How can PHP developers prevent cross-site request forgery (CSRF) attacks when processing form data from external sources?

To prevent CSRF attacks when processing form data from external sources, PHP developers can implement CSRF tokens. These tokens are unique values generated for each form submission and are verified on the server side to ensure that the request is legitimate. 

// Generate CSRF token
$csrf_token = bin2hex(random_bytes(32));
$_SESSION['csrf_token'] = $csrf_token;

// Include CSRF token in form
<form action="process_form.php" method="post">
    <input type="hidden" name="csrf_token" value="<?php echo $csrf_token; ?>">
    <!-- Other form fields -->
</form>

// Verify CSRF token on form submission
session_start();
if ($_POST['csrf_token'] === $_SESSION['csrf_token']) {
    // Process form data
    // Reset CSRF token
    unset($_SESSION['csrf_token']);
} else {
    // Handle CSRF attack
    die("CSRF attack detected!");
}

Keywords

CSRF protection PHP form data external sources security

Related Questions