I just finally got around to reading that article about PHP security in that Insecure security magazine. In the section "Attacks against client browsers", in the last paragraph, the author states the following:
"Adding randomly generated hidden tokens to forms is the best solution to this problem. In every PHP script which generates a form add a hidden variable containing a random value. Save this value temporarily, such as in $SESSION (which cannot be tampered with by the user) and then check the random value submitted in the form against the one contained in $SESSION. Since an attacker is highly unlikely to guess a the random value correctly if this value is sufficiently long, the form submitted is guaranteed to be the one from the client who requested it."
I was wondering if this is a good method to employ, and if so, how to actually go about doing so?
