A short script to make a CSRF token to be used in my html elements such as inputs, file-uploads, scripts, iframes & svgs.

        if (NULL || empty($_SESSION['csrf_token'])){ // Cross Site Request Forgery ::(Token.). 
            $_SESSION['csrf_token']= bin2hex(random_bytes(28).openssl_random_pseudo_bytes(7));

Above Is the Old Version that was Posted Last Year, Just Revisited this Project and Added some to to this. Posted Below.


    header('Access-Control-Allow-Origin: *'); // Remove this when Uploaded to live server. only here for CORS Warnings.

     $GuestUsr = "BaseUsr";

         if (NULL || undefined || empty($_SESSION['csrf_token'])){              // Cross Site Request Forgery ::(Token.). 
             $_SESSION['csrf_token']  = bin2hex(random_bytes(28).openssl_random_pseudo_bytes(7));
             }                                                      // Shouldn't use MD5 anymore apparently.

        $_SESSION['hits']++;    // Increment a very Basic Page Counter.
        $_SESSION['in_Session'] = '1';

        $_SESSION["is_guest"] = true;
        $_SESSION["loggedIn"] = false;
        $_SESSION["has_priv"] = false;
            if($SESSION["is_guest"] = true){
                $_SESSION["loggedIn"] = false;
            } elseif ($_SESSION["loggedIn"] = true) {
                $_SESSION["is_guest"] = false;
                $_SESSION["has_priv"] = 1;           // Will be different privaledge levels. 1>7...

        $csrf = bin2hex(16);
        $cookie = bin2hex(32);
        $hashish_cookie = bin2hex(64);

        if (isset($_SESSION['loggedIn']) && $_SESSION['loggedIn'] == true) {
            echo "Welcome to the member's area, " . $_SESSION['username'] . "!";
        } else {
            echo "Please log in first to see this page.";

Also Just Downloaded Some generic Code from PhpJabbers, But Noticed when studying there code they have included: @session_start() instead of the normal session_start() that I see everywhere else. Does anybody Know what the @ does? Appart from Suppressing Warnings and Errors... Google or PHP Docs have no reference to this?

Can this be made better? I saw a very complex one using regex but this is my implementation so far.

Having Just Read These Answers:
CSRF implementation => SO Quest.
I might change it to use: openssl_random_pseudo_bytes(16) or a combination of both.

Questions that I have which I still don't understand in PHP.

1) Is $_SESSION['Tokens']; a fixed list of variables that I can call upon to do certain jobs? Or can I make my own Up like $_SESSION['MyStoredSumthing']?

2) Are all $_UPPERCASE considered GLOBAL.

3) Currently I have My CSRF & Cookie Codes, in the head of my document, That is included in every single page. Is this bad practice as every time a page is requested its going to be running through my php script & creating or over-riding The CSRF and/or cookie with either the same value or a different new value. if its being stored in the SESSION which makes it available to all subsequent pages. Then calling this php every page load is wrong? is this correct? I'm trying to build my pages more towards MVC but still gotta go through and get rid of all the mysql_functions.

4) All Mysql_functions are deprecated. Does this include mysqli?

         Another tutorial that I watched used uniqid() wrapped inside of an MD5 hashing function, but from the Documents and articles that I have read MD5 is deprecated & wrapping uniqid inside of a hashing function destroys the purpose and intent of uniqid() which is to create a guid or as close to possible to a one time unique number.. Another part used mcrypt_create_iv() which is also deprecated...

Other Questions That I can find related to CSRF & Token generation:
Update Soon.

  • 1
    \$\begingroup\$ For this purpose I don't think you need such a complex token. Something like random_bytes(16) (64 bits) should be enough. I won't downvote your question, but for Code Review, there is very little code in your question. \$\endgroup\$ Aug 20, 2019 at 19:37
  • \$\begingroup\$ I know. I mainly just put it here because I added The NULL Part and have no way of testing if its NULL What would happen. \$\endgroup\$
    – Ryan Stone
    Aug 20, 2019 at 19:39
  • 2
    \$\begingroup\$ The NULL || bit doesn't do anything. You can leave it out. \$\endgroup\$ Aug 20, 2019 at 20:33
  • \$\begingroup\$ @KIKO Software Surely it is better to check whether the value is NULL or Undefined otherwise an attacker could set it to either one of these and then the part of the code that builds the csrf token would never run? ie it would just skip straight past that if statement? No? \$\endgroup\$
    – Ryan Stone
    Feb 16, 2020 at 23:43
  • \$\begingroup\$ No. There is no check when you use NULL || or undefined ||. They represent constant values which will always evaluate to FALSE. So when you say: NULL || undefined || empty($_SESSION['csrf_token']), you could as well say: FALSE || FALSE || empty($_SESSION['csrf_token']), or shorter: empty($_SESSION['csrf_token']). \$\endgroup\$ Feb 17, 2020 at 11:26


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.