title: PHP form token usage and handling
body: <p>I'm a beginner working on a login script in PHP. This is the form token statement that I have so far:</p>
  
  <pre><code>$_SESSION["form_token"] = md5(rand(time (), true)) ;
  </code></pre>
  
  <p>The statement is issued just after the user indicates that he/she wants to login.</p>
  
  <p>My limited understanding is that the tokens purpose is to identify a unique user at a unique point in time and to disguise the form token information. </p>
  
  <p>Then everything becomes fuzzy. Here are my 3 open questions:</p>
  
  <ol>
  <li><p>When is the best time to "check" the form token for security purposes?  </p></li>
  <li><p>How do I check it?  </p></li>
  <li><p>When, if ever, do I "destroy" the form token? (IOW, would the form token stay "active" until the user logs out?</p></li>
  </ol>