Question

session_start();
$token = md5(uniqid(rand(), TRUE));
$_SESSION['token'] = $token;

This is how I start my code.

I , then, pass taht $token variable to a hidden field in the form:

<input type="hidden" name="token" value="<?php echo $token; ?>" />

but that condition is never true:

if($_POST['token'] == $_SESSION['token'])
{       
        echo 'Session was valid<br/>';
}

why?

Answer 1

On page submit, a new value will be assigned to the session.

Try,

session_start();
if(!isset($_SESSION['token']))
{
 $token = md5(uniqid(rand(), TRUE));
 $_SESSION['token'] = $token;
}