title: Is this enough for CSRF protection?
body: <p>Is this enough for CSRF protection:</p>
  
  <ul>
  <li>A random string is generated, <code>$_SESSION['hash']</code> stores it</li>
  <li>A hidden value (in <code>$_POST['thing']</code>) in a form contains the random string</li>
  <li>When the form is submitted, it checks if <code>$_SESSION['hash']</code> equals <code>$_POST['thing']</code>, and continues if they match</li>
  </ul>
  
  <p>One of my site's users keeps telling me that my site is vulnerable, but I can't tell if he's just trolling me. Is there anything else that I can do?</p>