```php
use Saturn\DatabaseManager\DBMS;
$DB = new DBMS();
$Data = $DB->Escape($Data);
// Now safe to perform a query with the data.
```
# Database Actions
A database action defines what format the function should return the data it retrieves from the database in.
| Action | Description |
| -------------- | ------------------------------------------- |
| `all:assoc` | Fetches all rows as an associative array. |
| `all:num` | Fetches all rows as a numerical array. |
| `first:assoc` | Fetches the first row as an array |
| `first:num` | Fetches the first row as a numerical array. |
| `first:object` | Fetches the first row as a JSON Object |
| `raw` | Returns the raw result with no processing. |
##
# HookManager
# Actions
Actions are a part of the [Hooks](/1.0.0/dev/hooks) system. They provide a way to running your functions at a predefined point during the execution of Saturn's systems.
You can also create custom actions that allow you to use the system to execute hooks within your plugins.
Actions don't return anything back to the action hook. To do that you'll need to use Runners.
If you're unsure which type of hook to use, [please see this section, describing the difference between actions and runners](/1.0.0/dev/hooks#the-difference-between-actions-and-runners).
## Register an Action
To register an Action you need to use the Actions system.
Please see the below sections for examples specific to different implementations of your code.
The 'Parameters' parameter is optional.
### Specification
#### Parameters needed
```php
Register(string $Callback, string|array $Function, array|null $Parameters);
```
#### Parameters not needed
```php
Register(string $ActionCode, string|array $Function);
```
### Object-oriented functions
{% hint style="danger" %}
**This will generate a new instance of the class**
That means any variables defined in your class won't carry over, you should declare them globally or pass them in if you need them.
{% endhint %}
```php
use Saturn\HookManager\Actions;
$Actions = new Actions();
$Actions->Register('ActionCode', array(new ExampleClass(),'ExampleFunction'), array($Parameters));
```
### Static functions
```php
use Saturn\HookManager\Actions;
$Actions = new Actions();
$Actions->Register('ActionCode', '\Namespace\Class::Function', array($Parameters));
```
## Unregister an Action
You can unregister actions that you no longer need to run, this is useful if you only want to complete an action once when it may run multiple times.
Please see the below sections for examples specific to different implementations of your code.
The 'Parameters' parameter is optional.
### Specification
#### Parameters needed
```php
Unregister(string $ActionCode, string|array $Function);
```
### Object-oriented functions
{% hint style="danger" %}
**This will generate a new instance of the class**
That means any variables defined in your class won't carry over, you should declare them globally or pass them in if you need them.
{% endhint %}
```php
use Saturn\HookManager\Actions;
$Actions = new Actions();
$Actions->Unregister('ActionCode', array(new ExampleClass(),'ExampleFunction'));
```
### Static functions
```php
use Saturn\HookManager\Actions;
$Actions = new Actions();
$Actions->Unregister('ActionCode', '\Namespace\Class::Function');
```
## Run an Action
You can also run actions yourself, this is useful if you're creating [Custom Actions](#custom-actions).
use Saturn\HookManager\Actions;
$Actions = new Actions();
$Actions->Run('ActionCode');
## List of Action Codes
### Core
| Action | Execution Time |
| ---------------- | ----------------------------------------------------------------- |
| Saturn.PostStart | After Saturn starts up all core systems except router. |
| Saturn.End | Executes after everything else, or just before exit; is executed. |
### Plugin Manager
| Action | Execution Time |
| ----------------------------- | ------------------------------------ |
| Saturn.PluginManager.PostLoad | After Saturn has loaded all plugins. |
### Control Panel Plugin
If you're using the Control Panel plugin, there's loads of actions for that as well!
{% content-ref url="/pages/X4BnId3XKqkMH6Uru8ub" %}
[Control Panel Hooks](/1.0.0/plugins/official-plugins/control-panel/developer-guide/control-panel-hooks)
{% endcontent-ref %}
## Custom Actions
To create a custom Action Code, you just need to enter an action name that doesn't already exist into the callback parameter.
We recommend using a prefix related to your plugin. For example: `MyPlugin.ActionName`. This keeps your actions distinguished from others and avoids conflicts.
# Runners
# HTTP
## Routing
Routing allows you to create custom pages in Saturn.
