


How do I prevent cross-site request forgery (CSRF) attacks in PHP?
Jun 28, 2025 am 02:25 AMTo prevent CSRF attacks in PHP, implement anti-CSRF tokens. 1) Generate and store secure tokens using random_bytes() or bin2hex(random_bytes(32)), save them in $_SESSION, and include them in forms as hidden inputs. 2) Validate tokens on submission by strictly comparing the POST token with the session-stored one; reject mismatched requests with a 403 error. 3) Protect AJAX/API requests by including the token in headers or body, often retrieved from a meta tag. 4) Use htmlspecialchars() when outputting tokens to prevent XSS leaks. 5) Regenerate tokens after critical actions like login. 6) Set SameSite=Strict/Lax for session cookies and avoid GET for state changes. 7) Re-authenticate users for sensitive actions. These steps ensure comprehensive CSRF protection across all request types while maintaining security integrity.
To prevent CSRF attacks in PHP, you need to implement a solid anti-CSRF strategy—mainly by using tokens. The idea is simple: every state-changing request (like form submissions) should include a unique, unpredictable token that only the legitimate user knows. Without this token, the server shouldn’t process the request.
Here’s how to actually do it well in practice.
Generate and Store Anti-CSRF Tokens
Every time you display a form that performs an action (like submitting settings or making a purchase), generate a secure token and store it somewhere safe on the server side—like in the session.
- Use
random_bytes()
orbin2hex(random_bytes(32))
to create a strong token. - Save it in
$_SESSION
so you can compare it later when the form is submitted.
For example:
if (empty($_SESSION['csrf_token'])) { $_SESSION['csrf_token'] = bin2hex(random_bytes(50)); }
Then in your form:
<input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
This way, each form submission includes a token that the attacker can't guess or reproduce.
Validate the Token on Form Submission
When the form is submitted, check if the token in the POST data matches what’s stored in the session.
- Always check for the presence of the token.
- Compare it strictly (
===
) to avoid type-juggling issues. - If it doesn’t match, reject the request with a 403 error or similar.
Example code:
if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) { http_response_code(403); die('Invalid CSRF token.'); }
A small but important detail: always use htmlspecialchars()
when outputting the token into HTML to prevent XSS from leaking the token.
Also, don’t forget to rotate or regenerate the token after critical actions like login or password change.
Don’t Forget AJAX Requests and APIs
If your site uses JavaScript to submit forms or make API calls, those requests also need CSRF protection.
- Include the CSRF token in the headers or body of the AJAX request.
- You can store the token in a meta tag or inline script and read it from there when making the call.
For example, set a meta tag in your HTML head:
<meta name="csrf-token" content="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
Then in your JS:
fetch('/update-profile', { method: 'POST', headers: { 'X-CSRF-Token': document.querySelector('meta[name="csrf-token"]').content }, body: new URLSearchParams({ name: 'John Doe' }) });
On the backend, look for the token in the X-CSRF-Token
header and validate it just like with regular forms.
One thing to note: if you're building a single-page app (SPA) or mobile app that talks to your PHP backend, consider using same-site cookies and CSRF tokens together for better protection.
Bonus Tips: SameSite Cookies and HTTP-Only Forms
Even with tokens, there are extra steps you can take:
- Set
SameSite=Strict
orLax
on your session cookie to reduce cross-origin requests. - Make sure your forms only accept POST requests where needed—don’t allow GET-based state changes.
- For sensitive operations (like deleting an account), re-authentication helps add another layer.
These aren’t replacements for CSRF tokens, but they work well alongside them.
That’s basically it. CSRF protection in PHP boils down to generating good tokens, validating them properly, and making sure they’re included in all relevant requests. It’s not overly complex, but easy to mess up if you skip even one step.
The above is the detailed content of How do I prevent cross-site request forgery (CSRF) attacks in PHP?. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

To merge two PHP arrays and keep unique values, there are two main methods. 1. For index arrays or only deduplication, use array_merge and array_unique combinations: first merge array_merge($array1,$array2) and then use array_unique() to deduplicate them to finally get a new array containing all unique values; 2. For associative arrays and want to retain key-value pairs in the first array, use the operator: $result=$array1 $array2, which will ensure that the keys in the first array will not be overwritten by the second array. These two methods are applicable to different scenarios, depending on whether the key name is retained or only the focus is on

exit() is a function in PHP that is used to terminate script execution immediately. Common uses include: 1. Terminate the script in advance when an exception is detected, such as the file does not exist or verification fails; 2. Output intermediate results during debugging and stop execution; 3. Call exit() after redirecting in conjunction with header() to prevent subsequent code execution; In addition, exit() can accept string parameters as output content or integers as status code, and its alias is die().

The rational use of semantic tags in HTML can improve page structure clarity, accessibility and SEO effects. 1. Used for independent content blocks, such as blog posts or comments, it must be self-contained; 2. Used for classification related content, usually including titles, and is suitable for different modules of the page; 3. Used for auxiliary information related to the main content but not core, such as sidebar recommendations or author profiles. In actual development, labels should be combined and other, avoid excessive nesting, keep the structure simple, and verify the rationality of the structure through developer tools.

There are two ways to create an array in PHP: use the array() function or use brackets []. 1. Using the array() function is a traditional way, with good compatibility. Define index arrays such as $fruits=array("apple","banana","orange"), and associative arrays such as $user=array("name"=>"John","age"=>25); 2. Using [] is a simpler way to support since PHP5.4, such as $color

When you encounter the prompt "This operation requires escalation of permissions", it means that you need administrator permissions to continue. Solutions include: 1. Right-click the "Run as Administrator" program or set the shortcut to always run as an administrator; 2. Check whether the current account is an administrator account, if not, switch or request administrator assistance; 3. Use administrator permissions to open a command prompt or PowerShell to execute relevant commands; 4. Bypass the restrictions by obtaining file ownership or modifying the registry when necessary, but such operations need to be cautious and fully understand the risks. Confirm permission identity and try the above methods usually solve the problem.

The way to process raw POST data in PHP is to use $rawData=file_get_contents('php://input'), which is suitable for receiving JSON, XML, or other custom format data. 1.php://input is a read-only stream, which is only valid in POST requests; 2. Common problems include server configuration or middleware reading input streams, which makes it impossible to obtain data; 3. Application scenarios include receiving front-end fetch requests, third-party service callbacks, and building RESTfulAPIs; 4. The difference from $_POST is that $_POST automatically parses standard form data, while the original data is suitable for non-standard formats and allows manual parsing; 5. Ordinary HTM

To safely handle PHP file uploads, you need to verify the source and type, control the file name and path, set server restrictions, and process media files twice. 1. Verify the upload source to prevent CSRF through token and detect the real MIME type through finfo_file using whitelist control; 2. Rename the file to a random string and determine the extension to store it in a non-Web directory according to the detection type; 3. PHP configuration limits the upload size and temporary directory Nginx/Apache prohibits access to the upload directory; 4. The GD library resaves the pictures to clear potential malicious data.

InPHP,variablesarepassedbyvaluebydefault,meaningfunctionsorassignmentsreceiveacopyofthedata,whilepassingbyreferenceallowsmodificationstoaffecttheoriginalvariable.1.Whenpassingbyvalue,changestothecopydonotimpacttheoriginal,asshownwhenassigning$b=$aorp
