note 108537 deleted from security.variables by danbrown

Note Submitter: step8601 at email dot com ---- "Now when processing the form... check the value of your token" What if a user legitimately goes to your site and generates a token and then uses that token and adds a dangerous fieldname to a static form that now has a legit token during the session? <form name="newform" action="index.php" method="post"> <input type="text" name="potentialeveilfield" value="" size 30 /> <input type="hidden" name="token" value="<?php echo maketoken(newform, $userid); //$userid here could be user profile id ?>" /> <input type="submit" /> </form> <form name="newform" action="index.php" method="post"> <input type="text" name="potentialeveilfield" value="" size 30 /> <input type="hidden" name="token" value="9l3j34509u0ueroiu34u345" /> <input type="submit" /> </form>