Prevent an attacker from intercepting submitted form data
<p>I have a problem with PHP. A user is stealing my form data to process. Here you can better see the PHP code:<br></p>

<pre><code>&lt;?php

    session_name("name_session");
    session_start();

    $secret = md5(uniqid(rand(), true));
    $_SESSION['FORM_SECRET'] = $secret;
    $_SESSION = array();
    require_once('recaptchalib.php');
    $captcha_publickey = "xxxx";
    $captcha_privatekey = "xxx";
    $error_captcha = null;
    if ($_POST){
        $captcha_respuesta = recaptcha_check_answer ($captcha_privatekey, $_SERVER["REMOTE_ADDR"], $_POST["recaptcha_challenge_field"], $_POST["recaptcha_response_field"]);
        if ($captcha_respuesta-&gt;is_valid) {
            if (isset($_POST['enviar'])) { 
                $username = "xxxx";
                $pass = "xxxx";
                $nop = $_POST['pais'].$_POST['no'];
                $mensaje = stripslashes($_POST['mensg']);  
                $len = strlen($mensaje);
                if ($len &gt; 160){
                    $cSMS = $len/160;
                    $cSMS = number_format($cSMS,1);
                    $cSMS = substr($cSMS,0,1);
                }else{
                    $cSMS=1;
                }

//-------------------------------------------------

                $postdata = "p_num_text=$nop&amp;smstemplate=&amp;message=$mensaje&amp;txtcount=$len char : $cSMS Sms&amp;hiddcount=153";
                if ($nop != "" &amp;&amp; $mensaje != ""){
                    $ch = curl_init();
//------------- Login ------------------
                    curl_setopt($ch, CURLOPT_URL, "http://subdomain.dyndns.org/usuario/index.php");
                    curl_setopt($ch, CURLOPT_REFERER, "http://subdomain.dyndns.org/usuario/index.php");
                    curl_setopt ($ch, CURLOPT_POST, 1);
                    curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13");
                    curl_setopt ($ch, CURLOPT_POSTFIELDS, "app=page&amp;inc=login&amp;op=auth_login&amp;username=$username&amp;password=$pass");
                    curl_setopt ($ch, CURLOPT_COOKIEJAR, "cookieb.txt");
                    curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
                    $login = curl_exec ($ch);
           //----------------- Send SMS -------------------
                    curl_setopt($ch, CURLOPT_URL, "http://subdomain.dyndns.org/usuario/index.php?app=menu&amp;inc=send_sms&amp;op=sendsmstopv_yes");
                    curl_setopt($ch, CURLOPT_REFERER, "http://subdomain.dyndns.org/usuario/index.php?app=menu&amp;inc=send_sms&amp;op=sendsmstopv");
                    curl_setopt ($ch, CURLOPT_POST, 1);
                    curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13");
                    curl_setopt ($ch, CURLOPT_POSTFIELDS, $postdata);
                    //curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookie.txt');
                    curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
                    $send = curl_exec ($ch);

                    $search = strpos($send, "Your SMS has been delivered to queue");
                    if ($search === false) {
                        $errSuc = "Your SMS has been seend";
                    }else{
                        $errSuc = "Message: $mensaje &lt;br&gt; To: $nop &lt;br&gt; Sent Successfully.";

                //----------------------------------------------
                    }

                }
            }

        }else{
            $error = "&lt;div class='blue'&gt;code bad writing&lt;/div&gt;";
            $error_captcha = $captcha_respuesta-&gt;error;
        }
    }
    if (ini_get("session.use_cookies")) {
        $params = session_get_cookie_params();
        setcookie(session_name(), '', time() - 42000, $params["path"], $params["domain"], $params["secure"], $params["httponly"]);
    }

    session_destroy();

?&gt;
</code></pre>

<p>What do you think? How to fix this bug. Thanks!!</p>