```php
use Saturn\HTTPManager\Router;
$Router = new Router();
//GET
$Router->GET('/myroute', '/Plugins/MyPlugin/MyFile.php');
// POST
$Router->POST('/myformpost', '/Plugins/MyPlugin/MyFile.php');
```
## Response
Response allows you to quickly and easily send HTTP responses in PHP. The functions modify the headers sent by PHP then terminate the script.
```php
use Saturn\HTTPManager\Response;
$Response = new Response();
// Send HTTP 500
$Response->HTTP500();
// Send HTTP 405
$Response->HTTP405();
// Send HTTP 404
$Response->HTTP404();
// Send HTTP 403
$Response->HTTP403();
```
# LanguageManager
## Custom Translations
Custom Translations are useful for if you'd like your plugin to be available in multiple languages.
### Example: English and French
In this example, we'll support English and French. You can of course create as many language files as you'd like.
By default, users will only be able to see in languages that are supported by Saturn, but you could create your own settings file that supports more languages if you'd like.
{% code title="en-gb.json" %}
```json
{
"Hello": "Hello",
"ControlPanel": "Control Panel"
}
```
{% endcode %}
{% code title="fr.json" %}
```json
{
"Hello": "Bonjour",
"ControlPanel": "Panneau de commande"
}
```
{% endcode %}
{% code title="index.php" %}
```php
...
$Translate('ControlPanel'); ?>
$Translate('Hello'); ?>
...
```
{% endcode %}
# PluginManager
## Checking if a specific plugin is loaded.
{% hint style="info" %}
If your plugin depends on another plugin, you should put this in your Manifest.
{% endhint %}
This function will check if the requested plugin has been loaded by Saturn. It will return a true/false boolean result.
use Saturn\PluginManager\PluginLoader;
$PluginLoader = new PluginLoader();
if ($PluginLoader->PluginLoaded('ControlPanel')) {
// The plugin is installed! It's safe to do stuff with it now.
} else {
// The plugin is not installed :(
}
## Get a plugin's manifest file.
```php
use Saturn\PluginManager\PluginManifest;
$PluginManifest = new PluginManifest();
// The manifest will be returned to this variable as a JSON object.
$Manifest = $PluginManifest->GetManifest('ControlPanel');
```
# Manage Plugin Content
ContentManager allows you to manage downloaded plugin content.
## Uninstall Plugins
Use the `$ContentManager->Delete($Slug)` function to uninstall plugins. Pass the plugins slug (unique ID) into the function. It will return true/false depending on success.
```php
use Saturn\PluginManager\ContentManager;
$ContentManager = new ContentManager();
if ($ContentManager->Delete($Slug)) {
// The plugin was uninstalled
} else {
// Something went wrong
}
```
# Plugin Compatability
You can check plugins for potential compatabilitity issues by using this library.
## Check for unloading issues
These compatability issues will cause Saturn to unload the plugin, as it has a high chance to cause errors and crashes. This is done automatically when the plugin is loaded.
This function takes the plugin's manifest file. You can learn how to get this in [Fetch Manifest](/1.0.0/dev/libraries-and-functions/pluginmanager/fetch-manifest).
```php
use Saturn\PluginManager\PluginCompatability;
$Compatability = new PluginCompatability($Manifest);
$Compatability->Check();
```
The function returns an array, it will look like this if the plugin is compatible:
```json
['Compatible' => true, 'Reason' => '']
```
Or this if it's not:
```json
['Compatible' => false, 'Reason' => 'Not compatible with this version of Saturn.']
```
## Check version compatibility
You can also check if the plugin is compatible with the website's version of Saturn. This is done automatically when the plugin is loaded.
```php
use Saturn\PluginManager\PluginCompatability;
$Compatability = new PluginCompatability($Manifest);
$Compatability->CheckVersion();
```
This function returns true/false (true = compatible / version matches).
## Check duplicate compatibility
You can also check if the plugin is unique, and doesn't have any duplicates. This is done automatically when the plugin is loaded.
```php
use Saturn\PluginManager\PluginCompatability;
$Compatability = new PluginCompatability($Manifest);
$Compatability->CheckUnique();
```
This function returns true/false. (true = compatible / unique plugin)
## Check conflicts compatibility
You can also check if the plugin could conflict with other plugins, and if the conflicts are installed.
