title: Are we really secured from CSRF?
body: <p>confirm.php</p>
  
  <blockquote>
  <pre><code>&lt;?php
   session_start();
   $token= md5(uniqid());
   $_SESSION['delete_customer_token']= $token;
   session_write_close();
  ?&gt;
  &lt;form method="post" action="confirm_save.php"&gt;
  &lt;input type="hidden" name="token" value="&lt;?php echo $token; ?&gt;" /&gt;
  Do you really want to delete?
  &lt;input type="submit" value=" Yes " /&gt;
  &lt;input type="button" value=" No " onclick="history.go(-1);" /&gt;
  </code></pre>
  </blockquote>
  
  <p>confirm_save.php</p>
  
  <pre><code>&lt;?php
   session_start();
   $token= $_SESSION['delete_customer_token'];
   unset($_SESSION['delete_customer_token']);
   session_write_close();
   if ($_POST['token']==$token) {
     // delete the record
   } else {
     // log potential CSRF attack.
   }
  ?&gt;
  </code></pre>
  
  <p>Lets say we have a typical CSRF protection like this one
  What if an attacket uses this code to bypass the csrf token?</p>
  
  <pre><code>//On any site
  &lt;img src="http://cia.teletubbies.com/csrf.php" height="0" weight="0"/&gt;
  
  //csrf.php
  $cont = get_file_contents("http://cia.google.com/confirm.php");
  // parse the html using [PHP Simple HTML DOM Parser][2] and get the CSRF token
  //CURL and send a POST request to confirm_save.php with the token
  </code></pre>
  
  <p>This thing keeps bugging me, but im too lazy to try an attack on any random site. Isnt this is possible?</p>
  
  <p><em>The example code was stolen from <a href="https://stackoverflow.com/questions/1780687/preventing-csrf-in-php/1780726#1780726">preventing csrf in php</a></em></p>
  
  <p><strong>Updated</strong></p>
  
  <p>What happens when someone wants to pass a token from one platform to another or from server side to the client side? Flash to PHP for instance, how could its secure from csrf?</p>