How can generating and storing random values be used to verify form submission origins in PHP applications?

To verify form submission origins in PHP applications, you can generate a random value when rendering the form and store it in a session variable. When the form is submitted, compare the stored random value with the one submitted in the form data. If they match, it indicates that the form was submitted from the same session where it was rendered, helping to prevent CSRF attacks. 

<?php

session_start();

// Generate a random token
$token = bin2hex(random_bytes(16));

// Store the token in a session variable
$_SESSION['csrf_token'] = $token;

// Render the form with the token as a hidden input field
echo '<form method="post">';
echo '<input type="hidden" name="csrf_token" value="' . $token . '">';
echo '<input type="text" name="username">';
echo '<input type="password" name="password">';
echo '<input type="submit" value="Submit">';
echo '</form>';

// Verify the token when the form is submitted
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if ($_POST['csrf_token'] === $_SESSION['csrf_token']) {
        // Token is valid, process the form data
        // Add your form processing logic here
    } else {
        // Token is invalid, handle the error
        echo 'CSRF token validation failed';
    }
}

?>

Keywords

random values form submission origins PHP applications verification

Related Questions