About Preventing Cross-Site Request Forgeries?
<p>I found these couple lines of code on the internet and the goal is to prevent CSRF using a one-time token. <strong>Since the hidden value can be easily read from the source code, i am trying to figure out what makes this code prevent cross site request forgeries? any idea?</strong></p>

<pre><code> **form.php** 
  &lt;?php 
    $token = md5(uniqid(rand(), TRUE));
    $_SESSION['token'] = $token;
    ?&gt;    
    &lt;form action="process.php" method="post"&gt;
    &lt;input type="hidden" name="token" value="&lt;?php echo $token; ?&gt;" /&gt;
    &lt;p&gt;
    Symbol: &lt;input type="text" name="symbol" /&gt;&lt;br /&gt;
    Shares: &lt;input type="text" name="shares" /&gt;&lt;br /&gt;
    &lt;input type="submit" value="Buy" /&gt;
    &lt;/p&gt;
    &lt;/form&gt;


**process.php**
   &lt;?php

    if ($_POST['token'] == $_SESSION['token'])
    {
        /* Valid Token */
    }

    ?&gt;
</code></pre>
