title: Function to set an auth_token
body: <p>In my form I have a hidden field:</p>
  
  <pre><code>&lt;input type="hidden" name="auth_token" value="&lt;?php echo $auth_token; ?&gt;"&gt;
  </code></pre>
  
  <p>This value is also stored in a session and a variable:</p>
  
  <pre><code>$_SESSION['auth_token'] = hash('sha256', rand() . time() . $_SERVER['HTTP_USER_AGENT']);  #  TODO: put this in a function
  $auth_token = $_SESSION['auth_token'];
  </code></pre>
  
  <p>When the form is submitted the two values are compared. It's a basic form token.</p>
  
  <p>Should this be made into two functions or just one when refactored? <code>set_form_token()</code> and <code>get_form_token()</code>, get_form_token() returning the session value, then I can compare it in my main code. What is the proper way of doing this?</p>
  
  <p><strong>EDIT:</strong></p>
  
  <p>Considering both Joel L and RobertPitt's answers I have made these:</p>
  
  <pre><code>function set_auth_token()
  {
     if (!isset($_SESSION['auth_token']))
     {
        $_SESSION['auth_token'] = hash('sha256', rand() . time() . $_SERVER['HTTP_USER_AGENT']);
     }
  }
  
  function get_auth_token()
  {
     if (isset($_SESSION['auth_token']))
     {
        return $_SESSION['auth_token'];   
     }
     else
     {
        die('No auth token.');
     }
  }
  
  function check_auth_token()
  {
     if (array_key_exists('auth_token', $_SESSION) &amp;&amp; array_key_exists('auth_token', $_POST))
     {
        if ($_SESSION['auth_token'] === $_POST['auth_token'])
        {
           # what happens if user fills the form in wrong first time(?)
           $_SESSION['auth_token'] = hash('sha256', rand() . time() . $_SERVER['HTTP_USER_AGENT']);
        }
        else
        {
           return false;
        }
     }
     else
     {
        return false;
     }
  }
  </code></pre>
  
  <p>I can then check if check_auth_token returns false or not and then record it after the form has been submitted. Would this be acceptable?</p>