title: PHP CSRF Form token + validation advice
body: <p>I've got a submission form, with 9 fields, 6 of which require validation, including a upload field with file size and file type validation.</p>
  
  <p>Generating a random token, to prevent CSRF is working, but what is the correct way to validate when using a token?</p>
  
  <p>If I do the validation within the same file, the token is regenerated with the validation reload. (can this be prevented? I've tried <code>isset()</code> but still regenerates.) However using the same file prevents the users Name and Email from being stored in a session.</p>
  
  <p>Is it best to do the validation within a separate file, which then redirects back to the form with basic variables in the URL for each error, i.e. <code>http://www.example.com/form?n=1</code> </p>
  
  <p>Using a separate file would also mean storing the form data within session, so the form can be repopulated if errors exist on the redirect.</p>
  
  <p>Any help gratefully received.</p>