Back
Syntax
Study
Editor
Mode:
HTML
CSS
JavaScript
PHP
Reset
Run »
HTML / CSS / JS
<?php session_start(); // Generate token when rendering the form function generateCsrfToken(): string { if (empty($_SESSION['csrf_token'])) { $_SESSION['csrf_token'] = bin2hex(random_bytes(32)); } return $_SESSION['csrf_token']; } // Validate token on form submission function validateCsrfToken(string $submittedToken): bool { $sessionToken = $_SESSION['csrf_token'] ?? ''; // hash_equals is timing-safe return hash_equals($sessionToken, $submittedToken); } // In your form template: $token = generateCsrfToken(); // <input type="hidden" name="csrf_token" value="<?= $token ?>"> // In your form handler: if ($_SERVER['REQUEST_METHOD'] === 'POST') { $submitted = $_POST['csrf_token'] ?? ''; if (!validateCsrfToken($submitted)) { http_response_code(403); die('Invalid CSRF token'); } // Rotate token after use unset($_SESSION['csrf_token']); // ... process form }
Result
Open