using get token in php registration - php

Question

Ok when I get it prevents my validation(server side php) from working.
I have commented out the get token and my code works well, is there a reason for this?
code
<?php
require_once 'core/init.php';
if(Input::exists()) {
echo 'i have been run';
it works will i comment this line out //if(Token::check(Input::get('token'))) {
$validate = new Validate();
$validation = $validate->check($_POST, array(
'username' => array(
'required' => true,
'min' => 2,
'max' => 20,
'unique' => 'users'
),
'password' => array(
'required' => true,
'min' => 6
),
'password_again' => array(
'required' => true,
'matches' => 'password'
),
'name' => array(
'required' => true,
'min' => 2,
'max' => 50
)
));
if($validation->passed()) {
$user = new User();
$salt = Hash::salt(32);
try {
$user->create(array(
'username' => Input::get('username'),
'password' => Hash::make(Input::get('password'), $salt),
'salt' => $salt,
'name' => Input::get('name'),
'joined' => date('Y-m-d H:i:s'),
'group' => 1
));
Session::flash('home', 'You have been registered and now can log in!');
header('Location: index.php');
} catch(Exception $e) {
die($e->getMessage());
}
} else {
foreach($validation->errors() as $error) {
echo $error, '<br>';
}
}
}
//}
?>
Token.php
<?php
class Token {
public static function generate() {
return Session::put(Config::get('session/token_name'), md5(uniqid()));
}
public static function check($token) {
$tokenName = Config::get('session/token_name');
if(Session::exists($tokenName) && $token === Session::get($tokenName)) {
Session::delete($tokenName);
return true;
}
return false;
}
}
Hash.php
<?php
class Hash {
public static function make($string, $salt = '') {
return hash('sha256', $string . $salt);
}
public static function salt($length) {
return mcrypt_create_iv($length);
}
public static function unique() {
return self::make(uniqid());
}
}

Answer 1

It looks like you're using Laravel. If that's the case, there's already a CSRF filter that I think is accomplishing what you're trying to do.
See: /app/filters.php
Route::filter('csrf', function()
{
if (Session::token() != Input::get('_token') {
throw new Illuminate\Session\TokenMismatchException;
}
});
You can enforce this filter on a route like this:
Route::post('register', array('before' => 'csrf', function( ) {
return 'You gave a valid CSRF token!';
}));
See also: http://laravel.com/docs/html#csrf-protection