function csrf_check($fatal = true)
{
    if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
        return true;
    }
    csrf_start();
    $name = $GLOBALS['csrf']['input-name'];
    $ok = false;
    $tokens = '';
    do {
        if (!isset($_POST[$name])) {
            break;
        }
        // we don't regenerate a token and check it because some token creation
        // schemes are volatile.
        $tokens = $_POST[$name];
        if (!csrf_check_tokens($tokens)) {
            break;
        }
        $ok = true;
    } while (false);
    if ($fatal && !$ok) {
        $callback = $GLOBALS['csrf']['callback'];
        if (trim($tokens, 'A..Za..z0..9:;,') !== '') {
            $tokens = 'hidden';
        }
        $callback($tokens);
        exit;
    }
    return $ok;
}
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.