There are three functions involved. The first Init is run before the content is parsed. The second is parseContent where the content is generated. The third is displayPage that renders the page and HTML for the user.They are within an OOP class that uses template files which have #KEYWORDS# that are dynamically replaced. session_start() is also in effectInit()$this->content = false;    $this->inputVerified = false;if ( $this->input['token'] && $_SESSION['TOKEN'] && $this->input['token'] === $_SESSION['TOKEN'] ){    $this->inputVerified = true;    unset( $_SESSION['TOKEN'] );}parseContent()// content hereif ( $form_submission ){          if ( $this->inputVerified )    {        // CSRF PROOF?    }}$this->content = 'DYNAMIC TEMPLATE CONTENT';displayPage()if ( strpos( $this->content, '#TOKEN#' ) ){    $main = hash_hmac( 'sha512', mt_rand(), mt_rand() );    $_SESSION['TOKEN'] = $main;    $this->content = str_replace( '#TOKEN#', $main, $this->content );}What I like about this is I only had to do the following to implement it:Include a hidden token input field with the value of #TOKEN# onany sensitive formdisplayPage() will detect and replace this (with questionable efficiency)Check for $this->inputVerified on any page that will process a sensitive formInit() will detect token input and if it matches its $_SESSION counterpart will set $this->inputVerified to true only on the first valid submission, false if refreshed or otherwise.Is it enough?
PHP CSRF eliminator
php;object oriented;security;authentication