title: md5 token in hidden form field
body: <p>I read in more than one website about this method of protecting forms:</p>
  
  <p>I add a hiddenfield:</p>
  
  <pre><code>&lt;input type="hidden" name="token" value="&lt;?php echo $token; ?&gt;" /&gt;
  </code></pre>
  
  <p>the token is generated by:</p>
  
  <pre><code>$token = md5(uniqid(rand(), TRUE));
  $_SESSION['token'] = $token;
  </code></pre>
  
  <p>I do understand that this code is virtually unbreakable due to it's randomness.</p>
  
  <p>What I don't understand is: why they include the token in a hidden form field which can be viewed in the html source?</p>
  
  <p>Could then a user save the form and copy the valid md5 token to a fake version of the form and submit it?</p>