title: reason for using a token in HTML form and checking in PHP code
body: <p>In a code i have seen this creation of token for a login page:</p>
  
  <p><code>$token = $_SESSION['token'] = md5(uniqid(mt_rand(),true));</code></p>
  
  <p>Then this token is echoed as a hidden input in the login form and on submitted, php code to validate login also checks this token like:</p>
  
  <pre><code>public function isTokenValid()
  {
    return (!isset($_SESSION['token']) || $this-&gt;_token != $_SESSION['token'])? 0 : 1;
  }
  </code></pre>
  
  <p>What is the use of this token ?</p>
  
  <p><strong>Edit:</strong> This page is describes the use of it: <a href="https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet" rel="noreferrer">https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet</a></p>