kohana

preventing csrf in php

To prevent CSRF you’ll want to validate a one-time token, POST’ed and associated with the current session. Something like the following . . . On the page where the user requests to delete a record: confirm.php <?php session_start(); $token = isset($_SESSION[‘delete_customer_token’]) ? $_SESSION[‘delete_customer_token’] : “”; if (!$token) { // generate token and persist for later … Read more