TalkPHP - View Single Post - Cross-Site Request Forgeries

Karl · 09-30-2007, 02:02 PM

An exmaple would be to first set the token as the users cookie:

PHP Code:


			
$_SESSION['token'] = $iToken;

// Now create the form using this token

And then on the next page, we simply check:

PHP Code:


			

if ($_SESSION['token'] !== $_POST['token'])
{
    echo 'Tut tut, bad boy!.';
}

You would simply use code like that to check the token.

09-30-2007, 02:02 PM	#12 (permalink)
Karl The Reckoner Join Date: Sep 2007 Posts: 437 Thanks: 22	An exmaple would be to first set the token as the users cookie: PHP Code: `$_SESSION['token'] = $iToken; // Now create the form using this token` And then on the next page, we simply check: PHP Code: `if ($_SESSION['token'] !== $_POST['token']) { echo 'Tut tut, bad boy!.'; }` You would simply use code like that to check the token.