title: Something wrong with my PHP form Key class
body: <p>I'm following <a href="http://code.tutsplus.com/tutorials/secure-your-forms-with-form-keys--net-4753" rel="nofollow">this tutorial</a> to try and make a PHP Form Key Validation script. For some reason, my constructor is not creating a value for my <code>$old_formKey</code> variable.</p>
  
  <p>The tutorial mentions that Singletons are more secure, but it doesn't go into the implementation. I know basic principles of OOP with Java, but I don't know much about PHP OOP Principles. I was just trying to wing it by making the class variables static--and I think this is where my problem is. However, when my constructor is called, it is supposed to give <code>$old_formKey</code> the value of <code>$_POST[form_key]</code> "if isset()"</p>
  
  <p>I am not able to get the constructor to place the value of the old formKey in the desired variable space.</p>
  
  <p>So this is where I'm having problems.</p>
  
  <pre><code>&lt;?php
  class formKey
  {
      private static $formKey;
  
      private static $old_formKey;
  
      public function validate()
      {
          echo $_POST['form_key'];
          //We use the old formKey and not the new generated version
          if($_POST['form_key'] == $old_formKey) {
              //The key is valid, return true.
              return true;
          }
          else {
              //The key is invalid, return false.
              return false;
          }
      }
  }
  ?&gt;
  </code></pre>
  
  <p>My formKey validation script looks something like this.</p>
  
  <pre><code>&lt;?php
  if ($_SERVER["REQUEST_METHOD"] == "POST") {
      //Validate the form key
      if(!isset($_POST['form_key']) || !$formKey-&gt;validate()) {
          //Form key is invalid, show an error
          $error_msg = 'Security Error.';
          $die = "die";
      }
      else {
          /*continue validation*/
      } 
  }
  ?&gt;
  </code></pre>
  
  <p>The script returns the error message and then displays it because <code>$old_formKey</code> is never given a value inside of the <code>validate()</code> method.</p>
  
  <p>For some reason, I cannot modify the class variable from within the <code>validate()</code> method. Sorry if this has been addressed before. I honestly looked and couldn't find it!</p>
  
  <pre><code>function __construct()
  {
      //We need the previous key so we store it
      if(isset($_SESSION['form_key']))
      {
          self::$old_formKey = $_SESSION['form_key'];
      }
  }
  </code></pre>
  
  <p>Sorry I forgot to include my constructor. It has been added above.</p>