Suppose I have a registration page in my website that contains a registration form:
You can include a token in your form that only your site would know (and store it in a session variable). Then when the form is submitted you check to see if that token exists and is valid. If it is, continue processing the form. If it isn't, throw an error.
This is also very useful for defending against Cross-Site Request Forgery (CSRF) attacks.