{"slug": "building-a-24-language-journal-in-plain-php-ai-translation-hash-based-staleness", "title": "Building a 24-Language Journal in Plain PHP: AI Translation, Hash-Based Staleness, and a Points-Gated Community", "summary": "A developer built a 24-language Journal feature for the GDPR-first metasearch engine findnix.eu using plain PHP 8.4 and MariaDB, translating German source content into 23 EU languages with gpt-4o-mini chunked at heading boundaries and sanitized through a DOMDocument whitelist before storage. Staleness is tracked with an MD5 hash of the source title, excerpt and body rather than updated_at, and a GROUP BY title duplicate check caught eight mistranslated Slovak titles that an LLM self-grading pass missed. \"For batch-generated content, cheap invariants beat asking an LLM to grade itself,\" the developer wrote.", "body_md": "findnix.eu is a GDPR-first metasearch engine with its own index. Search was never the whole story, so we added a **Journal**: articles, a weekly digest, \"finds\" (sites worth a look), user questions and answers, and a profile page for every domain in the index. It's plain PHP 8.4 and MariaDB, no framework, in the same codebase as everything else. These are the decisions that mattered.\n\nArticles, digests, finds and questions share one table with an `ENUM` type column. Translations live in their own table keyed by `(post_id, lang)`, so the original post never changes shape and a missing language is just a missing row. German is the source language; the other 23 EU languages are translations. Each language version gets its own URL (`/journal/fr/some-slug`) with `hreflang` links, and the sitemap lists every version with its translated title and description, so the translated pages end up in our own search index too.\n\nThe renderer is about 100 lines. The one rule that keeps it safe: escape everything first, then generate only the tags we allow.\n\n``` php\n$t = htmlspecialchars($t, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');\n// only now turn [text](url) into , and only for http(s), mailto or local paths\n```\n\nRaw HTML in a post simply shows up as text. Links from user content get `rel=\"nofollow ugc\"`.\n\nPosts are rendered to HTML once, and that HTML is what we translate: split at `

`–`

` boundaries into chunks of a few thousand characters, one `gpt-4o-mini` call per chunk, with the instruction to keep every tag and attribute and translate only visible text. Title and teaser go in a separate call that returns JSON.\n\nThe important part is what happens afterwards. An article is attacker-controlled text as far as the model is concerned: a user post could contain instructions, and the model might obey them and emit markup. So the translated HTML goes through a `DOMDocument` whitelist (a short list of tags and attributes, URL schemes checked) before it is stored. If the model produces a `