```php
use Saturn\PluginManager\PluginCompatability;
$Compatability = new PluginCompatability($Manifest);
$Compatability->CheckConflicts();
```
This function returns true/false. (true = compatible / no conflicts)
# Check if a plugin is loaded.
This feature checks if a plugin is loaded, it's useful for [Checking for Dependencies](/1.0.0/dev/plugins/checking-for-dependencies).
```php
use Saturn\PluginManager\PluginLoader;
$Loader = new PluginLoader();
$IsLoaded = $Loader->PluginLoaded('PluginName');
// returns true/false
```
# Fetch Manifest
# RouteManager
This library creates Saturn Core's routes. To create your own routes please use HTTP.
{% content-ref url="/pages/yvhLXIngRxZLK1QqpbrF" %}
[HTTP](/1.0.0/dev/libraries-and-functions/http)
{% endcontent-ref %}
# SecurityManager
# Cross-site Request Forgery
## About CSRF Attacks
> Cross-site Request Forgery (CSRF) is a type of malicious exploit of a web application where unauthorized commands are submitted from a user that the the web application trusts.
>
> *Wikipedia (*[*https://en.wikipedia.org/wiki/Cross-site\_request\_forgery*](https://en.wikipedia.org/wiki/Cross-site_request_forgery)*)*
This type of attack is not limited to Saturn, but it is possible unless steps are taken to prevent it.
## Preventing CSRF Attacks
{% code title="form.php" %}
```php
Login form
```
{% endcode %}
{% code title="login.php" %}
```php
use Saturn\SecurityManager\CSRF
$CSRF = new CSRF();
if ($CSRF->Check()) {
// It's safe to proceed.
} else {
// Possible CSRF attack!
}
```
{% endcode %}
# Cross-site Scripting
> Cross-site scripting (XSS) is a type of security vulnerability that can be found in some web applications. XSS attacks enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy. Cross-site scripting carried out on websites accounted for roughly 84% of all security vulnerabilities documented by Symantec up until 2007.
>
> *Wikipedia (*[*https://en.wikipedia.org/wiki/Cross-site\_scripting*](https://en.wikipedia.org/wiki/Cross-site_scripting)*)*
## Escaping text
{% hint style="warning" %}
**You should not use this function for database queries.**
It is not designed for use with Databases, please use [DatabaseManager](/1.0.0/dev/libraries-and-functions/databasemanager) for escaping Database queries.
{% endhint %}
There are two possible ways to escape text in Saturn, using the XSS library's `Escape()` function, or by using the Saturn Core `Out()` function.
{% code title="XSS Library" %}
```php
use Saturn\SecurityManager\XSS;
$XSS = new XXS();
$XSS->Escape($Data);
```
{% endcode %}
{% code title="Saturn Core" %}
```php
Out($Data);
```
{% endcode %}
The Saturn Core function uses the XSS library's function, so it's often easier to just use `Out()` instead.
# SessionManager
# Start and End Sessions
# Validate Sessions
## Validate Sessions
You can check that users are genuine by validating sessions.
```php
use Saturn\SessionManager\Authenticate;
$Authenticate = new Authenticate();
if ($Authenticate->Validate()) {
// Valid session
} else {
// Invalid session
}
```
## Generate User Sessions
This function can be used to securely generate session tokens and store the user's username and UUID in session variables.
**This does not check their credentials against the database, you MUST use the database system to do this.**
```php
use Saturn\SessionManager\Authenticate;
$Authenticate = new Authenticate();
$Authenticate->Generate($Username, $UUID)
```
### Accessing session data
Sesssion data can be accessed like any usual session.
```php
$Username = $_SESSION['Username'];
$UUID = $_SESSION['UUID'];
$Token = $_SESSION['Token'];
```
# Session Data
| Variable | Type | Description |
| -------- | ------ | ---------------------------------- |
| Username | string | The user's username. |
| UUID | string | The user's unique user identifier. |
| Token | string | The session security token. |
# TestManager
## Timings
Timings checks how long a specific task takes, you can use it like this:
```php
use Saturn\TestManager\Timings;
$Timings = new Timings();
$Timings->Start(); // Starts the timer
// Your task here...
$TimeTaken = $Timings->End(); // Outputs time taken
```
## Profiler
Profiler tells you how many system resources you're currently using.
