Source code:
<?php
if( $_POST )
{
if ($_POST['XSRF_filter'] != $_COOKIE['XSRF_filter_cookie'])
{
echo "You're trying to do an XSRF attack! Can't allow you to post this form";
echo "<p>form value: " . $_POST['XSRF_filter'];
echo "<br>cookie value: " . $_COOKIE['XSRF_filter_cookie'] . "</p>";
}
else
{
//process form
echo "your form post has been processed :)";
}
}
else
{
$randomString = md5(rand(0,100000));
setcookie("XSRF_filter_cookie",
$randomString,
time() + 3600,
"/",
".ideadrought.com",
0);
?>
<form action="" method="POST">
Change this to create an error :)
<br><input type="text" name="XSRF_filter" value="<? echo $randomString; ?>">
<br>...other form elements
<br><input type="submit" name="submit" value="submit">
</form>
<?
}
?>