Is this enough to protect CSRF?

Question

This is enough to protect CSRF:

• A random string is produced, $_SESSION['hash']stores it
• The hidden value (in $_POST['thing']) in the form contains a random string
• When the form is submitted, it checks to see if it is equal $_SESSION['hash'] $_POST['thing'], and continues if they match

One of my site users tells me that my site is vulnerable, but I can’t say if it just trolled me. Is there anything else I can do?

Answer 1

, . , , . . , , , 100% .

, , - , , CSRF? .

, - , , php . , ssh telnet. , .

, cookie cookie.

, CSRF, . , , , , , .

Answer 2

, , , .

Chris CRSF. :

• CSRF- (-CSRF-), .
• ,
• , , CSRF . ( ), . .

Answer 3

, , , .

, . , . , , .

Answer 4

from: http://en.wikipedia.org/wiki/Cross-site_request_forgery

• cookie
• HTTP-
• captcha -

, ...