```php
use Saturn\TestManager\Profiler;
$Profiler = new Profiler();
$Usage = $Profiler->ResourceUsage(); // Returns resource usage
var_dump($Usage['memory']['current']); // Outputs current memory usage.
var_dump($Usage['memory']['peak']); // Outputs peak memory usage.
var_dump($Usage['cpu']); // Outputs CPU usage.
```
# Security
### out() function.
{% hint style="warning" %}
**You should not use this function for database queries.**
It is not designed for use with Databases, please use [DatabaseManager](/1.0.0/dev/libraries-and-functions/databasemanager) for escaping Database queries.
{% endhint %}
The out() function is supplied by Saturn Core and is designed to escape potentially dangerous characters from strings.
```php
echo out('Hello! ');
```
# Plugins
# How to structure a plugin
## Plugin Folder
Your plugin must be uploaded in a .zip folder, with the manifest directly inside it, you should not place the manifest in any sub-folders.
Because of how Saturn detects and loads plugins, you must have your manifest in the root .zip file. It must not be in any sub-folders, Saturn won't load your plugin.
## manifest.json file
```
PluginSlug.zip
-> manifest.json
```
You can place the code, or anything else in sub-folders as long as you update your manifest to point to the correct file.
For example: If your main file is called main.php and it's in the /code folder. You should set your Startup value to "`code/main.php`"
Learn more about manifests here:
{% content-ref url="/pages/HTgUkip4BX3J5eLRrprO" %}
[Manifest](/1.0.0/dev/plugins/manifest)
{% endcontent-ref %}
## Your code
Your code can be in any number of sub-folders, as long as you link to it. Please see the above section for how to change your manifest.json to point to a sub-folder.
# Manifest
The manifest file contains information that Saturn needs to load the plugin, all manifest attributes must exist or the plugin will not be loaded.
Here's an example of a plugin manifest.json file:
{% code title="manifest.json" %}
```json
{
"Slug": "ExamplePlugin",
"Name": "Example Plugin",
"Description": "A cool example plugin.",
"Author": ["John Doe"],
"Version": {
"Plugin": "1.0",
"Saturn": ["1.0.0"]
},
"Dependencies": [],
"Conflicts": [],
"Hibernate": ["/MyPluginURL"],
"Startup": ["Main.php"]
}
```
{% endcode %}
## Manifest keys and what they do
### Slug
Your Saturn provided plugin 'slug', this tells Saturn where to look for updates, and to automatically generate a link to your plugin page.
A slug is basically a unique ID for you! It stops plugins from clashing and causing nasty errors, it's also how PluginManager understands what plugin is this plugin.
Even if you change the name of your plugin, you slug won't change. It's permanent.
*There are no examples - use your slug.*
### Name
The name key does what it says on the tin, it's the plugin's name!
Examples
:white\_check\_mark: **Example**
:white\_check\_mark: **My Cool Plugin!**
:x: **Plugin by John Doe**
Plugins shouldn't contain your name, that's what the author section is for!
:x: **Saturn Plugin**
Plugins shouldn't contain "Saturn", we know it's for Saturn!
### Description
Another easy one, it's a quick description for your plugin!
Examples
:white\_check\_mark: **This is a cool plugin that does cool stuff**
:x: **A plugin made by John Doe**
Descriptions shouldn't contain your name, that's what the author section is for! The only exception is if you are required to give attribution for using libraries, etc (Libraries made by the Saturn team made for Saturn don't require attribution in plugins).
:x: **A cool plugin for Saturn**
Descriptions shouldn't contain "Saturn", we know it's for Saturn!
### Author
This can be a single author, or a list. It tells the people using it who made it.
Examples
:white\_check\_mark: **\["John Doe"]**
:white\_check\_mark: **\["John Doe", "Jane Doe"]**
:x: **\["[www.johndoe.com](http://www.johndoe.com)"]**
Plugins shouldn't contain URLs, we automatically generate links back to your Saturn Marketplace page in the Plugin Library!
:x: **\["Anonymous"]**
Tell us who you are! Use an Alias, anything!
:x: **"John Doe"**
Please put it in an array, even if it's only one value. I like arrays.
### Version->Plugin
Your plugin version, that's up to you! It must only consist of numbers and periods. It's used whilst checking for plugin updates.
