Session variable fails, php issue - php

Question

session_start();
$token = md5(uniqid(rand(), TRUE));
$_SESSION['token'] = $token;
This is how I start my code.
I , then, pass taht $token variable to a hidden field in the form:
<input type="hidden" name="token" value="<?php echo $token; ?>" />
but that condition is never true:
if($_POST['token'] == $_SESSION['token'])
{
echo 'Session was valid<br/>';
}
why?

Answer 1

Because you regenerate your token BEFORE checking it. You have to change it AFTER you're sure it's not the same

Answer 2

On page submit, a new value will be assigned to the session.
Try,
session_start();
if(!isset($_SESSION['token']))
{
$token = md5(uniqid(rand(), TRUE));
$_SESSION['token'] = $token;
}

Answer 3

Try echoing $_SESSION['token'] into the form instead of $token, in case you accidentally re-assigned it between the creation of the token and the form output.
I once had a problem very similar to this when I was developing something that took me ages to find, and it turned out that it was because I had left an <img src=''> in, because I didn't yet have the image - this caused the page to be requested again, since an empty src means 'this page', so the token was re-generated after the page was loaded.
Another thing to check is if the form's action attribute is missing, or some value that points to itself, the token maybe regenerated when the form is submitted, before the if (...) statement.

Answer 4

You could do something like this in order to prevent resetting the token on every page load:
session_start();
if (!isset($_SESSION['token']))
{
$token = md5(uniqid(rand(), TRUE));
$_SESSION['token'] = $token;
}
But... you may be better off session.referer_check or using some open source Session class that incorporates finer grained security than tacking this on top of the procedural standard. (if done correctly your code won't have to change wherever you actually use the session.)
see php.net/session_set_save_handler for more information.

Answer 5

the Code you provide is in one file and you submitting it to itself.
that regenerate the token and assign to the session variable. As said by "AVD" is the code to prevent the reassigning it
session_start();
if(empty($_SESSION['token'])){
$token = md5(uniqid(rand(), TRUE));
$_SESSION['token'] = $token;
}
then you can compare your condition where you are going to check.