diff --git a/App/pages/dashboard.php b/App/pages/dashboard.php
index 6783c27..2131600 100644
--- a/App/pages/dashboard.php
+++ b/App/pages/dashboard.php
@@ -1,5 +1 @@
-<?php
-/** GeoGraSim — Lehrkraefte-Dashboard */
-$html = file_get_contents(APP_ROOT . '/dashboard.html');
-$ctx = '<script>window.__GGS__ = ' . json_encode(['sessionId' => Session::studentId(), 'teacherId' => Session::teacherId(), 'baseUrl' => BASE_URL, 'basePath' => BASE_PATH], JSON_UNESCAPED_UNICODE) . ';</script>';
-echo str_replace('</body>', $ctx . "\n</body>", $html);
+<?php renderPage('dashboard.html');
diff --git a/App/pages/energiemix.php b/App/pages/energiemix.php
index 02741d0..47dfa56 100644
--- a/App/pages/energiemix.php
+++ b/App/pages/energiemix.php
@@ -1,5 +1 @@
-<?php
-/** GeoGraSim — Energiemix-Simulator */
-$html = file_get_contents(APP_ROOT . '/energiemix.html');
-$ctx = '<script>window.__GGS__ = ' . json_encode(['sessionId' => Session::studentId(), 'teacherId' => Session::teacherId(), 'baseUrl' => BASE_URL, 'basePath' => BASE_PATH], JSON_UNESCAPED_UNICODE) . ';</script>';
-echo str_replace('</body>', $ctx . "\n</body>", $html);
+<?php renderPage('energiemix.html');
diff --git a/App/pages/erdbeben.php b/App/pages/erdbeben.php
index bac8567..fb73e36 100644
--- a/App/pages/erdbeben.php
+++ b/App/pages/erdbeben.php
@@ -1,5 +1 @@
-<?php
-/** GeoGraSim — Erdbeben-Simulator */
-$html = file_get_contents(APP_ROOT . '/erdbeben.html');
-$ctx = '<script>window.__GGS__ = ' . json_encode(['sessionId' => Session::studentId(), 'teacherId' => Session::teacherId(), 'baseUrl' => BASE_URL, 'basePath' => BASE_PATH], JSON_UNESCAPED_UNICODE) . ';</script>';
-echo str_replace('</body>', $ctx . "\n</body>", $html);
+<?php renderPage('erdbeben.html');
diff --git a/App/pages/fluss.php b/App/pages/fluss.php
index d1f5b2f..4cd71f6 100644
--- a/App/pages/fluss.php
+++ b/App/pages/fluss.php
@@ -1,5 +1 @@
-<?php
-/** GeoGraSim — Flussmanagement-Simulation */
-$html = file_get_contents(APP_ROOT . '/fluss.html');
-$ctx = '<script>window.__GGS__ = ' . json_encode(['sessionId' => Session::studentId(), 'teacherId' => Session::teacherId(), 'baseUrl' => BASE_URL, 'basePath' => BASE_PATH], JSON_UNESCAPED_UNICODE) . ';</script>';
-echo str_replace('</body>', $ctx . "\n</body>", $html);
+<?php renderPage('fluss.html');
diff --git a/App/pages/game-3d.php b/App/pages/game-3d.php
index cf7404a..476ef93 100644
--- a/App/pages/game-3d.php
+++ b/App/pages/game-3d.php
@@ -1,18 +1 @@
-<?php
-/**
- * GeoGraSim — Klimawächter (3D)
- */
-
-$html = file_get_contents(APP_ROOT . '/game-3d.html');
-
-$sessionScript = '<script>' . "\n"
-    . 'window.__GGS__ = ' . json_encode([
-        'sessionId' => Session::studentId(),
-        'teacherId' => Session::teacherId(),
-        'baseUrl'   => BASE_URL,
-        'basePath'  => BASE_PATH,
-    ], JSON_UNESCAPED_UNICODE) . ";\n"
-    . '</script>';
-
-$html = str_replace('</body>', $sessionScript . "\n</body>", $html);
-echo $html;
+<?php renderPage('game-3d.html');
diff --git a/App/pages/game.php b/App/pages/game.php
index 2329561..dee71ec 100644
--- a/App/pages/game.php
+++ b/App/pages/game.php
@@ -1,18 +1 @@
-<?php
-/**
- * GeoGraSim — Klimawächter (2D)
- */
-
-$html = file_get_contents(APP_ROOT . '/game.html');
-
-$sessionScript = '<script>' . "\n"
-    . 'window.__GGS__ = ' . json_encode([
-        'sessionId' => Session::studentId(),
-        'teacherId' => Session::teacherId(),
-        'baseUrl'   => BASE_URL,
-        'basePath'  => BASE_PATH,
-    ], JSON_UNESCAPED_UNICODE) . ";\n"