Examples
:white\_check\_mark: **1**
:white\_check\_mark: **1.2**
:white\_check\_mark: **1.2.3**
:x: **1.2-patch-1**
This will confuse Saturn. Please don't confuse Saturn, it's trying it's best.
### Version->Saturn
The version(s) of Saturn that your plugin is compatable with.
Examples
:white\_check\_mark: **\["1.0.0"]**
:x: **\["Saturn 1.0.0"]**
This will confuse Saturn. Please don't confuse Saturn, it's trying it's best.
:x: **"1.0.0"**
Please put it in an array, even if it's only one value. *We* like arrays.
### Dependencies
Does you plugin rely on another plugin to work? If so, this section is for you! If not, well you need it anyways.
Examples: My plugin has dependencies.
:white\_check\_mark: **\["Example"]**
:white\_check\_mark: **\["Example", "ExampleTwo"]**
:x: **"Example"**
Please put it in an array, even if it's only one value. We love arrays.
Examples: My plugin does not have dependencies.
:white\_check\_mark: **\[]**
:x: **\["None"]**
Don't say that! Now Saturn is looking all over for a plugin called "None"
### Conflicts
This section is for if you're aware of your plugin conflicting with another plugin, for example if you create a custom control panel plugin - you don't want users to use any others!
Examples: My plugin has conflicts.
:white\_check\_mark: **\["Example"]**
:white\_check\_mark: **\["Example", "ExampleTwo"]**
:x: **"Example"**
Please put it in an array, even if it's only one value. Saturn loves arrays.
Examples: My plugin does not have conflicts.
:white\_check\_mark: **\[]**
:x: **\["None"]**
Don't say that! Now Saturn is looking all over for a plugin called "None"
### Hibernate
Hibernate allows your plugin to only load when specific conditions are met, for more information please see [Power Features](/1.0.0/dev/plugins/power-features#hibernate).
Examples: My plugin hibernates.
:white\_check\_mark: **\["/panel"]**
:white\_check\_mark: **\["/panel", "/account"]**
:x: **"/panel"**
Please put it in an array, even if it's only one value. Everyone loves arrays.
Examples: My plugin does not hibernate.
:white\_check\_mark: **false**
:x: **\["None"]**
Don't say that! Now Saturn is confused and won't load it until "None" is found!
### Startup
The files that Saturn should load into the program. These files should have executable PHP outside of a class, Saturn doesn't load classes automatically.
Conventionally, you should only load one file which in turn loads and starts your plugin. But if you want to you can load more, it's up to you really - we don't care.
Examples
:white\_check\_mark: **\["Main.php"]**
:white\_check\_mark: **\["Main.php", "Settings.php"]**
:white\_check\_mark: **\["code/Main.php"]**
Your startup file can be in a subfolder.
:x: **\["Main"]**
You need to add a file extension!
:x: **\[]**
If you load nothing, you plugin won't work.
# APIs
Saturn allows you to directly talk to it's APIs and sometimes even change how they work. This allows you to have a high level of control and customisation on certain Saturn functions.
## Manager Libraries
Managers are a set of libraries that execute similar functions to one-another. All the libraries within a manager work together to complete tasks such as Database queries or executing actions.
### DatabaseManager
{% content-ref url="/pages/ZDvHgonVNDqrRe9EG859" %}
[DatabaseManager](/1.0.0/dev/libraries-and-functions/databasemanager)
{% endcontent-ref %}
### HookManager
{% content-ref url="/pages/960Bod25GMLOyqurCq6H" %}
[Hooks](/1.0.0/dev/hooks)
{% endcontent-ref %}
### HTTPManager
{% content-ref url="/pages/yvhLXIngRxZLK1QqpbrF" %}
[HTTP](/1.0.0/dev/libraries-and-functions/http)
{% endcontent-ref %}
### RouteManager
### SecurityManager
### SessionManager
### TestManager
{% content-ref url="/pages/PARPF8sVHexHzts6jhmZ" %}
[Tests and Profiling](/1.0.0/dev/tests-and-profiling)
{% endcontent-ref %}
### LanguageManager
### Error Handlers
# Checking for Dependencies
## Manfiest File
Using a Manifest File to check for dependencies is the preferred route if your plugin **requires** another to work.
