<?php
	require_once "lib/viewer_functions.php";

	//session_write_close();
	//session_name('csrf');
	//session_start();

	$preventAlerts = '';
	if (!isset($_SESSION['csrf']))						{ $preventAlerts .= "Warning - Parameter [_SESSION] not present!<br/>\n"; }
	else if (!isset($_REQUEST['csrf']))					{ $preventAlerts .= "Warning - Parameter [_REQUEST] not present!<br/>\n"; }
	else if (@$_SESSION['csrf'] !== @$_REQUEST['csrf'])	{ $preventAlerts .= "Warning - You are not authorized!<br/>\n"; }
	else												{ $preventAlerts .= "csrf Ok!<br/>\n"; }

?><html>
<head>
<title>Test $_SESSION</title>
</head>
<body>

<?php echo $preventAlerts; ?>

<form action="?" method="post">
  <input type="hidden" name="csrf" value="<?php $csrf = hash_hmac('md5', @$_SERVER['REQUEST_TIME'], 'xyz0123'). @$_SERVER['REQUEST_TIME']; @$_SESSION['csrf'] = $csrf; echo $csrf; ?>" />
  <input type="submit" id="btnPost" name="btnPost" value="Ok" />
</form>


$_SESSION : <?php var_dump($_SESSION['csrf']); ?><br />
$_REQUEST : <?php var_dump($_REQUEST['csrf']); ?>

<xmp><?php print_r($_SESSION); ?></xmp>

</body>
</html>