[eluser]worchyld[/eluser]
A unique token does not solve this problem. Every time you submit the form the unique token is always the same!
Code:
<?php
/* This code is not intended to be used on a live site */
session_start();
$unique_code = md5(microtime());
if (empty($_POST)) {
$_SESSION['unique_code'] = $unique_code;
}
print "POSTED: <br />";
print_r($_POST);
print '<br /><br />SESSION: <br />';
print_r($_SESSION);
?>
<form name="testForm" method="post" action="<?=$_SERVER['PHP_SELF'];?>">
<p>
<input type="text" name="name" id="name" value="" /><br />
<input type="text" name="unique_code" id="unique_code" value="<?=$unique_code;?>" />
</p>
<p>
<input type="submit" />
</p>
</form>