09-23-2017, 09:52 PM
Generally anytime I load another page with a form one of the two will fail because of the token being generated on every form load…are you suggesting I generate the token elsewhere? Wouldn’t I still have this issue though?
The token system doesn't technically care where the token is generated, but you do have to make sure it's after post.
So, if your page is
headers/includes
$_POST
Form1
Form2
You can do
headers/includes
$_POST
$token = Token::generate
form1 (with $token in a hidden field)
form2 (with $token in a hidden field)
The big thing people do when they try to generate the token outside the form is that they put it before $_POST so the token changes JUST BEFORE $_POST is read.
Since php reads the file in order, you submit the page, it reads the headers, processes post (including the token) and then generates a new token without breaking the old $_POST.
The token system doesn't technically care where the token is generated, but you do have to make sure it's after post.
So, if your page is
headers/includes
$_POST
Form1
Form2
You can do
headers/includes
$_POST
$token = Token::generate
form1 (with $token in a hidden field)
form2 (with $token in a hidden field)
The big thing people do when they try to generate the token outside the form is that they put it before $_POST so the token changes JUST BEFORE $_POST is read.
Since php reads the file in order, you submit the page, it reads the headers, processes post (including the token) and then generates a new token without breaking the old $_POST.