Learn how to set dependencies in Manifest files here: [Manifest](/1.0.0/dev/plugins/manifest#dependencies)
## Using PluginManager
PluginManager allows you to check if a plugin is running. This is the preferred route if your plugin **does not require, but can use** features from another plugin.
For example, if you have a feature that links in with another plugin, but does not require the plugin to be installed for yours to work.
This is great for optional features.
Learn more here: [Check if a plugin is loaded.](/1.0.0/dev/libraries-and-functions/pluginmanager/check-if-a-plugin-is-loaded.)
# Power Features
Power Features are designed to improve plugin speed and performance, by managing plugin resource usage on the server.
{% content-ref url="/pages/DJ1xfPSDuL05tpT65Ik8" %}
[Hibernate](/1.0.0/dev/plugins/power-features/hibernate)
{% endcontent-ref %}
# Hibernate
Hibernate is a feature intended to speed up Saturn websites by skipping plugins that would otherwise not do anything the user needs on a specific page.
For example: if your plugin enchances the login page, why load it on every single page in Saturn? It's faster to hibernate the plugin than to load it, it also reduces the number of unintended bugs your plugin could cause.
## What happens when my plugin hibernates?
For your plugin, nothing. No files will be loaded and nothing will be included. Your plugin will still appear in Saturn's list of plugins, but unless it's active it won't be loaded.
If your plugin hibernates in the official Control Panel plugin it will show as unloaded in the plugin list, and when clicked on it will inform the user that the plugin is hibernating.
## How do I hibernate my plugin?
Simply edit the manifest file, and add a list of URLs you'd like your plugin to "wake up" on. When a user visits one of these URLs, the plugin will load. If the URL is not visited, the plugin will hibernate.
To disable Hibernate simply enter false:
```json
"Hibernate": false
```
To enable Hibernate, enter an array list of URLs. This example plugin will wake up when a user visits example.com/login or example.com/register
The plugin will also wake up if a user visits sub-pages of the pages you listed, such as example.com/login/reset
```
"Hibernate": ["/login", "/register"]
```
## Potential drawbacks
If your plugin is intended for use on the majority of Saturn, excluding one of two pages, it might not be worth enabling Hibernate.
Saturn uses loops to find Hibernate URLs, so if you have a lot of URLs, this may just slow down your plugin more.
# Hooks
## Types of Hooks
{% content-ref url="/pages/VwoBFqiaMeuohq0Xz18g" %}
[Actions](/1.0.0/dev/libraries-and-functions/hookmanager/actions)
{% endcontent-ref %}
{% content-ref url="/pages/Tg3nw8iejdsQ24FDw0wC" %}
[Runners](/1.0.0/dev/libraries-and-functions/hookmanager/runners)
{% endcontent-ref %}
## The difference between Actions and Runners
# Tests and Profiling
Ensuring that your plugins run quickly, it's important to test their resource usage and the time it takes for them to complete tasks. This can help you to optimise your code and algorithms.
You can use our built in TestManager libraries to complete basic tests and profiling tasks.
{% content-ref url="/pages/6R3UKonsKJ5ODh7N0q78" %}
[TestManager](/1.0.0/dev/libraries-and-functions/testmanager)
{% endcontent-ref %}
# Global Variables
**Global Variables** are variables created by Saturn to share certain information about the system with developers and other Saturn processes.
| Variable | Type | What's in it? | Example |
| -------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| $SaturnPlugins | array(array()) | A list of plugins Saturn has found and attempted to load. Contains the loading status and if they couldn't be loaded, the reason why. | array(2) { \["Example Plugin 1"]=> array(1) { \["Loaded"]=> bool(true) } \["Example Plugin 2"]=> array(2) { \["Loaded"]=> bool(false) \["Reason"]=> string(53) "Plugin is not compatible with this version of Saturn." } } |
| $ActionList | array(array()) | A list of actions that will run. | \["RouteRegister"]=> array(1) { \[0]=> array(1) { \[0]=> array(2) { \["Function"]=> array(2) { \[0]=> object(ControlPanel\CPRouter)#11 (0) { } \[1]=> string(8) "Register" } \["Data"]=> array(1) { \[0]=> object(Saturn\HTTP\Router)#5 (0) { } } } } } |