Does PHP have its own version of the Rails authenticity token?
\" />
When outputting to form:
$token = md5(time() . rand(1,100)); $_SESSION['token'] = $token;
After POST:
if(empty($_POST['token']) || $_POST['token'] !== $_SESSION['token']){ exit("Bad token!"); } unset($_SESSION['token']);