-    . '</script>';
-
-$html = str_replace('</body>', $sessionScript . "\n</body>", $html);
-echo $html;
+<?php renderPage('game.html');
diff --git a/App/pages/index.php b/App/pages/index.php
index ab57f5c..e0abe85 100644
--- a/App/pages/index.php
+++ b/App/pages/index.php
@@ -1,21 +1 @@
-<?php
-/**
- * GeoGraSim — Startseite (Landing Page)
- * Laedt die bestehende index.html und injiziert Session-Kontext.
- */
-
-$html = file_get_contents(APP_ROOT . '/index.html');
-
-// Session-Kontext vor </body> injizieren
-$sessionScript = '<script>' . "\n"
-    . 'window.__GGS__ = ' . json_encode([
-        'sessionId' => Session::studentId(),
-        'teacherId' => Session::teacherId(),
-        'baseUrl'   => BASE_URL,
-        'basePath'  => BASE_PATH,
-    ], JSON_UNESCAPED_UNICODE) . ";\n"
-    . '</script>';
-
-$html = str_replace('</body>', $sessionScript . "\n</body>", $html);
-
-echo $html;
+<?php renderPage('index.html');
diff --git a/App/pages/lieferketten.php b/App/pages/lieferketten.php
index c5f826d..410af5a 100644
--- a/App/pages/lieferketten.php
+++ b/App/pages/lieferketten.php
@@ -1,5 +1 @@
-<?php
-/** GeoGraSim — Lieferketten-Simulator */
-$html = file_get_contents(APP_ROOT . '/lieferketten.html');
-$ctx = '<script>window.__GGS__ = ' . json_encode(['sessionId' => Session::studentId(), 'teacherId' => Session::teacherId(), 'baseUrl' => BASE_URL, 'basePath' => BASE_PATH], JSON_UNESCAPED_UNICODE) . ';</script>';
-echo str_replace('</body>', $ctx . "\n</body>", $html);
+<?php renderPage('lieferketten.html');
diff --git a/App/pages/regenwald.php b/App/pages/regenwald.php
index 7fab607..bf3e147 100644
--- a/App/pages/regenwald.php
+++ b/App/pages/regenwald.php
@@ -1,5 +1 @@
-<?php
-/** GeoGraSim — Regenwald-Explorer */
-$html = file_get_contents(APP_ROOT . '/regenwald.html');
-$ctx = '<script>window.__GGS__ = ' . json_encode(['sessionId' => Session::studentId(), 'teacherId' => Session::teacherId(), 'baseUrl' => BASE_URL, 'basePath' => BASE_PATH], JSON_UNESCAPED_UNICODE) . ';</script>';
-echo str_replace('</body>', $ctx . "\n</body>", $html);
+<?php renderPage('regenwald.html');
diff --git a/App/pages/sim.php b/App/pages/sim.php
index 01ac506..9dcf9c6 100644
--- a/App/pages/sim.php
+++ b/App/pages/sim.php
@@ -1,5 +1 @@
-<?php
-/** GeoGraSim — Simulationsseite (POE-Workflow) */
-$html = file_get_contents(APP_ROOT . '/sim.html');
-$ctx = '<script>window.__GGS__ = ' . json_encode(['sessionId' => Session::studentId(), 'teacherId' => Session::teacherId(), 'baseUrl' => BASE_URL, 'basePath' => BASE_PATH], JSON_UNESCAPED_UNICODE) . ';</script>';
-echo str_replace('</body>', $ctx . "\n</body>", $html);
+<?php renderPage('sim.html');
diff --git a/App/pages/stilauswahl.php b/App/pages/stilauswahl.php
index ad00226..ba998af 100644
--- a/App/pages/stilauswahl.php
+++ b/App/pages/stilauswahl.php
@@ -1,5 +1 @@
-<?php
-/** GeoGraSim — Stilauswahl */
-$html = file_get_contents(APP_ROOT . '/stilauswahl.html');
-$ctx = '<script>window.__GGS__ = ' . json_encode(['sessionId' => Session::studentId(), 'teacherId' => Session::teacherId(), 'baseUrl' => BASE_URL, 'basePath' => BASE_PATH], JSON_UNESCAPED_UNICODE) . ';</script>';
-echo str_replace('</body>', $ctx . "\n</body>", $html);
+<?php renderPage('stilauswahl.html');
diff --git a/App/php/api/assessment.php b/App/php/api/assessment.php
index 65c0a86..50dfd64 100644
--- a/App/php/api/assessment.php
+++ b/App/php/api/assessment.php
@@ -4,8 +4,6 @@
  * POST /api/assessment {simId, processLog, predictions, results, reflections, duration, completedPhases}
  */
 
