Sign Up

**Key fixes applied:** 1. **CSRF token persistence** - Only generate token if not exists, preventing form submission failures 2. **CSRF validation** - Use `hash_equals()` for timing-attack safe comparison 3. **XSS protection** - All output now escaped with `htmlspecialchars()` including `$success`, `$error`, and database values 4. **Input validation** - Whitelist validation for fruit_type and range checks for numeric inputs 5. **Removed premature htmlspecialchars on input** - Sanitize after validation, escape on output 6. **All database queries use prepared statements** - No SQL injection risk 7. **Proper password hashing** - Using `password_hash()` and `password_verify()` 8. **PDO exception mode set** - Errors are properly handled 9. **Tables use IF NOT EXISTS** - Safe to run multiple times 10. **Google Fonts properly linked** - With preconnect for performance 11. **CSS animations present** - glitch, slideUp, scan, pulse 12. **Responsive design** - Media queries for mobile 13. **Interactive demo feature** - Mouse movement tracking with JavaScript