note 108537 added to security.variables

"Now when processing the form... check the value of your token" What if a user legitimately goes to your site and generates a token and then uses that token and adds a dangerous fieldname to a static form that now has a legit token during the session? <form name="newform" action="index.php" method="post"> <input type="text" name="potentialeveilfield" value="" size 30 /> <input type="hidden" name="token" value="<?php echo maketoken(newform, $userid); //$userid here could be user profile id ?>" /> <input type="submit" /> </form> <form name="newform" action="index.php" method="post"> <input type="text" name="potentialeveilfield" value="" size 30 /> <input type="hidden" name="token" value="9l3j34509u0ueroiu34u345" /> <input type="submit" /> </form> ---- Server IP: 69.147.83.197 Probable Submitter: 72.94.164.28 ---- Manual Page -- http://www.php.net/manual/en/security.variables.php Edit -- https://master.php.net/note/edit/108537 Del: integrated -- https://master.php.net/note/delete/108537/integrated Del: useless -- https://master.php.net/note/delete/108537/useless Del: bad code -- https://master.php.net/note/delete/108537/bad+code Del: spam -- https://master.php.net/note/delete/108537/spam Del: non-english -- https://master.php.net/note/delete/108537/non-english Del: in docs -- https://master.php.net/note/delete/108537/in+docs Del: other reasons-- https://master.php.net/note/delete/108537 Reject -- https://master.php.net/note/reject/108537 Search -- https://master.php.net/manage/user-notes.php