-header('Content-Type: application/json; charset=utf-8');
-
 if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
     Response::error('Nur POST erlaubt', 405);
 }
diff --git a/App/php/api/dashboard.php b/App/php/api/dashboard.php
index d6e92bc..07a444c 100644
--- a/App/php/api/dashboard.php
+++ b/App/php/api/dashboard.php
@@ -4,8 +4,6 @@
  * GET /api/dashboard?class_id=X
  */
 
-header('Content-Type: application/json; charset=utf-8');
-
 if ($_SERVER['REQUEST_METHOD'] !== 'GET') {
     Response::error('Nur GET erlaubt', 405);
 }
@@ -18,14 +16,14 @@ $classId = (int)($_GET['class_id'] ?? 0);
 // Verifizieren dass die Klasse dem Lehrer gehoert
 if ($classId) {
     $class = $db->fetchOne(
-        'SELECT * FROM classes WHERE id = ? AND teacher_id = ?',
+        'SELECT id, name, school_year, join_code, created_at FROM classes WHERE id = ? AND teacher_id = ?',
         [$classId, $teacherId]
     );
     if (!$class) Response::error('Klasse nicht gefunden', 404);
 }
 
 // Klassen des Lehrers
-$classes = $db->fetchAll('SELECT * FROM classes WHERE teacher_id = ? ORDER BY created_at DESC', [$teacherId]);
+$classes = $db->fetchAll('SELECT id, name, school_year, join_code, created_at FROM classes WHERE teacher_id = ? ORDER BY created_at DESC', [$teacherId]);
 
 if (!$classId && !empty($classes)) {
     $classId = $classes[0]['id'];
diff --git a/App/php/api/saves.php b/App/php/api/saves.php
index 1beabaa..9ad69d1 100644
--- a/App/php/api/saves.php
+++ b/App/php/api/saves.php
@@ -1,22 +1,19 @@
 <?php
 /**
  * API: Spielstaende speichern/laden
- * GET  /api/saves?key=klimawaechter-save  → Spielstand laden
- * POST /api/saves {key, data, version}     → Spielstand speichern
+ * GET  /api/saves?key=klimawaechter-save
+ * POST /api/saves {key, data, version}
  */
 
-header('Content-Type: application/json; charset=utf-8');
-
 $method = $_SERVER['REQUEST_METHOD'];
 $db = Database::get();
 
 if ($method === 'GET') {
     $sessionId = Session::studentId();
-    if (!$sessionId) {
-        Response::json(['data' => null]);
-    }
+    if (!$sessionId) Response::json(['data' => null]);
+
     $key = $_GET['key'] ?? '';
-    if (!$key) Response::error('key fehlt');
+    if (!$key || strlen($key) > 100) Response::error('key fehlt oder zu lang');
 
