PHP CSRF Attack

Question

I want to know if this code is strong enough to prevent CSRF attack on PHP Form?

Answer 1

On the products I support, I'd say "no." Your random number generator is based on rand() which is predictable. Also, it looks like the random number is very short - it needs to be long enough that it cannot be brute forced during the session's validity - nor cany any of the many active sessions' CSRF tokens be cracked.

Check out the OWASP page on CSRF They'll give you good guidance.