     $row = $db->fetchOne(
         'SELECT save_data, save_version FROM game_saves WHERE session_id = ? AND save_key = ?',
@@ -31,6 +28,9 @@ if ($method === 'POST') {
     if (!$body || !isset($body['key']) || !isset($body['data'])) {
         Response::error('key und data erforderlich');
     }
+    if (strlen($body['key']) > 100 || strlen($body['data']) > 500000) {
+        Response::error('Payload zu gross', 413);
+    }
 
     $db->execute(
         'INSERT INTO game_saves (session_id, save_key, save_data, save_version)
diff --git a/App/php/api/sessions.php b/App/php/api/sessions.php
index 8fe4c0d..0a0d93f 100644
--- a/App/php/api/sessions.php
+++ b/App/php/api/sessions.php
@@ -5,8 +5,6 @@
  * POST /api/sessions {action: "status"}
  */
 
-header('Content-Type: application/json; charset=utf-8');
-
 if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
     Response::error('Nur POST erlaubt', 405);
 }
@@ -26,7 +24,7 @@ if ($action === 'join') {
         Response::error('Klasse nicht gefunden');
     }
 
-    $displayName = trim($body['displayName'] ?? '');
+    $displayName = mb_substr(trim($body['displayName'] ?? ''), 0, 64);
     $uuid = Session::createStudent((int)$class['id'], $displayName);
 
     Response::ok([
diff --git a/App/php/lib/Session.php b/App/php/lib/Session.php
index fad9be3..223c9c5 100644
--- a/App/php/lib/Session.php
+++ b/App/php/lib/Session.php
@@ -22,12 +22,12 @@ class Session {
 
     /** Neue Schueler-Session erstellen */
     public static function createStudent(int $classId, string $displayName = ''): string {
-        $uuid = sprintf('%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
-            mt_rand(0, 0xffff), mt_rand(0, 0xffff),
-            mt_rand(0, 0xffff),
-            mt_rand(0, 0x0fff) | 0x4000,
-            mt_rand(0, 0x3fff) | 0x8000,
-            mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0xffff)
+        $uuid = sprintf('%s-%s-%s-%s-%s',
+            bin2hex(random_bytes(4)),
+            bin2hex(random_bytes(2)),
+            bin2hex(random_bytes(2)),
+            bin2hex(random_bytes(2)),
+            bin2hex(random_bytes(6))
         );
 
         $db = Database::get();
@@ -83,6 +83,12 @@ class Session {
     public static function logout(): void {
         self::start();
         session_destroy();
-        setcookie(self::COOKIE_NAME, '', ['expires' => 1, 'path' => BASE_PATH . '/']);
+        setcookie(self::COOKIE_NAME, '', [
+            'expires'  => 1,
+            'path'     => BASE_PATH . '/',
+            'samesite' => 'Lax',
+            'secure'   => IS_PRODUCTION,
+            'httponly'  => true,
+        ]);
     }
 }
diff --git a/App/php/templates/_scripts.php b/App/php/templates/_scripts.php
index b60664a..13adf8c 100644
--- a/App/php/templates/_scripts.php
+++ b/App/php/templates/_scripts.php
@@ -41,3 +41,15 @@ function injectSessionContext(): void {
     ];
     echo '<script>window.__GGS__ = ' . json_encode($ctx, JSON_UNESCAPED_UNICODE) . ';</script>' . "\n";
 }
+
+/** Seite rendern: HTML laden, Session-Kontext injizieren, ausgeben */
+function renderPage(string $htmlFile): void {
+    $html = file_get_contents(APP_ROOT . '/' . $htmlFile);
+    $ctx = '<script>window.__GGS__ = ' . json_encode([
+        'sessionId' => Session::studentId(),
+        'teacherId' => Session::teacherId(),
+        'baseUrl'   => BASE_URL,
+        'basePath'  => BASE_PATH,
+    ], JSON_UNESCAPED_UNICODE) . ';</script>';
+    echo str_replace('</body>', $ctx . "\n</body>", $html);
+}